CVE-2024-39877: Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-17 · updated 2026-06-17
Weakness: CWE-94

Description

Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability.

Affected products

Apache Airflow: from 2.4.0 before 2.9.3 — fixed in 2.9.3

How to fix

Upgrade to a fixed version: Apache Airflow 2.9.3. Check the vendor advisory for mitigations.

References

https://github.com/apache/airflow/pull/40522
https://lists.apache.org/thread/1xhj9dkp37d6pzn24ll2mf94wbqnb2y1
http://www.openwall.com/lists/oss-security/2024/07/16/7
https://github.com/apache/airflow/pull/40522
https://lists.apache.org/thread/1xhj9dkp37d6pzn24ll2mf94wbqnb2y1

Get alerted when CVE-2024-39877 or the next vulnerability affects your stack