CVE-2024-45498

Advisory

Affected versions of Apache Airflowcontain a critical vulnerability in the example DAG file "example_inlet_event_extra.py". This flaw allows authenticated attackers with only DAG trigger permission to execute arbitrary commands on the Airflow worker. Users who have based their DAGs on this example may be at risk. It is strongly recommended to avoid exposing example DAGs in production environments. Additionally, review all DAGs derived from this example for similar security issues.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://lists.apache.org/thread/tl7lzczcqdmqj2pcpbvtjdpd2tb9561n
• https://github.com/apache/airflow/pull/41873
• https://github.com/advisories/GHSA-c392-whpc-vfpr
• https://github.com/apache/airflow/commit/09ec2616568f8a18e0d5fe408110fae06ddf748f
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45498