{"id":"CVE-2021-38540","published":"2021-09-09T15:05:09Z","modified":"2024-08-04T01:44:23Z","title":"Apache Airflow: Variable Import endpoint missed authentication check","vendor":"Apache Software Foundation","product":"Apache Airflow","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Airflow","versions":[">= Apache Airflow, < 2.1.3"]}],"description":{"text":"The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow >=2.0.0, <2.1.3.","provenance":"source","from":"CVE.org"},"summary":{"text":"The Variable Import endpoint in Apache Software Foundation's Apache Airflow lacked an authentication check, so it was reachable without credentials. An unauthenticated remote attacker who can reach the endpoint over the network could add or modify Airflow variables used by DAGs, which could lead to denial of service, information disclosure, or remote code execution.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:18:26Z"},"cvss":null,"epss":{"score":0.80938,"percentile":0.9963,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-269","name":"Improper Privilege Management"}],"references":[{"url":"https://lists.apache.org/thread.html/rb34c3dd1a815456355217eef34060789f771b6f77c3a3dec77de2064%40%3Cusers.airflow.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/rac2ed9118f64733e47b4f1e82ddc8c8020774698f13328ca742b03a2%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"PyPI","package":"apache-airflow","vulnerableRanges":[">=2.0.0, <2.1.3"],"patched":["2.1.3"],"from":["GHSA-h88f-r7cw-8fv3","PYSEC-2021-326"],"provenance":"source"}],"advisories":[{"id":"GHSA-h88f-r7cw-8fv3","url":"https://github.com/advisories/GHSA-h88f-r7cw-8fv3","severity":"CRITICAL","ecosystem":"PyPI","package":"apache-airflow","vulnerableRanges":[">=2.0.0, <2.1.3"],"patched":["2.1.3"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2021-0016","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-0016","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2022-06-13","earliestUrl":"https://github.com/Captain-v-hook/PoC-for-CVE-2021-38540-","repos":[{"name":"Captain-v-hook/PoC-for-CVE-2021-38540-","url":"https://github.com/Captain-v-hook/PoC-for-CVE-2021-38540-","stars":4,"created":"2022-06-13"}]},"nuclei":[{"id":"CVE-2021-38540","name":"Apache Airflow - Unauthenticated Variable Import","severity":"critical","path":"http/cves/2021/CVE-2021-38540.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38540.yaml"}],"first":{"date":"2022-06-13","source":"PoC-in-GitHub","url":"https://github.com/Captain-v-hook/PoC-for-CVE-2021-38540-"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2021-09-09","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-38540","provenance":"source"},{"date":"2022-06-13","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Captain-v-hook/PoC-for-CVE-2021-38540-","provenance":"source"}],"speed":{"daysToPublicExploit":277,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":24.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.93,"detail":"percentile 0.9963"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-apache-airflow-cve-2021-38540","children":[{"from":"CVE-2021-38540","to":"CVE-2023-50783","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["airflow/www/views.py"],"commits":["https://github.com/apache/airflow/commit/bcec1df703cd4a01520a90c3f801cca6f97d9bfd","https://github.com/apache/airflow/commit/0e1c106d7cd0703125528a691088e42e17c99929"],"basis":"shared function","functions":["action_varexport"]}]}],"packageHistory":[{"cve":"CVE-2020-17515","published":"2020-12-11","fixed":"2.0.2rc1","kev":false},{"cve":"CVE-2021-28359","published":"2021-05-02","fixed":"2.0.2","kev":false},{"cve":"CVE-2021-35936","published":"2021-08-16","fixed":"2.1.2","kev":false,"link":{"from":"CVE-2021-35936","to":"CVE-2021-38540","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:apache-airflow","fromFixed":"2.1.2","toFixed":"2.1.3","daysApart":24}]}},{"cve":"CVE-2021-38540","published":"2021-09-09","fixed":"2.1.3","kev":false},{"cve":"CVE-2021-45230","published":"2022-01-20","fixed":"2.2.0","kev":false,"link":{"from":"CVE-2021-38540","to":"CVE-2021-45230","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:apache-airflow","fromFixed":"2.1.3","toFixed":"2.2.0","daysApart":133}]}},{"cve":"CVE-2021-45229","published":"2022-02-25","fixed":"2.2.4rc1","kev":false},{"cve":"CVE-2022-24288","published":"2022-02-25","fixed":"2.2.4","kev":false}],"package":"PyPI:apache-airflow"}}