CVE-2021-26697: Insecure Lineage Endpoint in Apache Airflow
Summary
CVE-2021-26697: The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. Affects apache-airflow versions < 2.0.1. Fixed in 2.0.1. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2021-26697 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of features for managing and executing tasks in a distributed environment. The Experimental API in Airflow 2.0.0 includes an endpoint called 'lineage' that allows users to retrieve metadata about a DAG (Directed Acyclic Graph) and its tasks. However, this endpoint was not protected by authentication, making it accessible to unauthenticated users.
Vulnerability Detail
The vulnerability identified as CVE-2021-26697 allows unauthenticated users to access the lineage endpoint in Apache Airflow 2.0.0. Although this issue is considered low-severity, as it requires knowledge of specific parameters and only provides access to metadata about a DAG and its tasks, it still poses a security risk. Attackers could potentially gather sensitive information about the workflow structure and task dependencies, which could aid in further attacks or unauthorized access.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.1
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==2.0.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually implement authentication for the lineage endpoint by modifying the source code. One possible approach is to add authentication middleware or decorators to the endpoint's handler function. Here is an example of how this can be done in Python:
from airflow.www.security import api_auth
@api_auth.requires_authentication
def lineage_endpoint_handler(request):
# Endpoint logic
...
Please note that this workaround is not recommended for production environments and should only be used until the upgrade to a fixed version is possible.
Conclusion
In conclusion, the CVE-2021-26697 vulnerability in Apache Airflow 2.0.0 allows unauthenticated users to access the lineage endpoint, potentially exposing sensitive metadata about workflows and tasks. It is crucial to upgrade to Apache Airflow 2.0.1 or later to fix this vulnerability and implement proper authentication. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of features for managing and executing tasks in a distributed environment.
The Experimental API in Apache Airflow includes additional endpoints and features that are not yet considered stable or fully supported. These APIs are subject to changes and may be deprecated in future versions.
The lineage endpoint in Apache Airflow's Experimental API allows users to retrieve metadata about a DAG (Directed Acyclic Graph) and its tasks. It provides information about the workflow structure and task dependencies.
Although this vulnerability is considered low-severity, it can still pose risks. Unauthenticated users could gather sensitive information about the workflow structure and task dependencies, which could aid in further attacks or unauthorized access.
To fix this vulnerability, it is recommended to upgrade to Apache Airflow version 2.0.1 or later. This upgrade will include the necessary fix to implement authentication for the lineage endpoint.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
