In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit.

Summary

In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit.

Timeline

1. Sep 17, 2020, 2:01 PM UTCCVE published
2. Aug 4, 2024, 12:32 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a Apache Airflow

  Apache Airflow < 1.10.12

• apache-airflowPyPI

  fixed in 1.10.12

• apache-airflowPyPI

  fixed in 1.10.12

References 9