CVE-2021-26697

Name of the Vulnerable Software and Affected Versions Apache Airflow version 2.0.0

Description The issue concerns the lineage endpoint of the deprecated Experimental API in Apache Airflow, which was not protected by authentication. This allowed unauthenticated users to access the endpoint. The attacker needs to be aware of certain parameters to pass to the endpoint, and even then, they can only obtain some metadata about a DAG and a Task. This is considered a low-severity issue.

Recommendations For Apache Airflow version 2.0.0, consider disabling access to the lineage endpoint of the deprecated Experimental API until a patch is available. Restricting access to this endpoint can minimize the risk of exploitation. Additionally, be cautious when using the endpoint, as it may allow unauthorized access to certain metadata. At the moment, there is no information about a newer version that contains a fix for this vulnerability.