CVE-2024-45498: Apache Airflow RCE Vulnerability

CVE-2024-45498 Overview

CVE-2024-45498 affects Apache Airflow version 2.10.0. The example_inlet_event_extra.py DAG shipped with this release contains a command injection flaw. An authenticated attacker with only DAG trigger permission can execute arbitrary commands on the Airflow worker. The issue also affects deployments that copied the example as a template for production DAGs. Apache addressed the flaw in Airflow 2.10.1. The vulnerability is tracked under CWE-116: Improper Encoding or Escaping of Output.

Critical Impact
Authenticated users with DAG trigger permission can execute arbitrary commands on Airflow workers through unsanitized inlet event extra data.

Affected Products

Apache Airflow 2.10.0
Deployments exposing the bundled example DAGs
Custom DAGs derived from example_inlet_event_extra.py

Discovery Timeline

2024-09-07 - CVE-2024-45498 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45498

Vulnerability Analysis

Apache Airflow ships example DAGs to demonstrate platform features. The example_inlet_event_extra.py DAG demonstrates passing arbitrary data through inlet events between tasks. The example constructs a shell command using attacker-controllable data from the inlet event extra field without sanitization or escaping.

An attacker who holds only DAG trigger permission can supply crafted input through the DAG's run configuration. When the DAG executes, that input flows into a shell context and runs as the Airflow worker user. The worker typically has broad access to task metadata, connections, variables, and any credentials mounted for pipeline use.

The severity increases when operators copy the example verbatim into production DAGs. Because Airflow explicitly documents the example DAGs for learning, the anti-pattern propagates into real deployments. See the upstream fix in pull request 41873 for the corrected pattern.

Root Cause

The root cause is improper encoding of output data passed to a command interpreter. Untrusted extra payload data is concatenated into a shell command string rather than passed as arguments to a parameterized executor. This maps directly to CWE-116.

Attack Vector

The attack requires network access to the Airflow web interface or API and valid credentials with DAG trigger permission. The attacker triggers the vulnerable DAG with a crafted extra payload containing shell metacharacters. Airflow evaluates the payload during task execution, and the worker runs attacker-supplied commands. Confidentiality, integrity, and availability of the pipeline environment are affected.

The vulnerability is exploited through DAG trigger input; no verified public code examples are available. Refer to the Apache mailing list advisory for additional context.

Detection Methods for CVE-2024-45498

Indicators of Compromise

Unexpected DAG runs of example_inlet_event_extra or DAGs derived from it
Airflow task logs containing shell metacharacters (;, |, `, $() in inlet event extra fields
Worker processes spawning shells (sh, bash) with unusual command lines outside normal pipeline behavior
Outbound network connections from Airflow workers to attacker-controlled infrastructure

Detection Strategies

Audit deployed DAG source code for patterns that pass inlet_events[...].extra values into BashOperator, subprocess, or os.system calls
Review Airflow audit logs for DAG trigger events from low-privilege accounts referencing the example DAG
Correlate Airflow worker process creation events with the parent airflow scheduler or worker service

Monitoring Recommendations

Ingest Airflow scheduler, worker, and webserver logs into a centralized analytics platform for correlation
Alert on child process creation from Airflow worker containers that is not part of the expected task inventory
Monitor role assignments and DAG-level permissions for accounts that hold only can_trigger but no development rights

How to Mitigate CVE-2024-45498

Immediate Actions Required

Upgrade Apache Airflow to version 2.10.1 or later
Disable example DAGs in production by setting load_examples = False in airflow.cfg
Audit all custom DAGs for code paths that use inlet_eventsextra values in shell contexts
Restrict can_trigger permissions to accounts that require pipeline execution rights

Patch Information

Apache Airflow 2.10.1 removes the dangerous pattern from example_inlet_event_extra.py. Deployment teams should upgrade using their standard package manager or container image workflow. Details of the code change are available in the Apache Airflow pull request 41873 and the OSS-Security announcement.

Workarounds

Set load_examples = False in airflow.cfg and restart the scheduler and webserver
Remove or rewrite any production DAG copied from example_inlet_event_extra.py to pass untrusted values as arguments rather than shell strings
Enforce least-privilege role-based access control so untrusted users cannot trigger DAGs that consume inlet event data

bash

# Configuration example: disable example DAGs in airflow.cfg
[core]
load_examples = False

# Or via environment variable for containerized deployments
export AIRFLOW__CORE__LOAD_EXAMPLES=False