CVE-2024-41937: Apache Airflow Cross-site Scripting Vulnerability
Summary
CVE-2024-41937: Apache Airflow Cross-site Scripting Vulnerability. Affects apache-airflow versions < 2.10.0. Fixed in 2.10.0. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2024-41937 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of features for managing and orchestrating complex data pipelines. The vulnerability in Apache Airflow versions prior to 2.10.0 allows a malicious provider developer to execute a cross-site scripting (XSS) attack when a user clicks on a provider documentation link. This vulnerability requires the provider to be installed on the web server and for the user to interact with the provider link.
Vulnerability Detail
The Apache Airflow vulnerability allows an attacker to inject malicious scripts into the provider documentation link, which can then be executed in the context of the user's browser. This can lead to various security issues, including unauthorized access to sensitive information, session hijacking, and potential remote code execution. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.10.0
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==2.10.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Apache Airflow XSS vulnerability allows a malicious provider developer to execute cross-site scripting attacks by injecting malicious scripts into provider documentation links. Upgrading to Apache Airflow version 2.10.0 or later is recommended to mitigate this vulnerability. It is also important to stay vigilant and regularly update all dependencies and plugins to ensure a secure Airflow environment.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of features for managing and orchestrating complex data pipelines.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. These scripts can be used to steal sensitive information, manipulate web content, or perform other malicious actions.
The Apache Airflow XSS vulnerability allows a malicious provider developer to inject malicious scripts into the provider documentation link. When a user clicks on this link, the injected scripts are executed in the context of the user's browser, potentially leading to various security issues.
The Apache Airflow XSS vulnerability can result in unauthorized access to sensitive information, session hijacking, and potential remote code execution. Attackers can exploit this vulnerability to manipulate web content, steal user credentials, or perform other malicious actions.
To protect your Apache Airflow installation, it is recommended to upgrade to version 2.10.0 or later, which includes the necessary patches to mitigate the XSS vulnerability. Additionally, it is important to regularly update and patch all dependencies and plugins used in your Airflow environment.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
