How serious is CVE-2024-56373?

This vulnerability has a CVSS score of 8.4 out of 10, classified as HIGH severity. Proof-of-concept exploit code is publicly available, making this an active threat.

Is there exploit code available for CVE-2024-56373?

Yes, proof-of-concept exploit code for CVE-2024-56373 is publicly available on GitHub and security research platforms. This increases the risk of active exploitation.

Which products are affected by CVE-2024-56373?

CVE-2024-56373 affects apache airflow. Check the full CVE details for specific version information.

How do I fix CVE-2024-56373?

To remediate CVE-2024-56373, check for security patches from apache. Apply all available updates and security patches. If no patch is available, implement recommended workarounds or security controls to mitigate the risk.

CVE-2024-56373

High

|8.4

Exploit Available

Plain English Summary

AI-powered analysis for quick understanding

This vulnerability allows a user with high-level permissions in Apache Airflow to execute arbitrary code on the web server by manipulating the database, particularly when viewing historical task logs. To mitigate this risk, users should upgrade to Airflow 3 or disable the log template history feature, which is turned off by default in version 2.11.1.

Technical Description

DAG Author (who already has quite a lot of permissions) could manipulate database of Airflow 2 in the way to execute arbitrary code in the web-server context, which they should normally not be able to do, leading to potentially remote code execution in the context of web-server (server-side) as a result of a user viewing historical task information. The functionality responsible for that (log template history) has been disabled by default in 2.11.1 and users should upgrade to Airflow 3 if they want to continue to use log template history. They can also manually modify historical log file names if they want to see historical logs that were generated before the last log template change.

CVSS Vector Analysis

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredHigh

User InteractionRequired

Confidentiality ImpactHigh

Integrity ImpactHigh

Availability ImpactHigh

ScopeChanged

Vector String

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Exploit Resources

Search for proof-of-concept code and exploit modules

GitHub Search Exploit-DB Nuclei Templates Metasploit Vulners

Official References

NIST NVD

Est. Bounty

$3,947($1K-$5K)

Vendor Response

Grade APatched in 0 days

Quick Information

Published

Feb 24, 2026

about 1 month ago

Last Modified

Feb 24, 2026

about 1 month ago

Vendor

apache

Product

airflow

Related Vulnerabilities

CVE-2025-66249Medium

This vulnerability allows an attacker to access files outside of the intended directory on an Apache Livy server, potentially exposing sensitive data. It can only be exploited if the server is configured with a non-default setting for local directory access, so users should upgrade to version 0.9.0 to protect against this risk.

CVE-2025-60012Medium

This vulnerability allows an attacker to access files they shouldn't be able to reach by sending specially crafted requests to Apache Livy's REST or JDBC interface. To exploit this, the attacker must already have access to these interfaces and be able to include specific Spark configuration values in their requests.

CVE-2026-25604Medium

An attacker could gain unauthorized access to different AWS instances by reusing SAML authentication responses from other instances, potentially bypassing access controls. This vulnerability occurs because the system does not verify the origin of the SAML response against the actual instance URL, so it's crucial to upgrade to version 9.22.0 of the provider if you're using AWS Auth Manager.

CVE-2025-69219High

This vulnerability allows an attacker with access to the database to run unauthorized code, effectively giving them the same permissions as the original creator of workflows in Airflow. While direct access to the database is uncommon and not recommended, upgrading to version 6.0.0 of the provider is essential to eliminate this risk.

CVE-2026-24713Critical

This vulnerability allows an attacker to send malicious input to Apache IoTDB, potentially leading to unauthorized access or manipulation of data. It affects versions 1.0.0 to 1.3.6 and 2.0.0 to 2.0.6, so users should upgrade to the latest versions to protect against this risk.