CVE-2021-26559: CWE-284 Improper Access Control on Configurations Endpoint for the Stable API

Published Feb 17, 2021

Updated

Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when [webserver] exposeconfig is set to False in airflow.cfg. This allowed a privilege escalation attack. This issue affects Apache Airflow 2.0.0.

Affected Software

2 affected componentsFixes available

Apache Airflow=2.0.0

pip/apache-airflow=2.0.0

2.0.1rc1

Event History

Feb 17, 2021

CVE Published

via MITRE·02:15 PM

Data Sourced

via MITRE·02:15 PM

DescriptionWeakness

Apr 7, 2021

Advisory Published

via GitHub·09:05 PM

Frequently Asked Questions

What is CVE-2021-26559?

CVE-2021-26559 is a vulnerability in Apache Airflow that allows users with Viewer or User role to access sensitive information.

What is the severity of CVE-2021-26559?

CVE-2021-26559 has a severity rating of medium (6.5).

How does CVE-2021-26559 affect Apache Airflow?

CVE-2021-26559 allows users with Viewer or User role to access sensitive information in Apache Airflow.

How can CVE-2021-26559 be fixed?

To fix CVE-2021-26559, update to Apache Airflow version 2.0.1.

What is CWE-269 and CWE-284?

CWE-269 refers to improper privilege management, while CWE-284 refers to improper access control.