Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Apache Airflow may run malicious code via crafted request

CVE-2022-38054 · published 2 days ago
Summary

The Airflow workflow system can be fooled into executing code that an attacker provides, potentially letting them control the server. This issue affects all Airflow packages from the Apache Software Foundation and related builds. Update to the latest released version of Apache Airflow as soon as possible to apply the fix.

What to do
  • Update apache software foundation apache-airflow to version 2.3.4rc1.
  • Update rootio-apache-airflow to version 2.3.3+root.io.5.
  • Update apache-airflow to version 2.3.3+aikido.6.
Affected software
Ecosystem VendorProductAffected versions
pip apache software foundation apache-airflow >= 2.2.4, < 2.3.4rc1
Fix: upgrade to 2.3.4rc1
– apache airflow >= 2.2.4, <= 2.3.3
cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
Root:PyPI – rootio-apache-airflow < 2.3.3+root.io.5
Fix: upgrade to 2.3.3+root.io.5
Root:PyPI – apache-airflow < 2.3.3+aikido.6
Fix: upgrade to 2.3.3+aikido.6
Original advisory text
CVE-2022-38054 in apache-airflow - Patched by Root
Root has patched CVE-2022-38054 in the apache-airflow package for Root:PyPI. Multiple fixed versions available.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-384Session Fixation
Timeline
Published10 Nov 2026
Updated11 Nov 2026
First seen6 Mar 2026
Sources
GHSA-5ff8-7639-6v6g · GHSA
CVE-2022-38054 · NVD
ROOT-APP-PYPI-CVE-2022-38054 · OSV
CVE-2022-38054 · OSV
Track software like this
Free during beta