CVE-2021-38540

Apache Airflow: Variable Import endpoint missed authentication check

The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow >=2.0.0, <2.1.3.

Affected

Apache Software Foundation · Apache Airflow

CVSS v4.0 GitHub

9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

80.94% chance of exploitation in the next 30 days, 100th percentile

Nuclei

critical

Published

2021-09-09

Updated

2024-08-04

Proof-of-concept exploits (1)

• Captain-v-hook/PoC-for-CVE-2021-38540-4★ · 2022-06-13

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38540.yaml

Security advisories

• https://lists.apache.org/thread.html/rb34c3dd1a815456355217eef34060789f771b6f77c3a3dec77d…
• advisories/GHSA-h88f-r7cw-8fv3

References

• CVE Record
• NVD entry