Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-zean-aktv-uqcu
Vulnerability ID VCID-zean-aktv-uqcu
Aliases BIT-airflow-2024-32077
CVE-2024-32077
GHSA-52gm-qmg3-r4qp
PYSEC-2024-264
Summary Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs.  Users are recommended to upgrade to version 2.9.1, which fixes this issue.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
System Score Found at
epss 0.03397 https://api.first.org/data/v1/epss?cve=CVE-2024-32077
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-52gm-qmg3-r4qp
cvssv3.1 5.4 https://github.com/apache/airflow
generic_textual MODERATE https://github.com/apache/airflow
cvssv3.1 5.4 https://github.com/apache/airflow/commit/87acf61f574daf47ce9e03a986e352a2c727f4ce
generic_textual MODERATE https://github.com/apache/airflow/commit/87acf61f574daf47ce9e03a986e352a2c727f4ce
cvssv3.1 5.4 https://github.com/apache/airflow/pull/38882
generic_textual MODERATE https://github.com/apache/airflow/pull/38882
ssvc Track https://github.com/apache/airflow/pull/38882
cvssv3.1 5.4 https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77
generic_textual MODERATE https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77
ssvc Track https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77
cvssv3.1 5.4 https://nvd.nist.gov/vuln/detail/CVE-2024-32077
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2024-32077
cvssv3.1 5.4 http://www.openwall.com/lists/oss-security/2024/05/14/1
generic_textual MODERATE http://www.openwall.com/lists/oss-security/2024/05/14/1
ssvc Track http://www.openwall.com/lists/oss-security/2024/05/14/1
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-32077
https://github.com/apache/airflow
https://github.com/apache/airflow/commit/87acf61f574daf47ce9e03a986e352a2c727f4ce
https://github.com/apache/airflow/pull/38882
https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77
http://www.openwall.com/lists/oss-security/2024/05/14/1
CVE-2024-32077 https://nvd.nist.gov/vuln/detail/CVE-2024-32077
GHSA-52gm-qmg3-r4qp https://github.com/advisories/GHSA-52gm-qmg3-r4qp
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/apache/airflow
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/apache/airflow/commit/87acf61f574daf47ce9e03a986e352a2c727f4ce
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/apache/airflow/pull/38882
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-05-14T18:35:34Z/ Found at https://github.com/apache/airflow/pull/38882
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-05-14T18:35:34Z/ Found at https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-32077
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at http://www.openwall.com/lists/oss-security/2024/05/14/1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-05-14T18:35:34Z/ Found at http://www.openwall.com/lists/oss-security/2024/05/14/1
Exploit Prediction Scoring System (EPSS)
Percentile 0.87615
EPSS Score 0.03397
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T20:34:26.974073+00:00 Pypa Importer Import https://github.com/pypa/advisory-database/blob/main/vulns/apache-airflow/PYSEC-2024-264.yaml 38.6.0