CVE-2021-26697

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-26697
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-26697.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-26697
Aliases
Published
2021-02-17T15:15:13.593Z
Modified
2026-07-08T21:26:15.837152Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue affects Apache Airflow 2.0.0.

References

Affected packages

Git / github.com/apache/airflow

Affected ranges

Type
GIT
Repo
https://github.com/apache/airflow
Events
Introduced
8217db8cb4b1ff302c5cf8662477ac00f701e78c
Last affected
8217db8cb4b1ff302c5cf8662477ac00f701e78c
Database specific 
{
    "cpe": "cpe:2.3:a:apache:airflow:2.0.0:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "last_affected": "2.0.0"
        }
    ]
}

Affected versions

2.*
2.0.0
providers-airbyte/2.*
providers-airbyte/2.0.0
providers-amazon/2.*
providers-amazon/2.0.0
providers-apache-beam/3.*
providers-apache-beam/3.0.0
providers-apache-cassandra/2.*
providers-apache-cassandra/2.0.0
providers-apache-druid/2.*
providers-apache-druid/2.0.0
providers-apache-hdfs/2.*
providers-apache-hdfs/2.0.0
providers-apache-hive/2.*
providers-apache-hive/2.0.0
providers-apache-kylin/2.*
providers-apache-kylin/2.0.0
providers-apache-livy/2.*
providers-apache-livy/2.0.0
providers-apache-pig/2.*
providers-apache-pig/2.0.0
providers-apache-pinot/2.*
providers-apache-pinot/2.0.0
providers-apache-spark/2.*
providers-apache-spark/2.0.0
providers-apache-sqoop/2.*
providers-apache-sqoop/2.0.0
providers-asana/1.*
providers-asana/1.0.0
providers-celery/2.*
providers-celery/2.0.0
providers-cloudant/2.*
providers-cloudant/2.0.0
providers-cncf-kubernetes/2.*
providers-cncf-kubernetes/2.0.0
providers-databricks/2.*
providers-databricks/2.0.0
providers-datadog/2.*
providers-datadog/2.0.0
providers-dingding/2.*
providers-dingding/2.0.0
providers-discord/2.*
providers-discord/2.0.0
providers-docker/2.*
providers-docker/2.0.0
providers-elasticsearch/2.*
providers-elasticsearch/2.0.1
providers-exasol/2.*
providers-exasol/2.0.0
providers-facebook/2.*
providers-facebook/2.0.0
providers-ftp/2.*
providers-ftp/2.0.0
providers-google/4.*
providers-google/4.0.0
providers-grpc/2.*
providers-grpc/2.0.0
providers-hashicorp/2.*
providers-hashicorp/2.0.0
providers-http/2.*
providers-http/2.0.0
providers-imap/2.*
providers-imap/2.0.0
providers-jdbc/2.*
providers-jdbc/2.0.0
providers-jenkins/2.*
providers-jenkins/2.0.0
providers-jira/2.*
providers-jira/2.0.0
providers-microsoft-azure/3.*
providers-microsoft-azure/3.0.0
providers-microsoft-mssql/2.*
providers-microsoft-mssql/2.0.0
providers-microsoft-winrm/2.*
providers-microsoft-winrm/2.0.0
providers-mongo/2.*
providers-mongo/2.0.0
providers-mysql/2.*
providers-mysql/2.0.0
providers-neo4j/2.*
providers-neo4j/2.0.0
providers-odbc/2.*
providers-odbc/2.0.0
providers-openfaas/2.*
providers-openfaas/2.0.0
providers-opsgenie/2.*
providers-opsgenie/2.0.0
providers-oracle/2.*
providers-oracle/2.0.0
providers-pagerduty/2.*
providers-pagerduty/2.0.0
providers-papermill/2.*
providers-papermill/2.0.0
providers-plexus/2.*
providers-plexus/2.0.0
providers-postgres/2.*
providers-postgres/2.0.0
providers-presto/2.*
providers-presto/2.0.0
providers-qubole/2.*
providers-qubole/2.0.0
providers-redis/2.*
providers-redis/2.0.0
providers-salesforce/3.*
providers-salesforce/3.0.0
providers-samba/2.*
providers-samba/2.0.0
providers-segment/2.*
providers-segment/2.0.0
providers-sendgrid/2.*
providers-sendgrid/2.0.0
providers-sftp/2.*
providers-sftp/2.0.0
providers-singularity/2.*
providers-singularity/2.0.0
providers-slack/4.*
providers-slack/4.0.0
providers-snowflake/2.*
providers-snowflake/2.0.0
providers-sqlite/2.*
providers-sqlite/2.0.0
providers-ssh/2.*
providers-ssh/2.0.0
providers-tableau/2.*
providers-tableau/2.0.0
providers-telegram/2.*
providers-telegram/2.0.0
providers-trino/2.*
providers-trino/2.0.0
providers-vertica/2.*
providers-vertica/2.0.0
providers-yandex/2.*
providers-yandex/2.0.0
providers-zendesk/2.*
providers-zendesk/2.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-26697.json"