apache-airflow vulnerabilities (PyPI)
158 vulnerabilities.
-
apache-airflowPyPI Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry 9.1 Critical -
apache-airflowPyPI Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter 4.3 Medium -
apache-airflowPyPI Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation 4.2 Medium -
apache-airflowPyPI Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI 6.5 Medium -
apache-airflowPyPI Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server 8.8 High -
apache-airflowPyPI Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint 5.4 Medium -
apache-airflowPyPI Apache Airflow: Airflow Variables were not masked in the UI for authenticated users 4.3 Medium -
apache-airflowPyPI Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization 7.3 High -
apache-airflowPyPI Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget 8.8 High -
apache-airflowPyPI Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass) 6.5 Medium -
apache-airflowPyPI Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id 7.5 High -
apache-airflowPyPI Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext 6.5 Medium -
apache-airflowPyPI Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI 6.5 Medium -
apache-airflowPyPI Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints 6.5 Medium -
apache-airflowPyPI Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection 5.4 Medium -
apache-airflowPyPI Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize() 9.8 Critical -
apache-airflowPyPI Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs 6.5 Medium -
apache-airflowPyPI Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key 6.5 Medium -
apache-airflowPyPI Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id} 6.5 Medium -
apache-airflowPyPI Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target 4.3 Medium -
apache-airflowPyPI Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options 6.5 Medium -
apache-airflowPyPI Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler 6.5 Medium -
apache-airflowPyPI Apache Airflow: Open Redirect Bypass Vulnerability 7.2 High -
apache-airflowPyPI Apache Airflow: DAG authorization bypass on /ui/structure/structure_data 3.1 Low -
apache-airflowPyPI Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints 4.3 Medium -
apache-airflowPyPI Apache Airflow: No certificate validation on SMTP STARTTLS connections 5.9 Medium -
apache-airflowPyPI Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy 5.9 Medium -
apache-airflowPyPI Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation 7.5 High -
apache-airflowPyPI Apache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern 9.1 Critical -
apache-airflowPyPI Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking 6.5 Medium -
apache-airflowPyPI Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets 6.5 Medium -
apache-airflowPyPI Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator 8.8 High -
apache-airflowPyPI Apache Airflow: Arbitrary import in custom deadline-reference deserialization 7.3 High -
apache-airflowPyPI Apache Airflow: Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access 3.1 Low -
apache-airflowPyPI Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter 4.3 Medium -
apache-airflowPyPI Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path 6.5 Medium -
apache-airflowPyPI Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response 6.5 Medium -
apache-airflowPyPI Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities 4.3 Medium -
apache-airflowPyPI Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated topologies and all DAGs names to unauthorized users 4.3 Medium -
apache-airflowPyPI Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1 3.7 Low -
apache-airflowPyPI Apache Airflow: Exposing stack trace in case of constraint error 7.5 High -
apache-airflowPyPI Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5) 7.2 High -
apache-airflowPyPI Apache Airflow: JWT token appearing in logs 7.5 High -
apache-airflowPyPI Apache Airflow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access 6.5 Medium -
apache-airflowPyPI Apache Airflow: RCE by race condition in example_xcom dag 8.1 High -
apache-airflowPyPI Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API 8.8 High -
apache-airflowPyPI Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI 7.5 High -
apache-airflowPyPI Apache Airflow: Airflow Logout Not Invalidating JWT 9.1 Critical -
apache-airflowPyPI Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure) 6.5 Medium -
apache-airflowPyPI Apache Airflow Provider for Databricks: TLS Certificate Verification Disabled in Databricks Provider K8s Token Exchange 4.8 Medium - Show olderLoading…