CVE-2024-41937: Apache Airflow Cross-Site Scripting Vulnerability in Provider Documentation Links
Summary
CVE-2024-41937: Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. Affects apache-airflow versions < 2.10.0. Fixed in 2.10.0. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2024-41937 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. It allows users to define workflows as directed acyclic graphs (DAGs) and provides a rich user interface to manage and visualize these workflows. However, prior to version 2.10.0, Airflow had a vulnerability that could be exploited through malicious provider documentation links, posing a risk to users who interact with these links.
Vulnerability Detail
The vulnerability in Apache Airflow arises from the ability of a malicious provider developer to execute a cross-site scripting (XSS) attack when a user clicks on a provider documentation link. This attack requires the malicious provider to be installed on the web server, and it can lead to unauthorized actions being performed on behalf of the user, potentially compromising sensitive information and user sessions.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.10.0
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==2.10.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid clicking on provider documentation links until they have upgraded to the patched version. Additionally, reviewing installed providers for any that may be untrusted can help mitigate risk.
Conclusion
The vulnerability identified as CVE-2024-41937 in Apache Airflow poses a significant risk through cross-site scripting attacks via provider documentation links. Users are strongly advised to upgrade to version 2.10.0 or later to mitigate this risk. Utilizing tools like Vulert can further enhance your security posture by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for apache-airflow →
FAQ
CVE-2024-41937 is a vulnerability in Apache Airflow that allows for cross-site scripting attacks through malicious provider documentation links.
Any version of Apache Airflow prior to 2.10.0 is affected by this vulnerability. You can check your version by running apache-airflow version in your terminal.
Exploitation of this vulnerability could lead to unauthorized actions being performed on behalf of users, potentially compromising sensitive data and user sessions.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. It requires only the Pipfile.lock to operate.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
