CVE Feed

    Dashboard / CVE / CVE-2022-45402

    CVE-2022-45402

    In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint.

    Published:Nov 15, 2022
    Last Modified:Apr 30, 2025
    EPS:Nov 15, 2022
    EPSS Score:0.37664
    CVSS Score:6.1

    Affected Products

    Vendor
    Apache
    Product
    Airflow

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-178 Cross-Site Flashing

    Related CVEs

    CVE-2026-59244 (CVSS 6.5) — Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered …
    CVE-2026-58076 (CVSS 8.8) — Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class nam…
    CVE-2026-59242 (CVSS 5.4) — Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal …
    CVE-2026-54183 (CVSS 4.3) — Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the U…
    CVE-2026-67260 (CVSS 7.3) — Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swe…
    CVE-2026-67587 (CVSS 8.8) — Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, whic…
    CVE-2026-65017 (CVSS 6.5) — Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments.…
    CVE-2026-68968 (CVSS 7.5) — Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backf…
    CVE-2026-68969 (CVSS 6.5) — Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they w…
    CVE-2026-68970 (CVSS 6.5) — Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets store…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High