CVE-2021-38540 is a critical vulnerability affecting Apache Airflow versions 2.0.0 through 2.1.2, where an unauthenticated variable import endpoint allowed unauthorized users to manipulate Airflow variables. This flaw carries a CVSS score of 9.8, indicating a severe risk of denial of service, information disclosure, or remote code execution due to its network-based attack vector and low attack complexity. While not listed on CISA's KEV catalog, exploit intelligence shows available Nuclei templates, suggesting potential for exploitation, though there is minimal public discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.0.0, < 2.1.3CPE matchmatch criteria | cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.