CVE-2024-45498

Name of the Vulnerable Software and Affected Versions: Apache Airflow version 2.10.0

Description: The issue allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. This is related to the example DAG example inlet event extra.py shipped with Apache Airflow. It is recommended to review DAGs based on this example and to avoid exposing example DAGs in deployments.

Recommendations: For Apache Airflow version 2.10.0, upgrade to version 2.10.1 or later to resolve the issue. If you must expose the example DAGs, consider upgrading as the primary mitigation measure. As a temporary workaround, consider restricting access to the example DAGs until the issue is resolved.