CVE-2024-56373

HIGH EPSS 62.5%

Published Feb 24, 20264mo ago · Modified Jun 17, 20261w ago

8.4 CVSS 3.1

High

Published Feb 24, 2026 4mo ago

Last Modified Jun 17, 2026 1w ago

Description

DAG Author (who already has quite a lot of permissions) could manipulate database of Airflow 2 in the way to execute arbitrary code in the web-server context, which they should normally not be able to do, leading to potentially remote code execution in the context of web-server (server-side) as a result of a user viewing historical task information. The functionality responsible for that (log template history) has been disabled by default in 2.11.1 and users should upgrade to Airflow 3 if they want to continue to use log template history. They can also manually modify historical log file names if they want to see historical logs that were generated before the last log template change.

CVSS Details

Base Score

8.4

Exploitability

1.7

Impact

6.0

Vector string

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required High

User Interaction Required

Scope Changed

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

62.5% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-94 Improper Control of Generation of Code (Code Injection) Injection

Affected Products 1

Vendor	Product	Version	Range
apache	airflow	*	<2.11.1

References 3

openwall.com http://www.openwall.com/lists/oss-security/2026/02/23/3

Mailing ListThird Party Advisory
github.com https://github.com/apache/airflow/pull/61880

Issue Tracking
lists.apache.org https://lists.apache.org/thread/2vrmrhcht6g7cp5yjxpnrk2wtrncm6cy

Mailing ListVendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.