CVE-2024-39863: Apache Airflow Authenticated Link Injection Vulnerability
Summary
CVE-2024-39863: Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Affects apache-airflow versions < 2.9.3. Fixed in 2.9.3. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2024-39863 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. It allows users to define workflows as Directed Acyclic Graphs (DAGs) and provides a rich user interface to manage and visualize these workflows. However, certain versions prior to 2.9.3 are susceptible to a vulnerability that permits authenticated attackers to inject malicious links during the installation of providers, potentially compromising the integrity of the system.
Vulnerability Detail
The vulnerability arises from insufficient validation of user input when installing provider packages in Apache Airflow. An authenticated attacker can exploit this flaw to inject a malicious link, which could lead to the execution of arbitrary code or the installation of harmful software. This poses significant risks, including data breaches and unauthorized access to sensitive information. The vulnerability is classified with a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.9.3
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==2.9.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users should limit access to the Airflow installation to trusted users only, and avoid installing providers from unverified sources until the upgrade is completed.
Conclusion
The vulnerability identified as CVE-2024-39863 poses a significant risk to Apache Airflow installations prior to version 2.9.3. Users are strongly advised to upgrade to the latest version to mitigate potential threats. By following the recommended steps and utilizing available resources like Vulert, users can ensure their systems remain secure.
See every vulnerability recorded for apache-airflow →
FAQ
CVE-2024-39863 is a vulnerability in Apache Airflow that allows authenticated attackers to inject malicious links during provider installations.
Apache Airflow versions prior to 2.9.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate upgrade is not possible, restrict access to the Airflow installation and avoid using unverified provider sources as a temporary workaround.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
