CVE-2021-26559: Improper Access Control in Apache Airflow
Summary
CVE-2021-26559: Improper Access Control in Apache Airflow. Affects apache-airflow versions >= 2.0.0, < 2.0.1rc1. Fixed in 2.0.1rc1. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2021-26559 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of features for managing and executing complex data pipelines. This vulnerability affects Apache Airflow version 2.0.0. The package is widely used in various industries and is known for its flexibility and scalability. However, improper access control on the Configurations Endpoint for the Stable API allows users with Viewer or User role to access sensitive information, even when the [webserver] expose_config setting is disabled in the airflow.cfg file. This vulnerability can lead to privilege escalation attacks.
Vulnerability Detail
The vulnerability arises from a lack of proper access control on the Configurations Endpoint in Apache Airflow. This allows users with lower privileges to retrieve sensitive information, including Airflow Configurations, even when the expose_config setting is disabled. An attacker with Viewer or User role can exploit this vulnerability to gain unauthorized access to sensitive data, potentially leading to further compromise of the system. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.1rc1
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==2.0.1rc1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually modify the airflow.cfg file to set [webserver] expose_config to False. This will prevent the exposure of sensitive information through the Configurations Endpoint. However, it is strongly recommended to apply the official fix by upgrading to a patched version of Apache Airflow.
Conclusion
The vulnerability in Apache Airflow allows users with lower privileges to access sensitive information, leading to potential privilege escalation attacks. Users are advised to upgrade to version 2.0.1 or later to fix this vulnerability. In the meantime, a temporary workaround can be applied by modifying the airflow.cfg file. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of features for managing and executing complex data pipelines.
This vulnerability allows users with lower privileges to access sensitive information, including Airflow Configurations, even when the expose_config setting is disabled. An attacker with Viewer or User role can exploit this vulnerability to gain unauthorized access to sensitive data, potentially leading to further compromise of the system.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
To fix this vulnerability, users of Apache Airflow should upgrade to version 2.0.1 or later. The fix includes proper access control checks on the Configurations Endpoint, preventing unauthorized access to sensitive information.
As a temporary workaround, users can manually modify the airflow.cfg file to set [webserver] expose_config to False. This will prevent the exposure of sensitive information through the Configurations Endpoint. However, it is strongly recommended to apply the official fix by upgrading to a patched version of Apache Airflow.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
