CVE-2021-26697
Apache Airflow: Lineage API endpoint for Experimental API missed authentication check
The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue affects Apache Airflow 2.0.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue affects Apache Airflow 2.0.0.
- Record
CVE-2021-26697- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-269, CWE-306
- Updated
- 2026-11-02
CVE ListNo score
Apache Airflow: Lineage API endpoint for Experimental API missed authentication check
The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue affects Apache Airflow 2.0.0.
- Record
CVE-2021-26697- Weakness
- CWE-269
- Updated
- 2026-11-02
EUVDEUVD-2021-0015
The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue affects Apache Airflow 2.0.0.
- Record
EUVD-2021-0015- CVSS
- 0.0 None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fh37-cx83-q542
Improper Authentication in Apache Airflow
The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue only affects Apache Airflow 2.0.0.
- Record
GHSA-fh37-cx83-q542- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-269, CWE-287, CWE-306
- Updated
- 2026-11-02
OSV
The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue affects Apache Airflow 2.0.0.
- Record
CVE-2021-26697- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-fh37-cx83-q542
Improper Authentication in Apache Airflow
The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue only affects Apache Airflow 2.0.0.
- Record
GHSA-fh37-cx83-q542- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-269, CWE-287, CWE-306
- Updated
- 2026-11-02
OSVBIT-airflow-2021-26697No score
Apache Airflow: Lineage API endpoint for Experimental API missed authentication check
The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue affects Apache Airflow 2.0.0.
- Record
BIT-airflow-2021-26697- Updated
- 2026-11-02
OSVPYSEC-2021-3No score
The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue affects Apache Airflow 2.0.0.
- Record
PYSEC-2021-3- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache-airflowPyPI | 2.0.0 to 2.0.0 | 2.0.1rc1 |
airflowBitnami | 2.0.0 up to 2.0.1 | 2.0.1 |
apache-airflowPyPI | 2.0.0 up to 2.0.1rc1 | 2.0.1rc1 |
apache-airflowPyPI | before 2.0.1, plus listed versions 1.8.11.8.2rc11.8.21.9.01.10.0 Show 45 moreShow less1.10.1b11.10.1rc21.10.11.10.2b21.10.2rc11.10.2rc21.10.2rc31.10.21.10.3b11.10.3b21.10.3rc11.10.3rc21.10.31.10.4b21.10.4rc11.10.4rc21.10.4rc31.10.4rc41.10.4rc51.10.41.10.5rc11.10.51.10.6rc11.10.6rc21.10.61.10.7rc11.10.7rc21.10.7rc31.10.71.10.8rc11.10.81.10.9rc11.10.91.10.10rc11.10.10rc21.10.10rc31.10.10rc41.10.10rc51.10.101.10.11rc11.10.11rc21.10.111.10.12rc11.10.12rc21.10.12rc3 | 2.0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-26697 is a medium vulnerability (CVSS 5.3) in Apache Airflow, published February 17, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.61%, the 91st percentile. Fixed in apache-airflow 2.0.1rc1.
References
lists.apache.org/thread.html/re21fec81baea7a6d73b0b5d31efd07cc02c61f832e297f65bb19b519%40%3Cusers.airflow.apache.org%3E
openwall.com/lists/oss-security/2021/02/17/2
nvd.nist.gov/vuln/detail/CVE-2021-26697
github.com/apache/airflow/commit/21cedff205e7d62675949fda2aa4616d77232b76
Show 8 moreShow less
Left out here: 20 versions. The JSON record has them.