CVE-2021-28359

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions <1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fix the issue completely. Update to Airflow 1.10.15 or 2.0.2. Please also update your Python version to the latest available PATCH releases of the installed MINOR versions, example update to Python 3.6.13 if you are on Python 3.6. (Those contain the fix for CVE-2021-23336 https://nvd.nist.gov/vuln/detail/CVE-2021-23336).

• CWE-79

• https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E
• https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E

Published

May 2, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-28353Remote Procedure Call Runtime Remote Code Execution Vulnerab…8.8
• CVE-2021-28354Remote Procedure Call Runtime Remote Code Execution Vulnerab…8.8
• CVE-2021-28355Remote Procedure Call Runtime Remote Code Execution Vulnerab…8.8
• CVE-2021-28356Remote Procedure Call Runtime Remote Code Execution Vulnerab…8.8
• CVE-2021-28357Remote Procedure Call Runtime Remote Code Execution Vulnerab…8.8
• CVE-2021-28358Remote Procedure Call Runtime Remote Code Execution Vulnerab…8.8
• CVE-2021-28361An issue was discovered in Storage Performance Development K…7.5
• CVE-2021-28362An issue was discovered in Contiki through 3.0. When sending…7.5
• CVE-2021-28363The urllib3 library 1.26.x before 1.26.4 for Python omits SS…6.5
• CVE-2021-28372ThroughTek's Kalay Platform 2.0 network allows an attacker t…8.3
• CVE-2021-28373The auth_internal plugin in Tiny Tiny RSS (aka tt-rss) befor…7.5
• CVE-2021-28374The Debian courier-authlib package before 0.71.1-2 for Couri…7.5