#VU86995 Improper access control in Apache Airflow - CVE-2024-26280
Published: March 4, 2024
Vulnerability identifier: #VU86995
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2024-26280
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Apache Airflow
Apache Airflow
Software vendor:
Apache Foundation
Apache Foundation
Description
The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote user with access to Ops and Viewers can view all information on audit logs, including dag names and usernames they were not permitted to view.
Remediation
Install updates from vendor's website.