GHSA-gp5f-cx7h-8q6f
Apache Airflow's create action can upsert existing Pools/Connections/Variables
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | apache-airflow | >= 3.0.0, < 3.1.1 | 3.1.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.
References
External links from the advisory. They lead to third-party sites.