PT-2021-17095 · Apache · Apache Airflow

Ian Carroll · Published 2021-02-17 · Updated 2024-03-06 · CVE-2021-26697

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Airflow version 2.0.0

Description The issue concerns the lineage endpoint of the deprecated Experimental API in Apache Airflow, which was not protected by authentication. This allowed unauthenticated users to access the endpoint. The attacker needs to be aware of certain parameters to pass to the endpoint, and even then, they can only obtain some metadata about a DAG and a Task. This is considered a low-severity issue.

Recommendations For Apache Airflow version 2.0.0, consider disabling access to the lineage endpoint of the deprecated Experimental API until a patch is available. Restricting access to this endpoint can minimize the risk of exploitation. Additionally, be cautious when using the endpoint, as it may allow unauthorized access to certain metadata. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Improper Authentication

Missing Authentication

Weakness Enumeration

CWE-269

CWE-287

CWE-306

Related Identifiers

BIT-AIRFLOW-2021-26697

CVE-2021-26697

GHSA-FH37-CX83-Q542

PYSEC-2021-3

Affected Products

Apache Airflow

References · 21

• https://osv.dev/vulnerability/BIT-airflow-2021-26697 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26697 · Security Note
• https://osv.dev/vulnerability/GHSA-fh37-cx83-q542 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-26697 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/21cedff205e7d62675949fda2aa4616d77232b76 · Note
• https://github.com/apache/airflow/commit/93957e917ff4cfb0be11aef088bd9527cf728a04 · Note
• https://github.com/apache/airflow/commit/24a54242d56058846c7978130b3f37ca045d5142 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2021-3.yaml · Note
• https://t.me/cvenotify/34202 · Telegram Post
• https://github.com/advisories/GHSA-fh37-cx83-q542 · Note
• https://lists.apache.org/thread.html/re21fec81baea7a6d73b0b5d31efd07cc02c61f832e297f65bb19b519%40%3Cusers.airflow.apache.org%3E · Note
• https://t.me/cibsecurity/23751 · Telegram Post
• https://lists.apache.org/thread.html/r36111262a59219a3e2704c71e97cf84937dae5ba7a1da99499e5d8f9@%3Cannounce.apache.org%3E · Note