CVE-2024-28746: Apache Airflow Auth Bypass Vulnerability

CVE-2024-28746 Overview

CVE-2024-28746 is an improper preservation of permissions vulnerability [CWE-281] in Apache Airflow versions 2.8.0 through 2.8.2. Authenticated users with limited permissions can access resources such as variables and connections through the web UI that they should not have permission to view. The flaw allows horizontal and potentially vertical information disclosure across Airflow's role-based access control model. Apache addressed the issue in Airflow 2.8.3 and recommends all users upgrade to that version or later.

Critical Impact
Authenticated low-privilege users can read sensitive Airflow variables and connections, exposing credentials, API keys, and secrets that feed downstream data pipelines.

Affected Products

Apache Airflow 2.8.0
Apache Airflow 2.8.1
Apache Airflow 2.8.2

Discovery Timeline

2024-03-14 - CVE-2024-28746 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-28746

Vulnerability Analysis

Apache Airflow enforces role-based access control (RBAC) across its web UI to gate reads of pipeline artifacts including variables, connections, pools, and configuration entries. In versions 2.8.0 through 2.8.2, permission checks on several UI endpoints do not correctly restrict a user whose role lacks the corresponding can_read permission on the target resource type.

An attacker only needs valid credentials for an account with limited permissions. Because Airflow variables and connections routinely hold cleartext credentials, database strings, and third-party API tokens, unauthorized read access can cascade into broader compromise of dependent systems. The attack executes over the network against the Airflow webserver with low complexity and no user interaction.

Root Cause

The defect is an improper preservation of permissions issue [CWE-281] introduced by changes to Airflow's UI authorization layer. Access filters on affected resource views did not consistently reject requests from users whose assigned role omitted the needed permission. The upstream fix in apache/airflow pull request #37881 restores the intended permission gating on the impacted views.

Attack Vector

Exploitation requires an authenticated session on the Airflow web UI. A user assigned a restricted role, such as a custom read-only or team-scoped role, browses to variable or connection listing endpoints that should be denied. The server returns the resource contents rather than an authorization error. No malicious payload or crafted request is required beyond navigating to the affected UI routes. See the Apache mailing list advisory and OpenWall oss-security post for the disclosure details.

Detection Methods for CVE-2024-28746

Indicators of Compromise

Access log entries showing HTTP 200 responses to /variable/list, /connection/list, or related JSON endpoints from users whose roles should not include can_read on Variable or Connection.
Airflow audit log events recording variable or connection reads by non-admin accounts outside their expected scope.
Unexpected use of credentials stored in Airflow connections against downstream systems shortly after UI access by a low-privilege user.

Detection Strategies

Correlate Airflow webserver access logs with the user's assigned role and compare the accessed resource type against the role's declared permissions.
Alert on any authenticated read of Variable or Connection resources by users outside a defined allowlist of privileged roles.
Review Airflow's Flask-AppBuilder permission tables to identify accounts whose recent activity exceeds their assigned grants.

Monitoring Recommendations

Forward Airflow webserver, scheduler, and audit logs to a centralized logging platform for retention and query.
Enable Airflow's audit logging ([core] audit_logs) and track reads of secret-bearing resources continuously.
Rotate any credentials stored in Airflow connections and variables if unauthorized read access cannot be ruled out during the vulnerable window.

How to Mitigate CVE-2024-28746

Immediate Actions Required

Upgrade Apache Airflow to version 2.8.3 or later on all webserver, scheduler, and worker nodes.
Inventory every account with a non-admin role and audit its recent access to variables and connections in the vulnerable timeframe.
Rotate secrets, API tokens, and database credentials stored in Airflow connections and variables if exposure to unauthorized users is plausible.
Restrict Airflow web UI network exposure to trusted networks and require multi-factor authentication on the identity provider.

Patch Information

Apache Airflow 2.8.3 contains the fix delivered in pull request #37881. Upgrade using the standard pip channel, for example pip install --upgrade 'apache-airflow==2.8.3', followed by running airflow db upgrade and restarting webserver, scheduler, and worker processes. Verify the deployed version through the UI footer or by executing airflow version.

Workarounds

If immediate upgrade is not possible, remove or downgrade non-administrative user roles so that only trusted accounts retain access to the Airflow UI.
Move sensitive values out of Airflow variables and connections into an external secrets backend such as HashiCorp Vault or AWS Secrets Manager, referenced by role-scoped identifiers only.
Place the Airflow webserver behind an authenticating reverse proxy that restricts access by source network and enforces additional authorization checks.

bash

# Configuration example
pip install --upgrade 'apache-airflow==2.8.3'
airflow db upgrade
systemctl restart airflow-webserver airflow-scheduler airflow-worker
airflow version