A high-severity remote code execution vulnerability in Apache Airflow 2.x allows authenticated users to compromise the web server context through malicious database manipulation.

This vulnerability involves improper control of code generation (CWE-94) where an authenticated DAG Author can inject code into the web server by manipulating log template history. This requires the attacker to have existing DAG Author permissions and involves a user viewing historical task information.

The ability for a DAG Author to achieve remote code execution in the web-server context poses a critical risk to organizational data and infrastructure integrity. With a CVSS score of 8.4, this flaw could allow an attacker to gain full control over the Airflow web server, potentially leading to unauthorized data access, lateral movement within the network, and complete system compromise.

Immediate Action: Upgrade to Apache Airflow version 2.11.1 or later, as this release disables the vulnerable log template history functionality by default.

Proactive Monitoring: Review web server access logs for unusual activity or unexpected execution patterns, and monitor for unauthorized modifications to historical log configurations.

Compensating Controls: Restrict administrative and DAG Author access to trusted personnel only, and implement network segmentation to isolate the Airflow web server from sensitive internal resources.

Public Exploit Available: Unknown

Given the severity of this remote code execution vulnerability, organizations should prioritize the update to Apache Airflow 2.11.1 immediately. If an immediate upgrade is not feasible, ensure that access to the DAG authoring functionality is strictly limited to authorized users and monitor system logs for signs of potential exploitation.