CVE-2021-26697
Apache Airflow: Lineage API endpoint for Experimental API missed authentication check
- State
- Published
- Severity
- Not scored
- Published
- Feb 17, 2021
- Updated
- Feb 13, 2025
- Reserved
- Feb 4, 2021
Description
The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue affects Apache Airflow 2.0.0.
Scores
The record has no CVSS score.
Weaknesses
- CWE-269 Improper Privilege Management
Affected Products
| Product | Versions |
|---|---|
Apache AirflowApache Software Foundation |
|
References
- https://lists.apache.org/thread.html/re21fec81baea7a6d73b0b5d31efd07cc02c61f832e297f65bb19b519%40%3Cusers.airflow.apache.org%3E
- [oss-security] 20210217 CVE-2021-26697: Apache Airflow: Lineage API endpoint for Experimental API missed authentication checkmailing-list
- [airflow-dev] 20210217 CVE-2021-26697: Apache Airflow: Lineage API endpoint for Experimental API missed authentication checkmailing-list
- [announce] 20210217 CVE-2021-26697: Apache Airflow: Lineage API endpoint for Experimental API missed authentication checkmailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.