PT-2024-2130 · Apache · Apache Airflow

H1_Yusuf + 1 · Published 2024-03-01 · Updated 2024-11-01 · CVE-2024-26280

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.8.2

Description The issue is related to incorrect default permissions in Apache Airflow, allowing authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With version 2.8.2 and newer, Ops and Viewer users do not have audit log permission by default and need to be explicitly granted permissions to see the logs. Only admin users have audit log permission by default.

Recommendations For Apache Airflow versions prior to 2.8.2, upgrade to version 2.8.2 or newer to mitigate the risk associated with this issue.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

BDU:2024-02029

BIT-AIRFLOW-2024-26280

CVE-2024-26280

GHSA-6XWF-XVF3-V459

PYSEC-2024-42

Affected Products

Apache Airflow

References · 22

• https://github.com/apache/airflow/pull/37501 · Patch
• https://bdu.fstec.ru/vul/2024-02029 · Security Note
• https://lists.apache.org/thread/knskxxxml95091rsnpxkpo1jjp8rj0fh · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2024-26280 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26280 · Security Note
• https://osv.dev/vulnerability/GHSA-6xwf-xvf3-v459 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-42 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-26280 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/f2ea8a3e1753012bfe0d529c9c8be66cf55ca28f · Note
• https://github.com/apache/airflow/commit/8324c87e05741e5a673c43b315619a3788bacc2e · Note
• https://github.com/apache/airflow/commit/8463ee4f25114a6c5fb2408d6026afe94bdf106d · Note
• https://github.com/apache/airflow/commit/f4b9cc74976b7df1acbc3c63471b5751b3e2c40c · Note
• https://github.com/apache/airflow/commit/1a96407cd2d76616c1137de288f092d4f3b097fa · Note
• https://github.com/apache/airflow/commit/7f10998c17ab9d725bc8671deb4c12d672bfba99 · Note