Cyber Resilience

CVE-2021-38540

Access Control in Apache Airflow 2.0.0 – 2.1.3

Published
09 September 2021
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.81 99.6th percentile
Risk Priority 97 floored blend · peak EPSS

Summary

CVE-2021-38540 is a critical-severity Improper Privilege Management (CWE-269) vulnerability in Apache Airflow. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 0.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code…

more

execution. This issue affects Apache Airflow >=2.0.0, <2.1.3.

CWE(s)

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
Unauthenticated access to the variable import endpoint on a public-facing Airflow webserver directly enables exploitation of a remote service.
T1059 Command and Scripting Interpreter Executionconfidence: MEDIUM
Modifying Airflow variables can lead to execution of attacker-controlled code within DAG tasks or trigger functions.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2020-13927Same product: Apache Airflow
CVE-2023-22888Same product: Apache Airflow
CVE-2023-40273Same product: Apache Airflow
CVE-2024-45784Same product: Apache Airflow
CVE-2023-42781Same product: Apache Airflow
CVE-2023-48291Same product: Apache Airflow
CVE-2023-22887Same product: Apache Airflow
CVE-2024-41937Same product: Apache Airflow
CVE-2023-50944Same product: Apache Airflow
CVE-2023-47265Same product: Apache Airflow

Affected Assets

apache
airflow
2.0.0 — 2.1.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 11 hardening rules · 8 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V6.2.3
  • V6.4.4
  • V10.4.16
  • V12.1.3

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-306 CWE-269

Guarantees critical functions are protected by mandatory invocation of the access control mechanism.

addresses: CWE-306 CWE-269

Certification assesses that critical functions have required authentication controls in place.

addresses: CWE-269 CWE-306

Baseline tailoring enforces organization-specific privilege-management decisions rather than accepting generic high-water-mark settings.

addresses: CWE-269 CWE-306

Documented procedures for role definition, privilege assignment, and removal provide the management framework that prevents improper privilege management.

addresses: CWE-269 CWE-306

By determining which components are critical, the analysis drives proper privilege assignment and management for those components, limiting attacker escalation paths.

addresses: CWE-269 CWE-306

Developer training on implemented privilege management controls prevents improper assignment or escalation through correct configuration and operation.

addresses: CWE-269 CWE-306

Least-privilege and separation-of-duties principles prevent improper privilege management.

addresses: CWE-269 CWE-306

Usage restrictions and implementation guidelines limit how privileges may be exercised with the specified components.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-03 full match
prevents

Directly requires authentication of users/services/hardware, which eliminates missing authentication for critical functions.

PR.AA-05 mostly match
prevents

PR.AA-05 enforces least privilege/SoD and periodic reviews that directly remove most privilege-assignment defects, yet CWE-269 also covers escalation paths and role design outside a single access-management control.

PR.AA-01 partial match
prevents

PR.AA-01 supplies credential/identity lifecycle support that can reduce some privilege-assignment errors but does not itself assign, modify, or check privileges, leaving most of CWE-269's risk unaddressed.

PR.IR-01 partial match
prevents

Protecting networks from unauthorized access can be undermined by missing authentication but does not address the root authentication gap.

PR.PS-01 partial match
prevents

Config baselines and default reviews can enforce some privilege-related settings (one facet) but do not address code-level assignment/tracking logic that defines CWE-269.

PR.PS-05 partial match
prevents

PR.PS-05 can partially limit exploitability of some privilege issues via execution restrictions, but does not address the core design/implementation flaws of CWE-269 at all.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

The control explicitly calls for authentication before any critical function is reached, eliminating the possibility of bypassing authentication for high-value operations.

prevents

Requiring owner approval, segregation of duties, and periodic reviews prevents the assignment of excessive or unnecessary privileges to users or processes.

prevents

Enforcing minimum-necessary privileges, temporary grants, and separation of administrative versus normal identities prevents the over-assignment of rights that CWE-269 describes.

prevents

Dynamic techniques that grant the minimum necessary rights for a given time window and revoke them afterward reduce the window in which excessive or unnecessary privileges can be exploited.

prevents

Explicit restrictions on privileged access and segregation of duties limit the scope of privileges that can be assigned, reducing the chance that excessive or unnecessary privileges are granted to entities.

prevents

Defining and communicating authorization levels for each role limits the assignment of excessive or unnecessary privileges.

References