CVE-2017-17835: Apache Airflow

High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days.

In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow.

Affected products

• Apache Airflow: up to and including 1.8.2

Published 2019-01-23. Last modified 2026-06-17.