CVE-2024-26280

Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by default, they need to be explicitly granted permissions to see the logs. Only admin users have audit log permission by default. Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability

• CWE-276

• http://www.openwall.com/lists/oss-security/2024/03/01/1Mailing List, Third Party Advisory
• https://github.com/apache/airflow/pull/37501Issue Tracking, Patch
• https://lists.apache.org/thread/knskxxxml95091rsnpxkpo1jjp8rj0fhMailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2024/03/01/1Mailing List, Third Party Advisory
• https://github.com/apache/airflow/pull/37501Issue Tracking, Patch
• https://lists.apache.org/thread/knskxxxml95091rsnpxkpo1jjp8rj0fhMailing List, Vendor Advisory

Published

Mar 1, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-26275A vulnerability has been identified in JT2Go (All versions <…7.8
• CVE-2024-26276A vulnerability has been identified in JT2Go (All versions <…5.5
• CVE-2024-26277A vulnerability has been identified in JT2Go (All versions <…4.8
• CVE-2024-26278The Custom Fields component not correctly filter inputs, lea…6.1
• CVE-2024-26279The wrapper extensions do not correctly validate inputs, lea…6.1
• CVE-2024-2628Inappropriate implementation in Downloads in Google Chrome p…4.3
• CVE-2024-26281Upon scanning a JavaScript URI with the QR code scanner, an …4.7
• CVE-2024-26282Using an AMP url with a canonical element, an attacker could…7.1
• CVE-2024-26283An attacker could have executed unauthorized scripts on top …7.8
• CVE-2024-26284Utilizing a 302 redirect, an attacker could have conducted a…6.1
• CVE-2024-26287Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-26288An unauthenticated remote attacker can influence the communi…8.7