CVE-2021-26697
Published: 17 February 2021
Summary
CVE-2021-26697 is a medium-severity Improper Privilege Management (CWE-269) vulnerability in Apache Airflow. Its CVSS base score is 5.3 (Medium).
Operationally, ranked in the top 14.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-0015
Vulnerability details
The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass…
more
to that endpoint and even after can just get some metadata about a DAG and a Task. This issue affects Apache Airflow 2.0.0.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Guarantees critical functions are protected by mandatory invocation of the access control mechanism.
Certification assesses that critical functions have required authentication controls in place.
Baseline tailoring enforces organization-specific privilege-management decisions rather than accepting generic high-water-mark settings.
Documented procedures for role definition, privilege assignment, and removal provide the management framework that prevents improper privilege management.
By determining which components are critical, the analysis drives proper privilege assignment and management for those components, limiting attacker escalation paths.
Developer training on implemented privilege management controls prevents improper assignment or escalation through correct configuration and operation.
Least-privilege and separation-of-duties principles prevent improper privilege management.
Usage restrictions and implementation guidelines limit how privileges may be exercised with the specified components.