CVE-2021-38540: Apache Airflow Variable Import Endpoint Authentication Bypass
Summary
CVE-2021-38540: The variable import endpoint was not protected by authentication in Airflow >=2.0.0,. Affects apache-airflow versions >= 2.0.0, < 2.1.3. Fixed in 2.1.3. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2021-38540 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Airflow is an open-source platform used for orchestrating and scheduling workflows. It allows users to define and manage complex workflows as Directed Acyclic Graphs (DAGs). The variable import endpoint in Airflow is responsible for adding or modifying variables used in DAGs. This endpoint was not protected by authentication in versions 2.0.0 to 2.1.2, allowing unauthenticated users to access it.
Vulnerability Detail
The lack of authentication on the variable import endpoint in Apache Airflow versions 2.0.0 to 2.1.2 enables unauthenticated users to manipulate Airflow variables used in DAGs. This vulnerability can lead to various security risks, including denial of service, information disclosure, and potential remote code execution. Attackers can exploit this issue to modify critical variables, disrupt workflows, or execute arbitrary code within the Airflow environment.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.3
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==2.1.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually implement authentication for the variable import endpoint by modifying the Airflow configuration. This can be achieved by enabling authentication middleware or configuring a reverse proxy with authentication in front of the Airflow instance. However, applying the official fix by upgrading to version 2.1.3 or later is strongly advised.
Conclusion
The lack of authentication on the variable import endpoint in Apache Airflow versions 2.0.0 to 2.1.2 poses a significant security risk. Upgrading to version 2.1.3 or later is the recommended solution to mitigate this vulnerability. It is crucial to promptly address this issue to prevent potential exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
The vulnerability allows unauthenticated users to modify Airflow variables, potentially leading to a denial of service, information disclosure, or remote code execution.
You can use the Vulert Playground at Vulert Scanner to check if your Apache Airflow version is affected by this vulnerability. Simply upload your Pipfile.lock to the playground, and it will provide real-time alerts for open-source vulnerabilities.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is crucial to apply the recommended fix to prevent any potential exploitation.
While a temporary workaround is available by implementing authentication manually, it is strongly recommended to upgrade to Apache Airflow version 2.1.3 or later to fully address the vulnerability.
You can find more information about this vulnerability in the Apache Airflow advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/apache-airflow/PYSEC-2021-326.yaml
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
