PyPI/apache-airflow CVE-2022-40754: unknown, EPSS 1.76%

In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's `/confirm` endpoint.

Action: Upgrade apache-airflow to 2.4.0b1 or later.

pip install apache-airflow==2.4.0b1

Affected

Fixed versions

Sources

• osv: PYSEC-2022-280
• https://github.com/apache/airflow/pull/26409
• https://lists.apache.org/thread/cn098dcp5x3c402xrb06p3l7nz5goffm
• https://github.com/advisories/GHSA-4fg5-j4mm-wfpg

CVE-2022-40754 · published 2022-09-21T08:15:00Z · modified 2026-06-10T17:00:21.863710446Z · JSON