PT-2026-21670 · Apache · Apache Airflow

Seokchan Yoon · Published 2026-02-24 · Updated 2026-03-01 · CVE-2024-56373

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.11.1

Description A user with DAG author permissions can manipulate the Airflow database to execute arbitrary code within the web server context. This could lead to remote code execution on the server-side when a user views historical task information. The functionality responsible for this issue, log template history, is disabled by default in version 2.11.1. The issue involves Server-Side Template Injection (SSTI) through shared database information.

Recommendations Upgrade to Airflow version 2.11.1 or later. If you require log template history, upgrade to Airflow 3. Manually modify historical log file names if you need to view logs generated before the last log template change.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BIT-AIRFLOW-2024-56373

CVE-2024-56373

GHSA-R837-HPV7-PC2F

Affected Products

Apache Airflow

References · 15

• https://github.com/apache/airflow/pull/61880 · Patch
• https://osv.dev/vulnerability/CVE-2024-56373 · Vendor Advisory
• https://lists.apache.org/thread/2vrmrhcht6g7cp5yjxpnrk2wtrncm6cy · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2024-56373 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56373 · Security Note
• https://osv.dev/vulnerability/GHSA-r837-hpv7-pc2f · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://twitter.com/cracbot/status/2027700480298914242 · Twitter Post
• https://twitter.com/cracbot/status/2028062791106748862 · Twitter Post
• https://t.me/cveNotify/152989 · Telegram Post
• https://t.me/CVEtracker/45587 · Telegram Post
• https://twitter.com/CVEnew/status/2026265014399615093 · Twitter Post
• http://openwall.com/lists/oss-security/2026/02/23/3 · Note
• https://t.me/cveNotify/152985 · Telegram Post
• https://twitter.com/oss_security/status/2026102106172661771 · Twitter Post