title: Apache Airflow: Creating DagRuns didn't respect Dag-level permissions in the Webserver
description: In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "can_create" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for.
problem types: Permission checks were limited.
affected:
{
product: Apache Airflow
vendor: Apache Software Foundation
versions:
status: affected, version: Apache Airflow 1.10 1.10.0 to 1.10.15
lessThan: 2.2.0, status: affected, version: Apache Airflow 2, versionType: custom
}
workarounds: This is a very low severity CVE and admins can mitigate this issue by removing the global "can_create" permissions on DagRun for Airflow versions >=2.0.0,<2.2.0 and 1.10.x versions that have set `rbac=True` in config.