{"action":"Upgrade apache-airflow to 2.0.1 or later.","affected":[{"fixed":"2.0.1","introduced":"0"}],"component":"apache-airflow","cve_ids":["CVE-2021-26697"],"ecosystem":"PyPI","epss":0.04555,"exploited":false,"fixed_versions":["2.0.1"],"ghsa_id":"GHSA-fh37-cx83-q542","id":"tcs_01M5KGC7FWHTZZM62SK5A7TWZB","modified_at":"2023-12-06T01:00:58.601690Z","published_at":"2021-02-17T15:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-3","https://lists.apache.org/thread.html/re21fec81baea7a6d73b0b5d31efd07cc02c61f832e297f65bb19b519%40%3Cusers.airflow.apache.org%3E","https://lists.apache.org/thread.html/r36111262a59219a3e2704c71e97cf84937dae5ba7a1da99499e5d8f9@%3Cannounce.apache.org%3E","http://www.openwall.com/lists/oss-security/2021/02/17/2","https://lists.apache.org/thread.html/re21fec81baea7a6d73b0b5d31efd07cc02c61f832e297f65bb19b519@%3Cdev.airflow.apache.org%3E","https://lists.apache.org/thread.html/re21fec81baea7a6d73b0b5d31efd07cc02c61f832e297f65bb19b519@%3Cusers.airflow.apache.org%3E","https://github.com/advisories/GHSA-fh37-cx83-q542"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-3","url":"https://osv.dev/vulnerability/PYSEC-2021-3"}],"summary":"The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the"}