Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-p42d-ta7v-7yhn
Vulnerability ID VCID-p42d-ta7v-7yhn
Aliases CVE-2022-38170
GHSA-q8h9-pqcx-59hw
PYSEC-2022-261
Summary In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
System Score Found at
epss 0.00274 https://api.first.org/data/v1/epss?cve=CVE-2022-38170
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-q8h9-pqcx-59hw
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-38170
https://github.com/advisories/GHSA-q8h9-pqcx-59hw
https://github.com/apache/airflow/commit/b6a2cd1aa34f69a36ea127e4f7f5ba87f4aca420
https://github.com/apache/airflow/commit/bf01d10cd348e679916034de1befb79ec6e46ff8
https://github.com/apache/airflow/commit/c14ea8f0f34944d2ecfa9021d167602e8b2b8b90
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2022-261.yaml
https://lists.apache.org/thread/zn8mbbb1j2od5nc9zhrvb7rpsrg1vvzv
http://www.openwall.com/lists/oss-security/2022/09/02/12
http://www.openwall.com/lists/oss-security/2022/09/02/3
http://www.openwall.com/lists/oss-security/2022/09/21/2
CVE-2022-38170 https://nvd.nist.gov/vuln/detail/CVE-2022-38170
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.51046
EPSS Score 0.00274
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T20:30:35.478253+00:00 Pypa Importer Import https://github.com/pypa/advisory-database/blob/main/vulns/apache-airflow/PYSEC-2022-261.yaml 38.6.0