{"id":"CVE-2021-38540","aliases":["BIT-airflow-2021-38540","EUVD-2021-0016","GHSA-h88f-r7cw-8fv3","PYSEC-2021-326"],"status":"published","title":"Apache Airflow: Variable Import endpoint missed authentication check","description":"The variable import endpoint was not protected by authentication in Airflow \u003e=2.0.0, \u003c2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow \u003e=2.0.0, \u003c2.1.3.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.80938,"percentile":0.99636,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-269","CWE-306"],"published":"2021-09-09T15:05:09Z","modified":"2026-10-24T10:30:39Z","exploits":[{"source":"nuclei","id":"CVE-2021-38540","title":"Apache Airflow - Unauthenticated Variable Import","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38540.yaml"},{"source":"pocgithub","id":"Captain-v-hook/PoC-for-CVE-2021-38540-","title":"Captain-v-hook/PoC-for-CVE-2021-38540-","date":"2022-06-13","url":"https://github.com/Captain-v-hook/PoC-for-CVE-2021-38540-"}],"fixes":[{"ecosystem":"PyPI","package":"apache-airflow","fixed_in":["2.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"airflow","fixed_in":["2.1.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"apache-airflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"airflow","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.1.3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"apache-airflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.3"}]}],"versions":["2.0.0","2.0.1","2.0.1rc1","2.0.1rc2","2.0.2","2.0.2rc1","2.1.0","2.1.0rc1","2.1.0rc2","2.1.1","2.1.1rc1","2.1.2","2.1.2rc1","2.1.3rc1"]},{"source":"osv","ecosystem":"PyPI","package":"apache-airflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.3"}]}],"versions":["2.0.0","2.0.1","2.0.1rc1","2.0.1rc2","2.0.2","2.0.2rc1","2.1.0","2.1.0rc1","2.1.0rc2","2.1.1","2.1.1rc1","2.1.2","2.1.2rc1","2.1.3rc1"]}],"products":[{"vendor":"apache","product":"airflow"},{"vendor":"apache software foundation","product":"apache airflow"}],"references":[{"url":"https://lists.apache.org/thread.html/rb34c3dd1a815456355217eef34060789f771b6f77c3a3dec77de2064%40%3Cusers.airflow.apache.org%3E","tags":["x_refsource_MISC","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/rac2ed9118f64733e47b4f1e82ddc8c8020774698f13328ca742b03a2%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38540","tags":["web","advisory"]},{"url":"https://lists.apache.org/thread.html/rac2ed9118f64733e47b4f1e82ddc8c8020774698f13328ca742b03a2@%3Cannounce.apache.org%3E","tags":["web"]},{"url":"https://github.com/apache/airflow/commit/bcec1df703cd4a01520a90c3f801cca6f97d9bfd","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h88f-r7cw-8fv3","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2021-326.yaml","tags":["web"]},{"url":"https://github.com/apache/airflow","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-38540","title":"Apache Airflow: Variable Import endpoint missed authentication check","description":"The variable import endpoint was not protected by authentication in Airflow \u003e=2.0.0, \u003c2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow \u003e=2.0.0, \u003c2.1.3.","status":"published","published":"2021-09-09T15:05:09Z","modified":"2024-08-04T01:44:23.448Z","cwes":["CWE-269"],"updated_at":"2026-11-02T14:33:07.349244Z"}],"euvd":[{"id":"EUVD-2021-0016","description":"The variable import endpoint was not protected by authentication in Airflow \u003e=2.0.0, \u003c2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow \u003e=2.0.0, \u003c2.1.3.","status":"published","published":"2021-09-09T15:05:09Z","modified":"2024-08-04T01:44:23Z","updated_at":"2026-11-03T03:24:24.781045Z"}],"ghsa":[{"id":"GHSA-h88f-r7cw-8fv3","title":"Missing Authentication for Critical Function in Apache Airflow","description":"The variable import endpoint was not protected by authentication in Airflow \u003e=2.0.0, \u003c2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow \u003e=2.0.0, \u003c2.1.3.","status":"published","published":"2022-05-24T19:14:00Z","modified":"2024-09-11T19:50:18Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:38:02.014847Z"}],"nvd":[{"id":"CVE-2021-38540","description":"The variable import endpoint was not protected by authentication in Airflow \u003e=2.0.0, \u003c2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow \u003e=2.0.0, \u003c2.1.3.","status":"published","published":"2021-09-09T15:15:09.17Z","modified":"2026-06-17T04:02:19.753Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-269","CWE-306"],"updated_at":"2026-11-02T14:06:58.502206Z"}],"osv":[{"id":"CVE-2021-38540","description":"The variable import endpoint was not protected by authentication in Airflow \u003e=2.0.0, \u003c2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow \u003e=2.0.0, \u003c2.1.3.","status":"published","published":"2021-09-09T15:15:09.17Z","modified":"2026-10-24T10:30:39.971722591Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:20.843843Z"},{"id":"GHSA-h88f-r7cw-8fv3","title":"Missing Authentication for Critical Function in Apache Airflow","description":"The variable import endpoint was not protected by authentication in Airflow \u003e=2.0.0, \u003c2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow \u003e=2.0.0, \u003c2.1.3.","status":"published","published":"2022-05-24T19:14:00Z","modified":"2024-09-11T20:02:06.795248Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:46:48.920784Z"},{"id":"BIT-airflow-2021-38540","title":"Apache Airflow: Variable Import endpoint missed authentication check","description":"The variable import endpoint was not protected by authentication in Airflow \u003e=2.0.0, \u003c2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow \u003e=2.0.0, \u003c2.1.3.","status":"published","published":"2024-03-06T10:58:56.46Z","modified":"2026-09-08T08:45:21.267905997Z","updated_at":"2026-11-02T15:28:28.267217Z"},{"id":"PYSEC-2021-326","description":"The variable import endpoint was not protected by authentication in Airflow \u003e=2.0.0, \u003c2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow \u003e=2.0.0, \u003c2.1.3.","status":"published","published":"2021-09-09T15:15:00Z","modified":"2023-12-06T01:01:25.686699Z","updated_at":"2026-11-02T15:52:52.682031Z"}]}}