CVE-2021-28359: Apache Airflow XSS Vulnerability
Summary
CVE-2021-28359: The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions. Affects apache-airflow across 2 version ranges.
>= 1.8.1, < 1.10.15
>= 2.0.0, < 2.0.2
Fixed in 1.10.15 or 2.0.2, depending on the release line you run. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2021-28359 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of features for managing complex data pipelines. However, versions prior to 1.10.15 in the 1.x series and versions 2.0.0, 2.0.1, and 2.x series are vulnerable to an XSS exploit. This vulnerability allows an attacker to inject malicious scripts into the 'origin' parameter of certain endpoints, such as '/trigger'.
Vulnerability Detail
The 'origin' parameter in Apache Airflow is not properly sanitized, allowing an attacker to execute arbitrary JavaScript code in the context of a user's browser. This can lead to various security risks, including session hijacking, data theft, and unauthorized actions on behalf of the user. Although attempts were made to fix this issue in the past (CVE-2020-13944 & CVE-2020-17515), the implemented fix did not completely resolve the vulnerability.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.8.1, < 1.10.151.10.15pip install --upgrade "apache-airflow==1.10.15" -
>= 2.0.0, < 2.0.22.0.2pip install --upgrade "apache-airflow==2.0.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is crucial to apply the recommended fixes by updating Apache Airflow and Python to the patched versions.
Conclusion
The XSS vulnerability in Apache Airflow can have serious security implications. It is crucial to update to the recommended versions and ensure that Python is also updated to the latest PATCH release. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform used for orchestrating and managing complex data workflows.
XSS (Cross-Site Scripting) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
This vulnerability can lead to session hijacking, data theft, and unauthorized actions on behalf of the user.
No, only versions prior to 1.10.15 in the 1.x series and versions 2.0.0, 2.0.1, and 2.x series are affected.
Yes, updating to Apache Airflow 1.10.15 or 2.0.2, along with the latest PATCH release of the installed Python MINOR version, will address this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
