CVE-2024-29735: Apache Airflow Improper Preservation of Permissions vulnerability
Summary
CVE-2024-29735: Apache Airflow Improper Preservation of Permissions vulnerability. Affects apache-airflow versions >= 2.8.2, < 2.8.4. Fixed in 2.8.4. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2024-29735 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of tools and features for managing complex data pipelines. This vulnerability affects Apache Airflow versions 2.8.2 through 2.8.3. The issue arises from the improper preservation of permissions in Airflow's local file task handler. By default, the handler sets incorrect permissions for parent folders of the log folder, potentially granting group write access to sensitive directories. This vulnerability can impact the ability to run SSH operations if log files are stored in the home directory.
Vulnerability Detail
The vulnerability in Apache Airflow allows for the incorrect setting of permissions on parent folders of the log folder. When running Airflow with the root user, group write permissions are added to all folders up to the root of the filesystem. This can lead to unintended group write access and potential security risks. Users who utilize Official Airflow Docker reference images or have a umask of 002 (group write enabled) are not affected. However, users who install Airflow locally or use other Docker images may be impacted. It is recommended to change the Airflow user to a non-root user, upgrade to version 2.8.4 or above, or modify the file task handler new folder permissions to 0o755.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.8.4
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==2.8.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to immediately upgrade or modify permissions, you can apply the following workaround to mitigate the vulnerability:
- Open the Airflow configuration file.
- Locate the 'file_task_handler_new_folder_permissions' setting.
- Change the value from the default 0o775 to 0o755.
This will ensure that group write access is not granted to parent directories.
Conclusion
The Apache Airflow Improper Preservation of Permissions vulnerability can lead to unintended group write access and potential security risks. It is recommended to take immediate action to fix this vulnerability by changing the Airflow user, upgrading to the latest version, or modifying permissions. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Users of Apache Airflow versions 2.8.2 through 2.8.3 who install Airflow locally or use other Docker images may be affected. Users who utilize Official Airflow Docker reference images or have a umask of 002 (group write enabled) are not affected.
The vulnerability can lead to unintended group write access to sensitive directories, potentially compromising the security of the system. It may also impact the ability to run SSH operations if log files are stored in the home directory.
You can fix this vulnerability by changing the Airflow user to a non-root user, upgrading to Apache Airflow version 2.8.4 or above, or modifying the file task handler new folder permissions to 0o755.
No, users of Official Airflow Docker reference images are not affected by this vulnerability. These images require group write permission to be set, which mitigates the issue.
If you have already run Airflow tasks and your default umask is 022 (group write disabled), you should stop Airflow components, check the permissions of AIRFLOW_HOME/logs in all components and parent directories, and remove group write access for all parent directories.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
