CVE-2019-0229 Apache Airflow vulnerable to CSRF Attacks
Attackers can perform cross-site request forgery attacks against Apache Airflow webserver endpoints, potentially bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-0229?
CVE-2019-0229 is a high-severity vulnerability in Apache Airflow, published on 10 Apr 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks.
Weakness: CWE-352
Which versions are affected by CVE-2019-0229?
3 open source packages ship an affected version, including apache-airflow. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apache-airflow PyPI | All versions | 1.10.3 |
apache-airflow PyPI | All versions | 1.10.3 |
apache-airflow PyPI | All versions | 1.10.3b1 |
Products include Apache Airflow.
How do I fix CVE-2019-0229?
Upgrade apache-airflow to a fixed version for your release line: 1.10.3 or 1.10.3b1.
Is CVE-2019-0229 being exploited?
There is no known exploitation of CVE-2019-0229 in the wild and no public exploit code.
Other vulnerabilities in Apache Airflow
- CVE-2020-13927 Apache Airflow's Experimental API Authentication Bypass
- CVE-2020-11978 Apache Airflow Command Injection
- CVE-2026-33264 Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()
- CVE-2023-25754 Apache Airflow: Privilege escalation using airflow logs
- CVE-2023-22884 Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow
Sources
Also known as GHSA-w6j4-3gh2-9f5j, PYSEC-2019-215.