CVE-2021-38540
Published: 09 September 2021
Summary
CVE-2021-38540 is a critical-severity Improper Privilege Management (CWE-269) vulnerability in Apache Airflow. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-0016
Vulnerability details
The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code…
more
execution. This issue affects Apache Airflow >=2.0.0, <2.1.3.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Guarantees critical functions are protected by mandatory invocation of the access control mechanism.
Certification assesses that critical functions have required authentication controls in place.
Baseline tailoring enforces organization-specific privilege-management decisions rather than accepting generic high-water-mark settings.
Documented procedures for role definition, privilege assignment, and removal provide the management framework that prevents improper privilege management.
By determining which components are critical, the analysis drives proper privilege assignment and management for those components, limiting attacker escalation paths.
Developer training on implemented privilege management controls prevents improper assignment or escalation through correct configuration and operation.
Least-privilege and separation-of-duties principles prevent improper privilege management.
Usage restrictions and implementation guidelines limit how privileges may be exercised with the specified components.