CVE-2017-17835: Remote Command Injection in Apache Airflow
Summary
CVE-2017-17835: In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow. Affects apache-airflow versions < 1.9.0. Fixed in 1.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for orchestrating and scheduling workflows. It allows users to define, schedule, and monitor complex workflows as directed acyclic graphs (DAGs) of tasks. Airflow is widely used in various industries for data processing and workflow automation. However, versions 1.8.2 and earlier of Apache Airflow were found to be vulnerable to a CSRF (Cross-Site Request Forgery) attack, which could lead to remote command injection on a default installation of Airflow.
Vulnerability Detail
The CSRF vulnerability in Apache Airflow allowed an attacker to execute arbitrary commands on a target system by tricking a user with administrative privileges into visiting a malicious website or clicking on a specially crafted link. This could result in unauthorized access, data leakage, or even complete compromise of the affected Airflow instance. The vulnerability was addressed in version 1.9.0 of Apache Airflow.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.0
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==1.9.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The CSRF vulnerability in Apache Airflow versions 1.8.2 and earlier allowed for remote command injection on a default installation of Airflow. To mitigate this vulnerability, it is crucial to upgrade to at least version 1.9.0 of Apache Airflow. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform used for orchestrating and scheduling workflows. It allows users to define, schedule, and monitor complex workflows as directed acyclic graphs (DAGs) of tasks.
CSRF (Cross-Site Request Forgery) is a type of attack that tricks a user into performing unwanted actions on a website in which they are authenticated. In the case of Apache Airflow, the CSRF vulnerability allowed an attacker to execute arbitrary commands on a target system by tricking a user with administrative privileges into visiting a malicious website or clicking on a specially crafted link.
The CSRF vulnerability in Apache Airflow could lead to unauthorized access, data leakage, or even complete compromise of the affected Airflow instance. An attacker could execute arbitrary commands on the target system, potentially gaining control over sensitive data or performing malicious actions.
To fix this vulnerability, it is recommended to upgrade to at least version 1.9.0 of Apache Airflow. This can be done by updating the package using the package manager or by manually installing the latest version from the official Apache Airflow website.
There is no specific workaround mentioned for this vulnerability. It is recommended to upgrade to the fixed version of Apache Airflow.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
