Apache Software Foundation Airflow vulnerabilities

• apache software foundation airflow Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcement CVE-2026-40913 No scoreNovember 9, 2026
• apache software foundation airflow Apache Airflow: Audit-log secrets masker redacts by key name only, persisting connection and Variable secrets in cleartext CVE-2026-50204 No scoreNovember 9, 2026
• apache software foundation airflow Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation CVE-2026-68982 No scoreNovember 9, 2026
• apache software foundation airflow task sdk Apache Airflow Task SDK: SecretCache: non-injective team cache key enables cross-team secret disclosure in multi-team mode CVE-2026-76185 No scoreNovember 9, 2026
• apache software foundation airflow Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation CVE-2026-86829 No scoreNovember 9, 2026
• apache software foundation airflow Apache Airflow: DeadlineAlert fields bypass plugin-registration gate for scheduler-side deserialization CVE-2026-82337 No scoreNovember 9, 2026
• apache software foundation airflow Apache Airflow: CLI argv masking misses Variable values and --conn-extra, persisting secrets in audit logs CVE-2026-86468 No scoreNovember 9, 2026
• apache software foundation airflow Apache Airflow: Scheduler: next_kwargs deserialized before the dict check, so resume data still invokes constructors CVE-2026-96285 No scoreNovember 9, 2026
• apache software foundation airflow Apache Airflow: Logout token revocation fails open; errors silently swallowed CVE-2026-113508 No scoreNovember 9, 2026
• apache software foundation airflow Apache Airflow: Shell command injection in the example_dag_decorator example Dag via an IPv6 zone identifier CVE-2026-101031 No scoreNovember 9, 2026
• apache software foundation airflow Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext CVE-2026-113504 No scoreNovember 9, 2026
• apache software foundation airflow Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext CVE-2026-107474 No scoreNovember 9, 2026
• apache software foundation airflow Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline callbacks CVE-2026-111395 No scoreNovember 9, 2026
• apache software foundation airflow Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow.* classes on the API server CVE-2026-111421 8.8 HighNovember 9, 2026
• apache software foundation airflow Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhookUrl) not matched against the sensitive-field list CVE-2026-111452 No scoreNovember 9, 2026
• apache software foundation airflow Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag_id query value but deletes rows for every readable Dag CVE-2026-111453 4.3 MediumNovember 9, 2026
• apache software foundation airflow Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read CVE-2026-111454 No scoreNovember 9, 2026
• apache software foundation airflow Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit CVE-2026-111455 No scoreNovember 9, 2026
• apache software foundation airflow ssh provider Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host CVE-2026-111422 8.8 HighOctober 26, 2026
• apache software foundation airflow amazon provider Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account CVE-2026-86467 8.8 HighOctober 20, 2026
• apache software foundation airflow sftp provider Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default CVE-2026-94135 4.3 MediumOctober 15, 2026
• apache software foundation airflow keycloak provider Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token CVE-2026-96806 5.8 MediumOctober 15, 2026
• apache software foundation airflow sftp provider, airflow ssh provider +1 more Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default CVE-2026-94134 Public exploit 9.1 CriticalOctober 15, 2026
• apache software foundation airflow keycloak provider Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read CVE-2026-92228 6.5 MediumOctober 15, 2026
• apache apache-airflow-providers-teradata, apache software foundation airflow teradata provider +1 more Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag CVE-2026-86843 6.3 MediumSeptember 29, 2026
• apache apache-airflow-providers-snowflake, apache software foundation airflow snowflake provider +1 more Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain CVE-2026-81930 Fix available 6.3 MediumSeptember 29, 2026
• apache apache-airflow-providers-teradata, apache software foundation airflow teradata provider +1 more Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs CVE-2026-81862 6.5 MediumSeptember 29, 2026
• apache apache-airflow-providers-google, apache software foundation airflow google provider +1 more Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names CVE-2026-81914 Fix available 4.3 MediumSeptember 29, 2026
• apache software foundation airflow hashicorp provider Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key CVE-2026-97636 6.5 MediumSeptember 24, 2026
• apache airflow Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry CVE-2026-86473 Fix available 9.1 CriticalSeptember 21, 2026
• apache airflow Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter CVE-2026-75158 Fix available 4.3 MediumSeptember 21, 2026
• apache airflow Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation CVE-2026-82355 Fix available 4.2 MediumSeptember 21, 2026
• apache software foundation airflow Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression) CVE-2026-75157 Public exploitFix available 7.5 HighSeptember 18, 2026
• apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 more Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated CVE-2026-86466 8.1 HighSeptember 16, 2026
• apache apache-airflow-providers-keycloak, apache software foundation airflow keycloak provider +1 more Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT CVE-2026-76187 9.8 CriticalSeptember 16, 2026
• apache apache-airflow-providers-keycloak, apache software foundation airflow keycloak provider +1 more Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity CVE-2026-76186 9.1 CriticalSeptember 16, 2026
• apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 more Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access CVE-2026-82310 7.2 HighSeptember 16, 2026
• apache apache-airflow-providers-apache-kafka, apache software foundation airflow apache kafka provider +1 more Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration CVE-2026-86792 Fix available 8.8 HighSeptember 16, 2026
• apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 more Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions CVE-2026-86462 9.1 CriticalSeptember 16, 2026
• apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 more Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false CVE-2026-82311 9.8 CriticalSeptember 16, 2026
• apache apache-airflow-providers-akeyless, apache software foundation airflow akeyless provider +1 more Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key CVE-2026-86465 6.5 MediumSeptember 16, 2026
• apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 more Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass CVE-2026-75156 9.1 CriticalSeptember 8, 2026
• apache airflow Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI CVE-2026-59244 Fix available 6.5 MediumAugust 12, 2026
• apache airflow Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server CVE-2026-58076 Fix available 8.8 HighAugust 12, 2026
• apache airflow Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint CVE-2026-59242 Fix available 5.4 MediumAugust 12, 2026
• apache airflow Apache Airflow: Airflow Variables were not masked in the UI for authenticated users CVE-2026-54183 Fix available 4.3 MediumAugust 12, 2026
• apache airflow Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization CVE-2026-67260 Fix available 7.3 HighAugust 12, 2026
• apache airflow Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget CVE-2026-67587 Fix available 8.8 HighAugust 12, 2026
• apache airflow Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass) CVE-2026-65017 Fix available 6.5 MediumAugust 12, 2026
• apache airflow Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id CVE-2026-68968 Fix available 7.5 HighAugust 12, 2026
• Show olderLoading…