CVE-2024-28746

High

Description

Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access. Users of Apache Airflow are recommended to upgrade to version 2.8.3 or newer to mitigate the risk associated with this vulnerability

SeverityHigh

CVSS8.1

Exploit probability—

Product

Apache Airflow

PublishedMar 14, 2024

First seenMar 14, 2024

Weakness typeCWE-281CWE-281

How to fix

Update

apache airflow2.8.3 or later
apache-airflow2.8.3rc1 or later

Patches

github.com/apache/airflow/pull/37881

Vendor advisories

lists.apache.org/thread/b4pffc7w7do6qgk4jjbyxvdz5odrvny7

Affected products

Product	Affected versions	Fixed in
apache airflow	2.8.0 ≤ v < 2.8.3	2.8.3
apache-airflowPyPI	2.8.0 ≤ v < 2.8.3rc1	2.8.3rc1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.