CVE Feed

    Dashboard / CVE / CVE-2022-40127

    CVE-2022-40127

    A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.

    Published:Nov 14, 2022
    Last Modified:Apr 30, 2025
    EPS:Nov 14, 2022
    EPSS Score:0.93751
    CVSS Score:8.8

    Affected Products

    Vendor
    Apache
    Product
    Airflow

    Exploits

    https://github.com/jakabakos/CVE-2022-40127-Airflow-RCEhttps://github.com/Mr-xn/CVE-2022-40127

    Related CVEs

    CVE-2026-59244 (CVSS 6.5) — Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered …
    CVE-2026-58076 (CVSS 8.8) — Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class nam…
    CVE-2026-59242 (CVSS 5.4) — Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal …
    CVE-2026-54183 (CVSS 4.3) — Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the U…
    CVE-2026-67260 (CVSS 7.3) — Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swe…
    CVE-2026-67587 (CVSS 8.8) — Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, whic…
    CVE-2026-65017 (CVSS 6.5) — Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments.…
    CVE-2026-68968 (CVSS 7.5) — Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backf…
    CVE-2026-68969 (CVSS 6.5) — Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they w…
    CVE-2026-68970 (CVSS 6.5) — Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets store…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High