| Aug 12 | Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse. The authorization dependency parsed it with `int()` while the route handler parsed it as pydantic's `NonNegativeInt`, which accepts values `int()` rejec CVE-2026-68968High7.5fixed in 3.3.1 | High7.5 | 3.3.1 |
| Aug 12 | Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`). The audit-log masking recognised only top-level request fields, and a bulk request nests CVE-2026-68969Medium6.5fixed in 3.3.1 | Medium6.5 | 3.3.1 |
| Aug 12 | Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level matc CVE-2026-68970Medium6.5fixed in 3.3.1 | Medium6.5 | 3.3.1 |
| Aug 12 | Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncCallback` is itself an Airflow class it passes the default `allowed_deserialization_classes` allow-list, so tightening th CVE-2026-67587High8.8fixed in 3.3.1 | High8.8 | 3.3.1 |
| Aug 12 | Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are allowe CVE-2026-68076Medium5.4fixed in 3.3.1 | Medium5.4 | 3.3.1 |
| Aug 12 | Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author , who controls that value through the task execution API , can cause an CVE-2026-67260High7.3fixed in 3.3.1 | High7.3 | 3.3.1 |
| Aug 12 | Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI , the dict value failed an `isinstance(str)` guard , so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user wit CVE-2026-59244Medium6.5fixed in 3.3.1 | Medium6.5 | 3.3.1 |
| Aug 12 | Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was shown u CVE-2026-54183Medium4.3fixed in 3.3.1 | Medium4.3 | 3.3.1 |
| Jul 7 | Apache Airflow exposes deferred trigger kwargs in task-instance API responses CVE-2026-49487Medium6.5fixed in 3.3.0 | Medium6.5 | 3.3.0 |
| Jul 7 | apache-airflow DAG source authorization bypass exposes co-located DAG source CVE-2026-49296Medium6.5fixed in 3.3.0 | Medium6.5 | 3.3.0 |
| Jul 7 | Apache Airflow allows code execution through unsafe serialized DAG deserialization CVE-2026-33264Critical9.8fixed in 3.3.0 | Critical9.8 | 3.3.0 |
| Jul 7 | Apache Airflow exposes unreadable DAG identifiers in the scheduling dependencies graph CVE-2026-48891Medium4.3fixed in 3.3.0 | Medium4.3 | 3.3.0 |
| Jul 7 | Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API CVE-2026-48828Medium6.5fixed in 3.3.0 | Medium6.5 | 3.3.0 |
| Jul 7 | Apache Airflow exposes secrets backend credentials through the Config API CVE-2026-48892Medium6.5fixed in 3.3.0 | Medium6.5 | 3.3.0 |
| Jun 1 | Apache Airflow has no certificate validation on SMTP STARTTLS connections CVE-2026-49267Medium5.9fixed in 3.2.2 | Medium5.9 | 3.2.2 |
| Jun 1 | Apache Airflow has an Authorization Bypass Through User-Controlled Key CVE-2026-46764Medium4.3fixed in 3.2.2 | Medium4.3 | 3.2.2 |
| Jun 1 | Apache Airflow: Auth manager doesn't invalidate JWT tokens after users click logout CVE-2026-48726Medium6.5fixed in 3.2.2 | Medium6.5 | 3.2.2 |
| Jun 1 | Apache Airflow Vulnerable to Deserialization of Untrusted Data CVE-2026-45360High7.3fixed in 3.2.2 | High7.3 | 3.2.2 |
| Jun 1 | Apache Airflow Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2026-42358Medium6.5fixed in 3.2.2 | Medium6.5 | 3.2.2 |
| Jun 1 | Apache Airflow vulnerable to Improper Neutralization of Special Elements Used in a Template Engine CVE-2026-42252Critical9.1fixed in 3.2.2 | Critical9.1 | 3.2.2 |
| Jun 1 | Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2026-42360Medium6.5fixed in 3.2.2 | Medium6.5 | 3.2.2 |
| Jun 1 | Apache Airflow Vulnerable to Authorization Bypass Through User-Controlled Key CVE-2026-41084High7.5fixed in 3.2.2 | High7.5 | 3.2.2 |
| Jun 1 | Apache Airflow has a Deserialization of Untrusted Data vulnerability CVE-2026-42359High8.8fixed in 3.2.2 | High8.8 | 3.2.2 |
| Jun 1 | Apache Airflow has an Incorrect Authorization issue CVE-2026-45426Low3.1fixed in 3.2.2 | Low3.1 | 3.2.2 |
| Jun 1 | Apache Airflow: Authenticated users can bypass the `is_safe_url` check CVE-2026-40961High7.2fixed in 3.2.2 | High7.2 | 3.2.2 |
| Jun 1 | Apache Airflow has a Link Following issue CVE-2026-40861Medium6.5fixed in 3.2.2 | Medium6.5 | 3.2.2 |
| Jun 1 | Apache Airflow has a Sensitive Cookie in HTTPS Session Without 'Secure' Attribute CVE-2026-41017Medium5.9fixed in 3.2.2 | Medium5.9 | 3.2.2 |
| Jun 1 | Apache Airflow has an Improper Authorization issue CVE-2026-40963Low3.1fixed in 3.2.2 | Low3.1 | 3.2.2 |
| Jun 1 | Apache Airflow has a Missing Authorization issue CVE-2026-41014Medium4.3fixed in 3.2.2 | Medium4.3 | 3.2.2 |
| Jun 1 | Apache Airflow: Incomplete redaction allowlist exposes secrets in Connection `extra` to read-permitted users CVE-2026-45192Medium6.5fixed in 3.2.2 | Medium6.5 | 3.2.2 |
| Apr 24 | Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance record CVE-2026-38743Medium4.3fixed in 3.2.1rc1 | Medium4.3 | 3.2.1rc1 |
| Apr 24 | Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions CVE-2026-40690Medium4.3fixed in 3.2.1rc1 | Medium4.3 | 3.2.1rc1 |
| Apr 18 | Apache Airflow Exposes Secrets in Variables Saved as JSON Dictionaries CVE-2026-32690Low3.7fixed in 3.2.0 | Low3.7 | 3.2.0 |
| Apr 18 | In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue. CVE-2026-30912High7.5fixed in 3.2.0 | High7.5 | 3.2.0 |
| Apr 18 | Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low. CVE-2026-25917High7.2fixed in 3.2.0 | High7.2 | 3.2.0 |
| Apr 16 | Apache Airflow: JWT token appearing in logs CVE-2026-31987Medium7.5fixed in 3.2.0 | Medium7.5 | 3.2.0 |
| Apr 16 | Apache Airflow: RCE by race condition in example_xcom dag CVE-2025-54550High8.1fixed in 3.2.0 | High8.1 | 3.2.0 |
| Apr 15 | Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access CVE-2026-25219Medium6.5fixed in 3.1.8 | Medium6.5 | 3.1.8 |
| Apr 13 | Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API CVE-2026-33858High8.8fixed in 3.2.0 | High8.8 | 3.2.0 |
| Apr 13 | Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI CVE-2025-66236Mediumfixed in 3.2.0 | Medium | 3.2.0 |
| Apr 9 | Apache Airflow: JWT token still valid after logout CVE-2025-57735Critical9.1fixed in 3.2.0 | Critical9.1 | 3.2.0 |
| Apr 9 | Apache Airflow has an authorization bypass in DagRun wait endpoint CVE-2026-34538Medium6.5fixed in 3.2.0 | Medium6.5 | 3.2.0 |
| Mar 31 | Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange CVE-2026-32794Medium4.8fixed in 1.12.0 | Medium4.8 | 1.12.0 |
| Mar 17 | Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications CVE-2026-28779High7.5fixed in 3.1.8 | High7.5 | 3.1.8 |
| Mar 17 | Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization CVE-2026-30911High8.1fixed in 3.1.8 | High8.1 | 3.1.8 |
| Mar 17 | Apache Airflow: DAG authorization bypass CVE-2026-28563Medium4.3fixed in 3.1.8 | Medium4.3 | 3.1.8 |
| Mar 17 | Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata CVE-2026-26929High7.5fixed in 3.1.8 | High7.5 | 3.1.8 |
| Feb 24 | Apache Airflow exposes sensitive information in its log files CVE-2025-27555Medium6.5fixed in 2.11.1 | Medium6.5 | 2.11.1 |
| Feb 24 | Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate table CVE-2024-56373High8.4fixed in 2.11.1 | High8.4 | 2.11.1 |
| Feb 21 | Apache Airflow error reporting may expose full kwargs CVE-2025-65995Medium6.5fixed in 2.11.1, 3.1.5rc1 | Medium6.5 | 2.11.1, 3.1.5rc1 |
| Feb 9 | Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated Users CVE-2026-24098Medium6.5fixed in 3.1.7 | Medium6.5 | 3.1.7 |
| Feb 9 | Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access CVE-2026-22922Medium6.5fixed in 3.1.7 | Medium6.5 | 3.1.7 |
| Jan 16 | Apache Airflow secrets in rendered templates could contain parts of sensitive values when truncated CVE-2025-68438High7.5fixed in 3.1.6 | High7.5 | 3.1.6 |
| Jan 16 | Apache Airflow proxy credentials for various providers might leak in task logs CVE-2025-68675High7.5fixed in 2.11.1, 3.1.6 | High7.5 | 2.11.1, 3.1.6 |
| Dec 172025 | Edge3 Worker RPC RCE on Airflow 2. CVE-2025-67895Critical9.8fixed in 2.0.0 | Critical9.8 | 2.0.0 |
| Dec 152025 | Apache Airflow exposes secret values to authenticated UI users via rendered templates CVE-2025-66388Medium6.5fixed in 3.1.5 | Medium6.5 | 3.1.5 |
| Oct 302025 | Apache Airflow `/api/v2/dagReports` executes DAG Python in API CVE-2025-62402Medium5.4fixed in 3.1.1 | Medium5.4 | 3.1.1 |
| Oct 302025 | Apache Airflow's create action can upsert existing Pools/Connections/Variables CVE-2025-62503Medium4.6fixed in 3.1.1 | Medium4.6 | 3.1.1 |
| Oct 302025 | Apache Airflow has a command injection vulnerability in "example_dag_decorator" CVE-2025-54941Mediumfixed in 3.0.5 | Medium | 3.0.5 |
| Sep 262025 | Apache Airflow: Connection sensitive details exposed to users with READ permissions CVE-2025-54831Mediumfixed in 3.0.4 | Medium | 3.0.4 |
