{"id":"CVE-2022-40127","published":"2022-11-14T00:00:00Z","modified":"2025-04-30T18:58:45Z","title":"Apache Airflow <2.4.0 has an RCE in a bash example","vendor":"Apache Software Foundation","product":"Apache Airflow","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Airflow","versions":[">= Apache Airflow, < 2.4.0"]}],"description":{"text":"A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is a code injection vulnerability in the Example DAGs bundled with Apache Airflow, affecting versions prior to 2.4.0. An attacker holding UI access with permission to trigger DAGs can execute arbitrary commands by supplying a crafted run_id parameter manually, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:51Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.85653,"percentile":0.99724,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://github.com/apache/airflow/pull/25960","tags":[]},{"url":"https://lists.apache.org/thread/cf132hgm6jvzvsbpsozl3plf1r4cwysy","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2022/11/14/2","tags":["mailing-list"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"PyPI","package":"apache-airflow","vulnerableRanges":["<2.4.0"],"patched":["2.4.0"],"from":["GHSA-6pw3-8h9w-32gc","PYSEC-2022-42982"],"provenance":"source"}],"advisories":[{"id":"GHSA-6pw3-8h9w-32gc","url":"https://github.com/advisories/GHSA-6pw3-8h9w-32gc","severity":"HIGH","ecosystem":"PyPI","package":"apache-airflow","vulnerableRanges":["<2.4.0"],"patched":["2.4.0"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-0017","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0017","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2022-11-18","earliestUrl":"https://github.com/Mr-xn/CVE-2022-40127","repos":[{"name":"Mr-xn/CVE-2022-40127","url":"https://github.com/Mr-xn/CVE-2022-40127","stars":41,"created":"2022-11-18"},{"name":"jakabakos/CVE-2022-40127-Airflow-RCE","url":"https://github.com/jakabakos/CVE-2022-40127-Airflow-RCE","stars":2,"created":"2023-07-21"}]},"nuclei":[{"id":"CVE-2022-40127","name":"AirFlow < 2.4.0 - Remote Code Execution","severity":"high","path":"http/cves/2022/CVE-2022-40127.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40127.yaml"}],"first":{"date":"2022-11-18","source":"PoC-in-GitHub","url":"https://github.com/Mr-xn/CVE-2022-40127"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-11-14","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-40127","provenance":"source"},{"date":"2022-11-18","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Mr-xn/CVE-2022-40127","provenance":"source"}],"speed":{"daysToPublicExploit":4,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":31.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.94,"detail":"percentile 0.9972"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2022-38170","published":"2022-09-02","fixed":"2.3.4","kev":false},{"cve":"CVE-2022-40604","published":"2022-09-21","fixed":"2.4.0rc1","kev":false},{"cve":"CVE-2022-40754","published":"2022-09-21","fixed":"2.4.0rc1","kev":false,"link":{"from":"CVE-2022-40754","to":"CVE-2022-40127","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:apache-airflow","fromFixed":"2.4.0rc1","toFixed":"2.4.0","daysApart":54}]}},{"cve":"CVE-2022-40127","published":"2022-11-14","fixed":"2.4.0","kev":false},{"cve":"CVE-2022-41672","published":"2022-10-07","fixed":"2.4.2rc1","kev":false},{"cve":"CVE-2022-43982","published":"2022-11-02","fixed":"2.4.2","kev":false},{"cve":"CVE-2022-43985","published":"2022-11-02","fixed":"2.4.2","kev":false}],"package":"PyPI:apache-airflow"}}