CVE-2017-17835 In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of…

Description

In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow.

Produits et versions touchés

Produit	Versions touchées	Corrigé en
Apache Airflow	Versions non publiées

Autres CVE de Apache Airflow

Les 153 CVE de Apache Airflow →

CVE-2026-86473 Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie Non notée CVE-2026-75158 Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter… Non notée CVE-2026-82355 When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token,… Non notée CVE-2026-75157 Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of… Non notée