PyPI/apache-airflow CVE-2022-41672: unknown, EPSS 1.48%

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

Action: Upgrade apache-airflow to 2.4.2rc1 or later.

pip install apache-airflow==2.4.2rc1

Affected

Fixed versions

Sources

• osv: PYSEC-2022-42983
• https://github.com/apache/airflow/pull/26635
• https://lists.apache.org/thread/ohf3pvd3dftb8zb01yngbn1jtkq5m08y
• https://github.com/advisories/GHSA-3q8r-f3pj-3gc4

CVE-2022-41672 · published 2022-10-07T07:15:00Z · modified 2026-06-10T17:00:20.034391230Z · JSON