PT-2022-5600 · Apache · Apache Airflow

L3Yx · Published 2022-11-14 · Updated 2026-02-20 · CVE-2022-40127

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.4.0

Description A vulnerability in Example Dags of Apache Airflow is related to incorrect management of code generation. This issue allows an attacker with UI access who can trigger DAGs to execute arbitrary commands via the manually provided run id parameter. The exploitation of this vulnerability may enable a remote attacker to execute arbitrary commands.

Recommendations For versions prior to 2.4.0, update to version 2.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the run id parameter in the affected DAGs to minimize the risk of exploitation. Additionally, limiting UI access to trusted users can help reduce the attack surface.

Exploit

Fix

OS Command Injection

Code Injection

Weakness Enumeration

CWE-78

CWE-94

Related Identifiers

BDU:2022-06963

BIT-AIRFLOW-2022-40127

CVE-2022-40127

GHSA-6PW3-8H9W-32GC

PYSEC-2022-42982

Affected Products

Apache Airflow

References · 22

• 🔥 https://github.com/Mr-xn/CVE-2022-40127 · Exploit
• https://github.com/apache/airflow/pull/25960 · Patch
• https://osv.dev/vulnerability/CVE-2022-40127 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2022-40127 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40127 · Security Note
• https://osv.dev/vulnerability/GHSA-6pw3-8h9w-32gc · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-42982 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2022-40127 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06963 · Security Note
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/372e699c2d1e11f7087b5340454d0a0a6a56fbf5 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2022-42982.yaml · Note
• https://github.com/anvbis/chrome.v8.n-days · Note
• https://t.me/apt_notes/843 · Telegram Post
• https://lists.apache.org/thread/cf132hgm6jvzvsbpsozl3plf1r4cwysy · Note