CVE-2024-39877: Apache Airflow RCE Vulnerability

CVE-2024-39877 Overview

CVE-2024-39877 is a code injection vulnerability in Apache Airflow versions 2.4.0 through 2.9.2. Authenticated DAG authors can craft a malicious doc_md parameter to execute arbitrary code in the scheduler context. This behavior violates the Airflow Security model, which forbids DAG authors from running code outside of worker isolation. The Apache Airflow project addressed the flaw in version 2.9.3. The vulnerability is tracked under [CWE-94] (Improper Control of Generation of Code) and [CWE-277] (Insecure Inherited Permissions).

Critical Impact
Authenticated DAG authors can execute arbitrary code inside the Airflow scheduler process, escaping worker isolation and compromising the orchestration control plane.

Affected Products

Apache Airflow 2.4.0
Apache Airflow versions 2.4.0 through 2.9.2
Apache Airflow (fixed in 2.9.3)

Discovery Timeline

2024-07-17 - CVE-2024-39877 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-39877

Vulnerability Analysis

Apache Airflow separates DAG parsing and scheduling from task execution. Task code is expected to run in isolated worker processes, while the scheduler handles orchestration metadata. The doc_md parameter accepts Markdown documentation intended to render in the Airflow UI. In affected releases, this parameter was processed in a way that permitted embedded expressions to execute in the scheduler context.

An authenticated user with permission to author DAGs can supply a crafted doc_md value that runs arbitrary Python code inside the scheduler. This grants access to scheduler credentials, connection secrets, and the Airflow metadata database. The scheduler typically holds elevated privileges compared to individual worker tasks, making this a privilege boundary violation as described in [CWE-277].

Root Cause

The root cause is improper handling of DAG documentation content during scheduler-side processing. Rendering logic evaluated doc_md input rather than treating it as inert string data. This allowed code injection at the scheduler layer, bypassing the security model that restricts DAG authors to worker-scoped execution. The maintainers removed the vulnerable behavior in pull request apache/airflow#40522.

Attack Vector

Exploitation requires authenticated access with DAG authoring permissions. The attacker submits a DAG file containing a malicious doc_md value on a DAG object, task, or related component. When the scheduler parses the DAG, the crafted payload executes with scheduler privileges. Because Airflow is often network-reachable to internal users and integrations, the attack path can be reached remotely. Refer to the Apache mailing list disclosure and the Openwall OSS Security post for advisory context.

Detection Methods for CVE-2024-39877

Indicators of Compromise

Unexpected child processes spawned by the Airflow scheduler process, particularly shells or Python subprocesses unrelated to normal DAG parsing.
New or modified DAG files containing unusual doc_md content such as embedded template expressions, code fences, or references to os, subprocess, or __import__.
Outbound network connections initiated by the scheduler host to unknown destinations.
Access to Airflow connection secrets or Fernet-encrypted variables outside routine worker execution.

Detection Strategies

Audit the DAG source repository for doc_md fields introduced by non-administrator accounts.
Compare running Airflow versions against the fixed release 2.9.3 across scheduler, webserver, and worker nodes.
Correlate DAG deployment events with scheduler process behavior to identify anomalous execution windows.

Monitoring Recommendations

Enable process-lineage telemetry on scheduler hosts and alert on non-standard child processes.
Forward Airflow audit logs, webserver access logs, and Git commit history for DAG repositories to a centralized SIEM.
Monitor file integrity for the DAGs folder and alert on modifications outside approved deployment pipelines.

How to Mitigate CVE-2024-39877

Immediate Actions Required

Upgrade Apache Airflow to version 2.9.3 or later on all scheduler, webserver, worker, and triggerer nodes.
Review DAG authoring permissions and remove access from accounts that do not require it.
Rotate credentials, connections, variables, and Fernet keys accessible to the scheduler if compromise is suspected.
Audit recent DAG changes for suspicious doc_md content across the environment.

Patch Information

The fix is included in Apache Airflow 2.9.3. The upstream code change is documented in apache/airflow pull request #40522. Operators should follow the project's standard upgrade procedure, including database migrations, and validate scheduler and worker health after deployment.

Workarounds

Restrict DAG authoring to a small set of trusted accounts protected by strong authentication.
Deploy DAGs through a reviewed Git-based pipeline that blocks unreviewed doc_md content.
Isolate the scheduler on a network segment with strict egress controls until patching completes.

bash

# Upgrade Apache Airflow to a fixed release
pip install --upgrade "apache-airflow>=2.9.3"

# Verify the installed version
airflow version