airflow vulnerabilities (Bitnami)
148 vulnerabilities.
airflowBitnamiApache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI7.5 HighairflowBitnamiApache Airflow: Airflow Logout Not Invalidating JWT9.1 CriticalairflowBitnamiApache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure)6.5 MediumairflowBitnamiApache Airflow: DAG authorization bypass4.3 MediumairflowBitnamiApache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata6.5 MediumairflowBitnamiApache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization8.1 HighairflowBitnamiApache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications7.5 HighairflowBitnamiApache Airflow: Connection Secrets not masked in UI when Connection are added via Airflow cli6.5 MediumairflowBitnamiApache Airflow: SSTI to Code Execution in Airflow through Shared DB Information8.4 HighairflowBitnamiApache Airflow: Disclosure of secrets to UI via kwargs6.5 MediumairflowBitnamiApache Airflow: Airflow externalLogUrl Permission Bypass6.5 MediumairflowBitnamiApache Airflow: Assigning single DAG permission leaked all DAGs Import Errors6.5 MediumairflowBitnamiApache Airflow: proxy credentials for various providers might leak in task logs7.5 HighairflowBitnamiApache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated7.5 HighairflowBitnamiApache Airflow: Secrets in rendered templates not redacted properly and exposed in the UI6.5 MediumairflowBitnamiApache Airflow: Command injection in "example_dag_decorator"4.6 MediumairflowBitnamiApache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API5.4 MediumairflowBitnamiApache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)4.6 MediumairflowBitnamiApache Airflow: Connection sensitive details exposed to users with READ permissions6.5 MediumairflowBitnamiApache Airflow: Sensitive configuration values are not masked in the logs by default7.5 HighairflowBitnamiApache Airflow: Secrets not masked in UI when sensitive variables are set via Airflow cli4.9 MediumairflowBitnamiApache Airflow: Authenticated DAG authors could execute code on scheduler nodes8.8 HighairflowBitnamiApache Airflow: Command Injection in an example DAG8.8 HighairflowBitnamiApache Airflow: Stored XSS Vulnerability on provider link6.1 MediumairflowBitnamiApache Airflow: DAG Author Code Execution possibility in airflow-scheduler8.8 HighairflowBitnamiApache Airflow: Potential XSS Vulnerability5.4 MediumairflowBitnamiApache Airflow: Cache Control - Storage of Sensitive Data in Browser Cache5.5 MediumairflowBitnamiApache Airflow: XSS vulnerability in Task Instance Log/Log Details5.4 MediumairflowBitnamiApache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used4.3 MediumairflowBitnamiApache Airflow: Potentially harmful permission changing by log task handler5.3 MediumairflowBitnamiApache Airflow: Ignored Airflow Permissions8.1 HighairflowBitnamiApache Airflow: Overly broad default permissions for Viewer/Ops (audit logs)4.7 MediumairflowBitnamiApache Airflow: Dag Code and Import Error Permissions Ignored5.9 MediumairflowBitnamiApache Airflow: Bypass permission verification to read code of other dags6.5 MediumairflowBitnamiApache Airflow: Potential pickle deserialization vulnerability in XComs7.5 HighairflowBitnamiApache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service6.5 MediumairflowBitnamiApache Airflow: Improper access control to DAG resources4.3 MediumairflowBitnamiApache Airflow: Improper access control vulnerability on the "varimport" endpoint6.5 MediumairflowBitnamiApache Airflow: DAG Params alllow to embed unchecked Javascript5.4 MediumairflowBitnamiApache Airflow: Missing CSRF protection on DAG/trigger6.5 MediumairflowBitnamiApache Airflow: Permission verification bypass allows viewing dagruns of other dags6.5 MediumairflowBitnamiApache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access)4.3 MediumairflowBitnamiApache Airflow Celery provider, Apache Airflow: Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend7.5 HighairflowBitnamiApache Airflow: Sensitive parameters exposed in API when "non-sensitive-only" configuration is set4.3 MediumairflowBitnamiApache Airflow: Bypass permission verification to view task instances of other dags6.5 MediumairflowBitnamiApache Airflow: Improper access control to DAG resources6.5 MediumairflowBitnamiApache Airflow: Configuration information leakage vulnerability4.3 MediumairflowBitnamiApache Airflow: Improper access control vulnerability in the "List dag warnings" feature6.5 MediumairflowBitnamiApache Airflow: Secrets can be unmasked in the "Rendered Template"6.5 MediumairflowBitnamiApache Airflow Dag Runs Broken Access Control Vulnerability4.3 Medium- Show moreLoading…