ConfirmedA court, a regulator or the organization itself has stated the core facts, or the record cites a court or regulator source.
Apache Airflow authenticated DAG authors could execute code on scheduler nodes
CVE-2024-45034 in Apache Airflow allowed authenticated DAG authors to execute arbitrary code on scheduler nodes. A fix was implemented and backported to version 2.10.1 on August 23, 2024.
AII-1002-444533 sources ↓
What happened
CVE-2024-45034 was identified in Apache Airflow allowing authenticated DAG (Directed Acyclic Graph) authors to execute arbitrary code on scheduler nodes.
Governance controls
A fix was implemented through splitting syspath preparation into stages in airflow/settings.py#initialize, merged on August 23, 2024, and backported to Airflow version 2.10.1.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.