apache-airflow vulnerabilities (PyPI)
158 vulnerabilities.
apache-airflowPyPIApache Airflow: DAG authorization bypass4.3 Mediumapache-airflowPyPIApache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata6.5 Mediumapache-airflowPyPIApache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization8.1 Highapache-airflowPyPIApache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications7.5 Highapache-airflowPyPIApache Airflow: Connection Secrets not masked in UI when Connection are added via Airflow cli6.5 Mediumapache-airflowPyPIApache Airflow: SSTI to Code Execution in Airflow through Shared DB Information8.4 Highapache-airflowPyPIApache Airflow: Disclosure of secrets to UI via kwargs6.5 Mediumapache-airflowPyPIApache Airflow: Airflow externalLogUrl Permission Bypass6.5 Mediumapache-airflowPyPIApache Airflow: Assigning single DAG permission leaked all DAGs Import Errors6.5 Mediumapache-airflowPyPIApache Airflow: proxy credentials for various providers might leak in task logs7.5 Highapache-airflowPyPIApache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated7.5 Highapache-airflowPyPIApache Airflow Providers Edge3: Edge3 Worker RPC RCE on Airflow 29.8 Criticalapache-airflowPyPIApache Airflow: Secrets in rendered templates not redacted properly and exposed in the UI6.5 Mediumapache-airflowPyPIApache Airflow: Command injection in "example_dag_decorator"4.6 Mediumapache-airflowPyPIApache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API5.4 Mediumapache-airflowPyPIApache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)4.6 Mediumapache-airflowPyPIApache Airflow: Connection sensitive details exposed to users with READ permissions6.5 Mediumapache-airflowPyPIApache Airflow: Sensitive configuration values are not masked in the logs by default7.5 Highapache-airflowPyPIApache Airflow: Secrets not masked in UI when sensitive variables are set via Airflow cli4.9 Mediumapache-airflowPyPIApache Airflow: Authenticated DAG authors could execute code on scheduler nodes8.8 Highapache-airflowPyPIApache Airflow: Command Injection in an example DAG8.8 Highapache-airflowPyPIApache Airflow: Stored XSS Vulnerability on provider link6.1 Mediumapache-airflowPyPIApache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow9.8 Criticalapache-airflowPyPIApache Airflow: DAG Author Code Execution possibility in airflow-scheduler8.8 Highapache-airflowPyPIApache Airflow: Potential XSS Vulnerability5.4 Mediumapache-airflowPyPIApache Airflow: Cache Control - Storage of Sensitive Data in Browser Cache5.5 Mediumapache-airflowPyPIApache Airflow: XSS vulnerability in Task Instance Log/Log Details5.4 Mediumapache-airflowPyPIApache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used4.3 Mediumapache-airflowPyPIApache Airflow: Potentially harmful permission changing by log task handler5.3 Mediumapache-airflowPyPIApache Airflow: Ignored Airflow Permissions8.1 Highapache-airflowPyPIApache Airflow: Overly broad default permissions for Viewer/Ops (audit logs)4.7 Mediumapache-airflowPyPIApache Airflow: Dag Code and Import Error Permissions Ignored5.9 Mediumapache-airflowPyPIApache Airflow: Bypass permission verification to read code of other dags6.5 Mediumapache-airflowPyPIApache Airflow: Potential pickle deserialization vulnerability in XComs7.5 Highapache-airflowPyPIApache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service6.5 Mediumapache-airflowPyPIApache Airflow: Improper access control to DAG resources4.3 Mediumapache-airflowPyPIApache Airflow: Improper access control vulnerability on the "varimport" endpoint6.5 Mediumapache-airflowPyPIApache Airflow: DAG Params alllow to embed unchecked Javascript5.4 Mediumapache-airflowPyPIApache Airflow: Missing CSRF protection on DAG/trigger6.5 Mediumapache-airflowPyPIApache Airflow: Permission verification bypass allows viewing dagruns of other dags6.5 Mediumapache-airflowPyPIApache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access)4.3 Mediumapache-airflowPyPIApache Airflow Celery provider, Apache Airflow: Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend7.5 Highapache-airflowPyPIApache Airflow: Sensitive parameters exposed in API when "non-sensitive-only" configuration is set4.3 Mediumapache-airflowPyPIApache Airflow: Bypass permission verification to view task instances of other dags6.5 Mediumapache-airflowPyPIApache Airflow: Improper access control to DAG resources6.5 Mediumapache-airflowPyPIApache Airflow: Configuration information leakage vulnerability4.3 Mediumapache-airflowPyPIApache Airflow: Improper access control vulnerability in the "List dag warnings" feature6.5 Mediumapache-airflowPyPIApache Airflow: Secrets can be unmasked in the "Rendered Template"6.5 Mediumapache-airflowPyPIApache Airflow Dag Runs Broken Access Control Vulnerability4.3 Mediumapache-airflowPyPIApache Airflow SMTP Provider, Apache Airflow IMAP Provider, Apache Airflow: SMTP/IMAP client components allowed MITM due to missing Certificate Validation5.9 Medium- Show moreLoading…