Advisoriesby Ibis
Apache Airflow security advisories
171 advisories · 28 critical or high in 12 months · latest Sep 21
60 of 171 advisories
When a request to the Airflow core API carries both a session cookie and an...CVE-2026-82355no fix yetApache Airflow: the Core API logout endpoint revokes only a session token...CVE-2026-86473fixed in 3.3.2Apache Airflow: improper access controlCVE-2026-75158fixed in 3.3.2Apache Airflow missing team context permits cross-team Dag actions and XCom readsCVE-2026-68971fixed in 3.3.1Apache Airflow bulk endpoints log Variable and Connection secrets in cleartextCVE-2026-68969fixed in 3.3.1Apache Airflow Task SDK fails to mask list-shaped JSON VariablesCVE-2026-68970fixed in 3.3.1Apache Airflow Task SDK Callback deserialization can import arbitrary modules in the schedulerCVE-2026-67587fixed in 3.3.1Apache Airflow environment-variable secrets backend permits cross-team credential useCVE-2026-68076fixed in 3.3.1Apache Airflow Config API exposes team-scoped sensitive configuration valuesCVE-2026-65017fixed in 3.3.1Apache Airflow XCom API permits unsafe deserialization through JSON string literalsCVE-2026-59242fixed in 3.3.1Apache Airflow Variables UI fails to mask sensitive values in deeply nested iterablesCVE-2026-54183fixed in 3.3.1Apache Airflow Backfill API parser discrepancy permits cross-DAG authorization bypassCVE-2026-68968fixed in 3.3.1Apache Airflow scheduler unsafely deserializes human-in-the-loop task next_kwargsCVE-2026-67260fixed in 3.3.1Apache Airflow exception-node deserialization permits arbitrary callable executionCVE-2026-58076fixed in 3.3.1Apache Airflow exposes dict-valued var.json secrets in Rendered TemplatesCVE-2026-59244fixed in 3.3.1Apache Airflow's Backfill API authorized a request against a Dag id supplied by...CVE-2026-68968fixed in 3.3.1Apache Airflow wrote Variable values and Connection `extra` contents to the...CVE-2026-68969fixed in 3.3.1Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON...CVE-2026-68970fixed in 3.3.1Apache Airflow's asset materialization endpointCVE-2026-68971fixed in 3.3.1Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by...CVE-2026-67587fixed in 3.3.1Apache Airflow's environment-variable secrets backend resolved a team-scoped...CVE-2026-68076fixed in 3.3.1Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new...CVE-2026-67260fixed in 3.3.1Apache Airflow's Config API did not mask team-scoped sensitive configuration...CVE-2026-65017fixed in 3.3.1Apache Airflow's secrets masker did not mask `var.json` Variable values whose...CVE-2026-59244fixed in 3.3.1Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true`...CVE-2026-59242fixed in 3.3.1Apache Airflow's serialization layer reconstructed exception nodes by calling...CVE-2026-58076fixed in 3.3.1Apache Airflow's secrets masker hides values stored under sensitive key namesCVE-2026-54183fixed in 3.3.1Apache Airflow: RCE by race condition in example_xcom dagCVE-2025-54550fixed in 3.2.0Apache Airflow exposes deferred trigger kwargs in task-instance API responsesCVE-2026-49487fixed in 3.3.0apache-airflow DAG source authorization bypass exposes co-located DAG sourceCVE-2026-49296fixed in 3.3.0Apache Airflow allows code execution through unsafe serialized DAG deserializationCVE-2026-33264fixed in 3.3.0Apache Airflow exposes unreadable DAG identifiers in the scheduling dependencies graphCVE-2026-48891fixed in 3.3.0Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables APICVE-2026-48828fixed in 3.3.0Apache Airflow exposes secrets backend credentials through the Config APICVE-2026-48892fixed in 3.3.0Apache Airflow has no certificate validation on SMTP STARTTLS connectionsCVE-2026-49267fixed in 3.2.2Apache Airflow has an Authorization Bypass Through User-Controlled KeyCVE-2026-46764fixed in 3.2.2Apache Airflow: Auth manager doesn't invalidate JWT tokens after users click logoutCVE-2026-48726fixed in 3.2.2Apache Airflow Vulnerable to Deserialization of Untrusted DataCVE-2026-45360fixed in 3.2.2Apache Airflow Vulnerable to Exposure of Sensitive Information to an Unauthorized ActorCVE-2026-42358fixed in 3.2.2Apache Airflow vulnerable to Improper Neutralization of Special Elements Used in a Template EngineCVE-2026-42252fixed in 3.2.2Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized ActorCVE-2026-42360fixed in 3.2.2Apache Airflow Vulnerable to Authorization Bypass Through User-Controlled KeyCVE-2026-41084fixed in 3.2.2Apache Airflow has a Deserialization of Untrusted Data vulnerabilityCVE-2026-42359fixed in 3.2.2Apache Airflow has an Incorrect Authorization issueCVE-2026-45426fixed in 3.2.2Apache Airflow: Authenticated users can bypass the `is_safe_url` checkCVE-2026-40961fixed in 3.2.2Apache Airflow has a Link Following issueCVE-2026-40861fixed in 3.2.2Apache Airflow has a Sensitive Cookie in HTTPS Session Without 'Secure' AttributeCVE-2026-41017fixed in 3.2.2Apache Airflow has an Improper Authorization issueCVE-2026-40963fixed in 3.2.2Apache Airflow has a Missing Authorization issueCVE-2026-41014fixed in 3.2.2Apache Airflow: Incomplete redaction allowlist exposes secrets in Connection `extra` to read-permitted usersCVE-2026-45192fixed in 3.2.2Apache Airflow: improper access controlCVE-2026-38743fixed in 3.2.1rc1Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissionsCVE-2026-40690fixed in 3.2.1rc1Apache Airflow Exposes Secrets in Variables Saved as JSON DictionariesCVE-2026-32690fixed in 3.2.0In case of SQL errorsCVE-2026-30912fixed in 3.2.0Apache Airflow: code executionCVE-2026-25917fixed in 3.2.0Apache Airflow: JWT token appearing in logsCVE-2026-31987fixed in 3.2.0Apache Airflow: RCE by race condition in example_xcom dagCVE-2025-54550fixed in 3.2.0Apache Airflow: information disclosureCVE-2026-25219fixed in 3.1.8Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom APICVE-2026-33858fixed in 3.2.0Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UICVE-2025-66236fixed in 3.2.0