CVE-2024-32077

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs. Users are recommended to upgrade to version 2.9.1, which fixes this issue.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Airflow	>= 2.9.0, < 2.9.1
apache	airflow	2.9.0

References

http://www.openwall.com/lists/oss-security/2024/05/14/1Mailing List, Third Party Advisory
https://github.com/apache/airflow/pull/38882Issue Tracking, Patch
https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/05/14/1Mailing List, Third Party Advisory
https://github.com/apache/airflow/pull/38882Issue Tracking, Patch
https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77Mailing List, Vendor Advisory

Timeline

Published: May 14, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-320784.1URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Foliovision FV Flowplayer Video Player.This issue affects FV Flowplayer CVE-2024-320796.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Dempfle Advanced iFrame allows CVE-2024-32085.4The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery widget in all versi CVE-2024-320805.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick Pelton Search Keyword Redirect al CVE-2024-320818.8Missing Authorization vulnerability in Websupporter Filter Custom Fields & Taxonomies Light.This issue affects Filter Custom Fields & Taxono CVE-2024-320826.1Cross-Site Request Forgery (CSRF) vulnerability in Kamlesh Parmar Sync Post With Other Site sync-post-with-other-site allows Cross Site Requ CVE-2024-320835.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Varun Kumar Easy Logo allows Stored XS CVE-2024-320844.3Cross-Site Request Forgery (CSRF) vulnerability in Gold Plugins Before And After.This issue affects Before And After: from n/a through 3.9.CVE-2024-320855.4Cross-Site Request Forgery (CSRF) vulnerability in AitThemes Citadela Listing.This issue affects Citadela Listing: from n/a before 5.20.0.CVE-2024-320867.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in AitThemes Citadela Listing.This issue affects Citadela Listing: CVE-2024-320877.2Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExportFeed.Com Product Feed on WooComm CVE-2024-320884.3Cross-Site Request Forgery (CSRF) vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd.This issue a