What is CVE-2024-28746?

CVE-2024-28746 is a high-severity vulnerability in Apache Airflow, classified under Improper Preservation of Permissions. CVSS score: 8.1/10. Published 2024-03-14.

How severe is CVE-2024-28746?

High severity. CVSS v3 base score is 8.1 out of 10.

Is CVE-2024-28746 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Apache Airflow

CVE-2024-28746

Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access. Users of Apache Airflow are recommended to upgrade to version 2.8.3 or newer to mitigate the risk associated with this vulnerability

EPSS: 0.013 (68.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

Apache Airflow
Apache Software Foundation Airflow — versions 2.8.0

Weakness classification (CWE)

CWE-281 — Improper Preservation of Permissions

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

security@apache.org (Patch, patch)
security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
security@apache.org (Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2024-28746?: CVE-2024-28746 is a high-severity vulnerability in Apache Airflow, classified under Improper Preservation of Permissions. CVSS score: 8.1/10. Published 2024-03-14.
How severe is CVE-2024-28746?: High severity. CVSS v3 base score is 8.1 out of 10.
Is CVE-2024-28746 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.