CVE-2024-45034

high

Description

Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.

References

https://lists.apache.org/thread/b4fcw33vh60yfg9990n5vmc7sy2dcgjx

https://github.com/apache/airflow/pull/41672

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-0013

http://www.openwall.com/lists/oss-security/2024/09/06/3

Details

Source: Mitre, NVD

Published: 2024-09-07

Updated: 2025-06-03

Named Vulnerability: GHSA-92xg-gmrq-5c3w

Risk Information

CVSS v2

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity: High

CVSS v4

Base Score: 8.7

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.01688