Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Apache Airflow lets DAG creators run code on scheduler
published 2 months ago
Summary
If you use Apache Airflow older than version 2.10.1, a person who can add a workflow (DAG) file could also place a special settings file that the scheduler would run automatically. This could let them execute code on the server that should only be run by the system itself. Upgrade Airflow to version 2.10.1 or later to stop this behavior.
What to do
- Update apache software foundation apache-airflow to version 2.10.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Echo:PyPi | apache software foundation | apache-airflow |
< 2.10.1 Fix: upgrade to 2.10.1
|
Original advisory text
ECHO-5933-7ea4-233c
References
Timeline
Published12 Aug 2026
Updated12 Aug 2026
First seen12 Aug 2026
Sources
ECHO-5933-7ea4-233c · OSV
Track software like this
Free during beta