CVE-2024-27906

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI.

Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Airflow	< 2.8.2

References

https://github.com/apache/airflow/pull/37290Broken Link
https://github.com/apache/airflow/pull/37468Issue Tracking
https://lists.apache.org/thread/on4f7t5sqr3vfgp1pvkck79wv7mq9st5Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/02/29/1Mailing List
https://github.com/apache/airflow/pull/37290Broken Link
https://github.com/apache/airflow/pull/37468Issue Tracking
https://lists.apache.org/thread/on4f7t5sqr3vfgp1pvkck79wv7mq9st5Mailing List, Vendor Advisory

Timeline

Published: Feb 29, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-279077.8A vulnerability has been identified in Simcenter Femap (All versions < V2306.0000). The affected application contains an out of bounds write CVE-2024-279084.9A buffer overflow vulnerability was reported in the HTTPS service of some Lenovo Printers that could result in denial of service.CVE-2024-279094.9A denial of service vulnerability was reported in the HTTPS service of some Lenovo Printers that could result in a system reboot.CVE-2024-27915.4The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all CVE-2024-279105.3A vulnerability was reported in some Lenovo Printers that could allow an unauthenticated attacker to reboot the printer without authenticati CVE-2024-279117.5A vulnerability was reported in some Lenovo Printers that could allow an unauthenticated attacker to obtain the administrator password.CVE-2024-279127.5A denial of service vulnerability was reported in some Lenovo Printers that could allow an attacker to cause the device to crash by sending CVE-2024-279136.5ospf_te_parse_te in ospfd/ospf_te.c in FRRouting (FRR) through 9.1 allows remote attackers to cause a denial of service (ospfd daemon crash)CVE-2024-279146.1GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.CVE-2024-279158.1Sulu is a PHP content management system. Starting in verson 2.2.0 and prior to version 2.4.17 and 2.5.13, access to pages is granted regardl CVE-2024-279164.3Minder is a software supply chain security platform. Prior to version 0.0.33, a Minder user can use the endpoints `GetRepositoryByName`, `De CVE-2024-279177.5Shopware is an open commerce platform based on Symfony Framework and Vue. The Symfony Session Handler pops the Session Cookie and assigns it