CVE-2017-12614: XSS Vulnerability in Apache Airflow
Summary
CVE-2017-12614: It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Affects apache-airflow versions < 1.9.0. Fixed in 1.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of tools and features for managing complex data pipelines. However, versions prior to 1.9.0 are susceptible to a cross-site scripting (XSS) vulnerability on certain 404 error pages. This vulnerability allows an attacker to inject malicious scripts into the page, potentially leading to unauthorized access, data theft, or other malicious activities.
Vulnerability Detail
The XSS vulnerability in Apache Airflow arises from inadequate input sanitization on specific 404 error pages. When a user encounters a non-existent page, the error message displayed may include user-supplied input without proper validation or encoding. This allows an attacker to craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript code within the context of the vulnerable page. While Chrome detects and prevents this reflected XSS attempt, other browsers like Firefox remain vulnerable. Exploitation of this vulnerability can lead to session hijacking, defacement, or the theft of sensitive information.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.0
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==1.9.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The XSS vulnerability in Apache Airflow poses a significant risk to the security and integrity of web applications utilizing this platform. Upgrading to Apache Airflow 1.9.0 or above is crucial to protect against potential attacks. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform used for authoring, scheduling, and monitoring workflows. It provides a rich set of tools and features for managing complex data pipelines.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as session hijacking, data theft, or defacement.
Versions of Apache Airflow prior to 1.9.0 are affected by this XSS vulnerability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Apache Airflow installation is affected by this vulnerability. Simply provide your Pipfile.lock, and Vulert will analyze it for open-source vulnerabilities in real-time.
No specific workarounds have been identified for this vulnerability. It is recommended to upgrade to Apache Airflow 1.9.0 or above to mitigate the XSS vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
