CVE-2018-20245: LDAP auth backend misconfiguration in apache-airflow
Summary
CVE-2018-20245: The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checking. Affects apache-airflow versions < 1.10.1. Fixed in 1.10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of tools and features for managing and executing complex data pipelines. The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) is a component of Apache Airflow that allows users to authenticate using LDAP (Lightweight Directory Access Protocol) credentials. This backend was misconfigured in versions prior to Apache Airflow 1.10.1, leading to improper checking of exceptions and disabling server certificate checking.
Vulnerability Detail
The misconfiguration in the LDAP auth backend of Apache Airflow allowed for the bypassing of server certificate checking. This means that the backend did not properly validate the authenticity of the LDAP server's certificate, making it susceptible to man-in-the-middle attacks. An attacker could exploit this vulnerability to intercept and modify communication between the Apache Airflow instance and the LDAP server, potentially gaining unauthorized access or manipulating user authentication. This vulnerability poses a significant security risk to organizations using Apache Airflow with LDAP authentication.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.10.1
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==1.10.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to the fixed version of Apache Airflow.
Conclusion
The misconfiguration in the LDAP auth backend of Apache Airflow prior to version 1.10.1 poses a significant security risk. It allows for the bypassing of server certificate checking, potentially enabling man-in-the-middle attacks and unauthorized access. To mitigate this vulnerability, it is crucial to upgrade to Apache Airflow 1.10.1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of tools and features for managing and executing complex data pipelines.
The LDAP auth backend in Apache Airflow is a component that allows users to authenticate using LDAP (Lightweight Directory Access Protocol) credentials. It enables integration with LDAP servers for user authentication.
Server certificate checking is the process of verifying the authenticity and validity of a server's SSL/TLS certificate. It ensures that the server being communicated with is the intended and trusted entity, preventing man-in-the-middle attacks and unauthorized access.
This vulnerability can lead to man-in-the-middle attacks, where an attacker can intercept and modify communication between the Apache Airflow instance and the LDAP server. This can result in unauthorized access to sensitive information, manipulation of user authentication, and potential compromise of the entire workflow system.
The recommended mitigation is to upgrade to Apache Airflow version 1.10.1 or later, which includes the fix for this vulnerability. Upgrading to the latest version ensures proper server certificate checking and enhances the security of the LDAP auth backend.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
