CVE-2021-26559

CWE-284 Improper Access Control on Configurations Endpoint for the Stable API

6.5 MediumFix available

Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when [webserver] expose_config is set to False in airflow.cfg. This allowed a privilege escalation attack. This issue affects Apache Airflow 2.0.0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

2.84%Up 0.2 points since Apr 14, 2021

What each source reports

NVD Score used6.5

Record: CVE-2021-26559
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness: CWE-284
Updated: 2026-11-02

CVE ListNo score

CWE-284 Improper Access Control on Configurations Endpoint for the Stable API

Record: CVE-2021-26559
Weakness: CWE-284
Updated: 2026-11-02

EUVDEUVD-2021-00140.0

Record: EUVD-2021-0014
CVSS: 0.0 NoneCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-ffw3-6mp6-jmvj7.1

Improper Access Control in Apache Airflow

Record: GHSA-ffw3-6mp6-jmvj
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-269, CWE-284
Updated: 2026-11-02

OSV6.5

Record: CVE-2021-26559
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVGHSA-ffw3-6mp6-jmvj7.1

Improper Access Control in Apache Airflow

Record: GHSA-ffw3-6mp6-jmvj
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-269, CWE-284
Updated: 2026-11-02

OSVBIT-airflow-2021-26559No score

CWE-284 Improper Access Control on Configurations Endpoint for the Stable API

Record: BIT-airflow-2021-26559
Updated: 2026-11-02

OSVPYSEC-2021-2No score

Record: PYSEC-2021-2
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`apache-airflow` PyPI	2.0.0 to 2.0.0	2.0.1rc1
`airflow` Bitnami	2.0.0 up to 2.0.1	2.0.1
`apache-airflow` PyPI	2.0.0 up to 2.0.1rc1	2.0.1rc1
`apache-airflow` PyPI	before 2.0.1, plus listed versions 1.8.11.8.2rc11.8.21.9.01.10.0 Show 45 moreShow less 1.10.1b11.10.1rc21.10.11.10.2b21.10.2rc11.10.2rc21.10.2rc31.10.21.10.3b11.10.3b21.10.3rc11.10.3rc21.10.31.10.4b21.10.4rc11.10.4rc21.10.4rc31.10.4rc41.10.4rc51.10.41.10.5rc11.10.51.10.6rc11.10.6rc21.10.61.10.7rc11.10.7rc21.10.7rc31.10.71.10.8rc11.10.81.10.9rc11.10.91.10.10rc11.10.10rc21.10.10rc31.10.10rc41.10.10rc51.10.101.10.11rc11.10.11rc21.10.111.10.12rc11.10.12rc21.10.12rc3	2.0.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-26559 is a medium vulnerability (CVSS 6.5) in Apache Airflow, published February 17, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.84%, the 86th percentile. Fixed in apache-airflow 2.0.1rc1.

References

Show 5 moreShow less

This page doesn't list everything

Left out here: 20 versions. The JSON record has them.