CVE-2024-39877 Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler

What is CVE-2024-39877?

CVE-2024-39877 is a high-severity code injection vulnerability in Apache Airflow, published on 17 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability.

Weakness: CWE-277, CWE-94

Which versions are affected by CVE-2024-39877?

4 open source packages ship an affected version, including apache-airflow and airflow. It affects 1 product.

Products include Apache Airflow.

How do I fix CVE-2024-39877?

Upgrade apache-airflow to 2.9.3 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2024-39877 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-39877 exists.

Other vulnerabilities in Apache Airflow

• CVE-2020-13927 Apache Airflow's Experimental API Authentication Bypass Exploited Critical 9.8
• CVE-2020-11978 Apache Airflow Command Injection Exploited High 8.8
• CVE-2026-33264 Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize() Critical 9.8
• CVE-2023-25754 Apache Airflow: Privilege escalation using airflow logs Critical 9.8
• CVE-2023-22884 Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow Critical 9.8

All Apache Airflow vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-airflow-2024-39877, ECHO-f127-5150-e1e6, GHSA-g5hv-r743-v8pm, PYSEC-2024-190.