CVE-2021-26559

Description

Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when [webserver] expose_config is set to False in airflow.cfg. This allowed a privilege escalation attack. This issue affects Apache Airflow 2.0.0.

Risk Information

Base Score

6.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

0.557

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2021-26559,CVE-2021-26697 are fixed in Python-apache-airflow 2.0.1rc1	Windows
Vulnerabilities CVE-2021-26559,CVE-2021-26697 are fixed in Python-apache-airflow for linux 2.0.1rc1	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234