CVE-2024-39877: 
Apache Airflow vulnerability analysis and mitigation

Apache Airflow versions 2.4.0 through 2.9.2 contain a security vulnerability (CVE-2024-39877) that was discovered in July 2024. The vulnerability allows authenticated DAG (Directed Acyclic Graph) authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which violates the Airflow Security model (NVD, Security Online).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The flaw is classified as CWE-94 (Improper Control of Generation of Code) and CWE-277 (Insecure Inherited Permissions). The vulnerability specifically relates to how Airflow handles the doc_md parameter, which can be manipulated to execute unauthorized code within the scheduler's context (NVD).

The exploitation of this vulnerability could enable attackers to gain unauthorized access to sensitive data, disrupt workflows, or potentially take control of the entire Airflow system. The high CVSS score indicates that successful exploitation could lead to significant compromise of system confidentiality, integrity, and availability (Security Online).

The vulnerability requires authentication as a DAG author to exploit, indicating a limited attack surface. However, once authenticated, the attack complexity is considered low, requiring no user interaction to execute (NVD).

The Apache Airflow team has addressed this vulnerability in version 2.9.3. Users running affected versions (2.4.0 through 2.9.2) are strongly advised to upgrade to version 2.9.3 or later to mitigate the risk (Openwall, NVD).