Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings
    to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute
    code submitted by the DAG author. Users are advised to upgrade to version 2.10.1 or later, which has fixed
    the vulnerability. (CVE-2024-45034)

ID	Name	Product	Family	Type	Severity
462119	Echo: apache-airflow: security update to 2.10.1	Tenable Cloud Security	Echo Local Security Checks	Local	high
462119	Echo: apache-airflow: security update to 2.10.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
412975	SCA: security update for apache-airflow (GHSA-92xg-gmrq-5c3w)	Tenable Cloud Security	SCA Checks	Local	high
412975	SCA: security update for apache-airflow (GHSA-92xg-gmrq-5c3w)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2024-45034

high

Tenable Plugins

high

high

high

high