Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
$8,000 CVE-2022-40604: Apache Airflow: Format String Vulnerability 🔗 https://hackerone.com/reports/1707287 🔗 http://t.me/luckyhacker42 https://t.co/B3TVxhqnLR
Post summary
The post announces the discovery of CVE-2022-40604, a format‑string vulnerability in Apache Airflow, provides a link to a HackerOne report and a Telegram channel, but does not detail exploitation tools, active attacks, patches, or PoC code.
$8,000 CVE-2022-40604: Apache Airflow: Format String Vulnerability 👨💻 leixiao 🔗 https://hackerone.com/reports/1707287 🔗 https://t.me/luckyhacker42 https://t.co/l9I8VExEB3
Post summary
The post announces an $8,000 bounty for CVE-2022-40604, a format‑string vulnerability in Apache Airflow, linking to a HackerOne report for details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | apache | airflow | - | - | - |