CVE-2024-28746

Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access.  Users of Apache Airflow are recommended to upgrade to version 2.8.3 or newer to mitigate the risk associated with this vulnerability

• CWE-281

• http://www.openwall.com/lists/oss-security/2024/03/13/5Mailing List, Third Party Advisory
• https://github.com/apache/airflow/pull/37881Patch
• https://lists.apache.org/thread/b4pffc7w7do6qgk4jjbyxvdz5odrvny7Mailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2024/03/13/5Mailing List, Third Party Advisory
• https://github.com/apache/airflow/pull/37881Patch
• https://lists.apache.org/thread/b4pffc7w7do6qgk4jjbyxvdz5odrvny7Mailing List, Vendor Advisory

Published

Mar 14, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28739An issue in Koha ILS 23.05 and before allows a remote attack…7.2
• CVE-2024-2874An issue has been discovered in GitLab CE/EE affecting all v…6.5
• CVE-2024-28740Cross Site Scripting vulnerability in Koha ILS 23.05 and bef…9.6
• CVE-2024-28741Cross Site Scripting vulnerability in EginDemirbilek NorthSt…8.8
• CVE-2024-28744The password is empty in the initial configuration of ACERA …8.8
• CVE-2024-28745Improper export of Android application components issue exis…3.3
• CVE-2024-28747An unauthenticated remote attacker can use the hard-coded cr…9.8
• CVE-2024-28748A remote attacker with high privileges may use a reading fil…7.2
• CVE-2024-28749A remote attacker with high privileges may use a writing fil…7.2
• CVE-2024-2875Rejected reason: ** REJECT ** Duplicate reservation. Please …
• CVE-2024-28750A remote attacker with high privileges may use a deleting fi…7.2
• CVE-2024-28751An high privileged remote attacker can enable telnet access …9.1