CVE

CVE-2021-38540

9.8

CVSS

Description

The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow >=2.0.0, <2.1.3.

Attack Vector

Privileges Req.

User Interaction

apache airflow

Updated Oct 24, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

CVE-2021-38540 Scanner

Targets the /api/v1/variables endpoint in Apache Airflow versions 2.0.0 to 2.1.3, allowing unauthenticated attackers to add or modify variables used in DAGs.

Used 3.3k times · 3.4k assets checked · url

Scanner page →Run scanner

CVE history: apache airflow

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →