CVE-2024-56373: RCE in Apache Airflow DAG Author

The impact of CVE-2024-56373 is significant due to its potential for remote code execution. A successful exploit allows an attacker, already authenticated as a DAG Author, to gain complete control over the Airflow web server. This could lead to data breaches, system compromise, and the ability to execute arbitrary commands on the underlying infrastructure. The attack vector involves manipulating the database to inject malicious code that is then executed when historical task information is viewed. This bypasses normal authorization checks, as the attacker is already authenticated as a DAG Author, but leverages a flaw in the log template history feature. The blast radius extends beyond the Airflow environment itself, potentially impacting any systems accessible from the compromised web server.

1. Reserved2024-12-22
2. Published2026-02-24
3. Modified2026-03-02
4. EPSS updated2026-03-23

The primary mitigation for CVE-2024-56373 is to upgrade to Apache Airflow version 2.11.1 or Airflow 3, which includes the necessary fixes. If immediate upgrading is not possible, disabling the log template history functionality can reduce the attack surface. This can be achieved by modifying the Airflow configuration. As a temporary workaround, manual modification of historical log file names can also mitigate the vulnerability. After upgrading, verify the fix by attempting to access historical task information as a DAG Author and confirming that no malicious code is executed. Monitor Airflow logs for any unusual activity or database manipulation attempts.