CVE-2024-45498— Apache Airflow: Command Injection in an example DAG
Quick assessment
Affected
Apache Software Foundation Apache Airflow
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Airflow是美国阿帕奇（Apache）基金会的一套用于创建、管理和监控工作流程的开源平台。该平台具有可扩展和动态监控等特点。 Apache Airflow 2.10.0版本存在安全漏洞，该漏洞源于example_inlet_event_extra.py示例DAG中的处理不当，允许仅具有DAG触发权限的已认证攻击者执行任意命令。
Possible ATT&CK Techniques 2 AI
T1505 · Server Software Component T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-45498
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Airflow: Command Injection in an example DAG
Source: CVE Program / CVE List V5
Vulnerability Description
Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the dangerous example; see https://github.com/apache/airflow/pull/41873 for more information. We recommend against exposing the example DAGs in your deployment. If you must expose the example DAGs, upgrade Airflow to version 2.10.1 or later.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对输出编码和转义不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Airflow 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Airflow是美国阿帕奇（Apache）基金会的一套用于创建、管理和监控工作流程的开源平台。该平台具有可扩展和动态监控等特点。 Apache Airflow 2.10.0版本存在安全漏洞，该漏洞源于example_inlet_event_extra.py示例DAG中的处理不当，允许仅具有DAG触发权限的已认证攻击者执行任意命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Airflow | 2.10.0 | - |
|
II. Public POCs for CVE-2024-45498
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-45498
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: Apache Airflow
-
CVE-2026-86473
Apache Airflow: Logout ignores a presented Authorization bea -
CVE-2026-75158
Apache Airflow: Assets events API returns asset events for e -
CVE-2026-82355
Apache Airflow: Session cookie silently overrides explicit A -
CVE-2026-75157
Apache Airflow: Asset queued-events DELETE endpoints gated o -
CVE-2026-59244
Apache Airflow: Secrets masker: `var.json` Variable values n
Same vendor: Apache Software Foundation
-
CVE-2026-103371
Apache Geode: Management REST API: Insertion of Sensitive In -
CVE-2026-92415
Apache Jackrabbit: DavEx client runs Class.forName + (String -
CVE-2026-92414
Apache Jackrabbit: Pre-auth hijack of cached sessions via de -
CVE-2026-97146
Apache YuniKorn: Admission control bypass via system label f -
CVE-2026-78243
Apache YuniKorn: LDAP Group provider panics on lowercase att
Same weakness: CWE-116
V. Comments for CVE-2024-45498
No comments yet