CVE-2024-45498: Apache Airflow: Command Injection in an example DAG
Example DAG: exampleinleteventextra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the dangerous example; see https://github.com/apache/airflow/pull/41873 for more information. We recommend against exposing the example DAGs in your deployment. If you must expose the example DAGs, upgrade Airflow to version 2.10.1 or later.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45498?
CVE-2024-45498 has a severity rating that indicates it poses a significant risk due to the potential for arbitrary command execution by authenticated users.
How do I fix CVE-2024-45498?
To remediate CVE-2024-45498, upgrade Apache Airflow to version 2.10.1 or later.
Who is affected by CVE-2024-45498?
CVE-2024-45498 affects users of Apache Airflow version 2.10.0 who have implemented the example DAG example_inlet_event_extra.py.
What can an attacker do with CVE-2024-45498?
An attacker exploiting CVE-2024-45498 can execute arbitrary commands on the server with only DAG trigger permissions.
Is any specific configuration required to be vulnerable to CVE-2024-45498?
Yes, the vulnerability specifically affects those who have used the example DAG as a base for their own DAG implementations.