CVE-2024-45034: Apache Airflow: Authenticated DAG authors could execute code on scheduler nodes
Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45034?
CVE-2024-45034 is considered a critical vulnerability due to the potential for unauthorized code execution.
How do I fix CVE-2024-45034?
To mitigate CVE-2024-45034, upgrade Apache Airflow to version 2.10.1 or later.
What versions are affected by CVE-2024-45034?
Apache Airflow versions before 2.10.1 are affected by CVE-2024-45034.
What is the main impact of CVE-2024-45034?
The main impact of CVE-2024-45034 is that DAG authors can run untrusted code on the scheduler.
Who is at risk from CVE-2024-45034?
Users of Apache Airflow versions prior to 2.10.1, especially those using DAGs authored by untrusted sources, are at risk from CVE-2024-45034.