IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-03-09 11:16

MODIFIED

2026-03-09 11:16

EPSS (Prob. Exploit)

0.71%

Top 47.0%

DATA SOURCES:

NVD 🔗 2026-03-09 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-10-28 OSV 🔗 2026-03-16

> DESCRIPTION

A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same permissions as Dag Author. Since direct DB access is not usual and recommended for Airflow, the likelihood of it making any damage is low. You should upgrade to version 6.0.0 of the provider to avoid even that risk.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-913

> CWE DETAILED DESCRIPTIONS

CWE-913: Improper Control of Dynamically-Managed Code Resources - The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

> GITHUB SECURITY ADVISORY

GHSA-9r5j-7r2x-rv4g HIGH

Apache Airflow Providers Http has Unsafe Pickle Deserializatio leading to RCE via HttpOperator

AFFECTED PACKAGES:

PIP / apache-airflow-providers-http

< 6.0.0

Fixed in: 6.0.0

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:

Unknown / Unknown

2733 versions affected

ALIASES:

GHSA-9r5j-7r2x-rv4g

> HISTORIQUE DES MODIFICATIONS

Première apparition

09/03/2026 11:16

Source: NVD

📊 ENRICHISSEMENT 01/04/2026 06:02

CWE

Champ modifié: Description CWE

Ancienne valeur:

N/A

Nouvelle valeur:

Total des modifications: 1 Dernière mise à jour: 7 months ago

> REFERENCES

https://github.com/apache/airflow/pull/61662

https://lists.apache.org/thread/zjkfb2njklro68tqzym092r4w65m5dq0

http://www.openwall.com/lists/oss-security/2026/03/09/1