Description
Apache Airflow is an open-source workflow management platform for data engineering pipelines.
Acunetix determined that it was possible to access Airflow Web interface without authentication.
Airflow is designed to be accessed by trusted clients inside trusted environments. It's not recommended to have it publicly accessible.
Remediation
Restrict public access and upgrade to the latest version of Airflow
References
Related Vulnerabilities
Plone CMS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2012-5508)
Apache Tomcat JK connector security bypass
WordPress Plugin Advanced Custom Fields PRO Information Disclosure (6.0.2)
Joomla! Core 3.7.x Information Disclosure (3.7.0 - 3.7.5)
Jenkins Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-2064)