CVE-2024-56373: Apache Airflow Code Injection Vulnerability via LogTemplate Table
Summary
CVE-2024-56373: Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate table. Affects apache-airflow versions < 2.11.1. Fixed in 2.11.1. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2024-56373 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. It allows users to define workflows as Directed Acyclic Graphs (DAGs) and provides a rich user interface to visualize and manage these workflows. However, a critical vulnerability has been identified in version 2.11.1 and earlier, which could allow unauthorized code execution in the web-server context.
Vulnerability Detail
The vulnerability arises from the ability of a DAG Author, who already possesses significant permissions, to manipulate the Airflow database. This manipulation can lead to arbitrary code execution in the web-server context when a user views historical task information. The flaw is particularly concerning as it could potentially allow remote code execution, posing a severe risk to the integrity and security of the server.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.11.1
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==2.11.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually modify historical log file names to access logs generated before the last log template change, although this does not fully mitigate the risk associated with the vulnerability.
Conclusion
The CVE-2024-56373 vulnerability in Apache Airflow poses a significant risk due to its potential for remote code execution. Users are strongly advised to upgrade to version 3 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities in open-source software.
See every vulnerability recorded for apache-airflow →
FAQ
CVE-2024-56373 is a code injection vulnerability in Apache Airflow that allows DAG Authors to execute arbitrary code in the web-server context.
If you are using Apache Airflow version 2.11.1 or earlier, your installation is vulnerable to this issue.
The vulnerability could lead to remote code execution, allowing attackers to execute arbitrary code on the server, which can compromise the entire system.
Yes, upgrading to Apache Airflow version 3 or later will patch this vulnerability.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just the Pipfile.lock. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
