VULNERABILITY INTELLIGENCE

CVE-2024-27906

CVSS score5.9 MEDIUM
EPSS probability0.34%
CISA KEVNot currently listed
Published2024-02-29
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Description

Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI. Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability

Weakness classification

  • security@apache.org: CWE-862
  • nvd@nist.gov: CWE-862

Primary references