Skip to contentApache Software Foundation Airflow vulnerabilities
- apache airflow, apache software foundation airflow mysql provider, apache apache-airflow-providers-mysql +2 moreApache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache AirflowCVE-2023-22884Public exploitFix availableEPSS 11.9%9.8 Critical
- apache software foundation airflow hive provider, apache apache-airflow-providers-apache-hive +1 moreApache Airflow Hive Provider: Hive Provider RCE vulnerability with hive_cli_paramsCVE-2022-46421Fix available9.8 Critical
- apache airflow, apache software foundation airflow hive provider, apache apache-airflow-providers-apache-hive +2 moreApache Airflow Hive Provider vulnerability (command injection via hive_cli connection)CVE-2022-41131Fix available7.8 High
- apache airflow, apache software foundation airflow spark provider, apache apache-airflow-providers-apache-spark +2 moreApache Airflow Spark Provider RCE that bypass restrictions to read arbitrary filesCVE-2022-40954Fix available5.5 Medium
- apache airflow, apache software foundation airlfow pig provider, apache apache-airflow-providers-apache-pig +2 moreApache Airlfow Pig Provider RCECVE-2022-40189Fix available9.8 Critical
- apache airflow, apache software foundation airflow pinot provider, apache apache-airflow-providers-apache-pinot +2 moreApache Airflow Pinot provider allowed Command InjectionCVE-2022-38649Fix available9.8 Critical
- apache airflowApache Airflow: Open redirect during loginCVE-2022-45402Fix availableEPSS 81.1%6.1 Medium
- apache airflowApache Airflow <2.4.0 has an RCE in a bash exampleCVE-2022-40127Public exploitFix availableEPSS 85.7%8.8 High
- apache airflowApache Airflow prior to 2.3.1 may include sensitive values in rendered templateCVE-2022-27949Fix available7.5 High
- apache airflowApache Airflow prior to 2.4.2 has an open redirectCVE-2022-43985Fix available6.1 Medium
- apache airflowApache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URLCVE-2022-43982Fix available6.1 Medium
- apache airflowSession still functional after user is deactivatedCVE-2022-41672Fix available8.1 High
- apache airflowOpen RedirectCVE-2022-40754Fix available6.1 Medium
- apache airflowFormat String VulnerabilityCVE-2022-40604Fix available7.5 High
- apache airflowOverly permissive umask for daemonsCVE-2022-38170Fix available4.7 Medium
- apache airflowSession FixationCVE-2022-38054Fix available9.8 Critical
- apache software foundation airflow, apache apache-airflow-providers-docker +1 moreDocker Provider <3.0 RCE vulnerability in example dagCVE-2022-38362Fix available8.8 High
- apache airflowApache Airflow: RCE in example DAGsCVE-2022-24288Fix availableEPSS 78.4%8.8 High
- apache airflowApache Airflow: Reflected XSS via Origin Query Argument in URLCVE-2021-45229Fix available6.1 Medium
- apache airflowApache Airflow: Creating DagRuns didn't respect Dag-level permissions in the WebserverCVE-2021-45230Fix available6.5 Medium
- apache airflowApache Airflow: Variable Import endpoint missed authentication checkCVE-2021-38540Public exploitFix availableEPSS 80.9%9.8 Critical
- apache airflowNo Authentication on Logging ServerCVE-2021-35936Fix available5.3 Medium
- apache airflowApache Airflow Reflected XSS via Origin Query Argument in URLCVE-2021-28359Fix availableEPSS 14.4%6.1 Medium
- apache airflowApache Airflow: Lineage API endpoint for Experimental API missed authentication checkCVE-2021-26697Fix available5.3 Medium
- apache airflowCWE-284 Improper Access Control on Configurations Endpoint for the Stable APICVE-2021-26559Fix available6.5 Medium
- apache airflowIncorrect Session Validation in Apache AirflowCVE-2020-17526Fix availableEPSS 23.9%7.7 High
- apache airflowSSRF vulnerability in Apache AirflowCVE-2020-17513Fix available5.3 Medium
- apache airflowApache Airflow logs passwords in plaintextCVE-2020-17511Fix available6.5 Medium
- apache airflowApache Airflow cross-site scripting due to incomplete fix for CVE-2020-13944CVE-2020-17515Fix availableEPSS 16.2%6.1 Medium
- apache airflow, airflow's experimental api +1 moreAuthentication bypass in Apache AirflowCVE-2020-13927In KEVPublic exploitFix availableEPSS 99.8%9.8 Critical
- apache airflowApache Airflow Cross-site ScriptingCVE-2020-13944Fix availableEPSS 25.1%6.1 Medium
- apache airflowStored XSS in Apache AirflowCVE-2020-9485Fix available6.1 Medium
- apache airflowMultiple stored XSS in RBAC Admin screens in Apache AirflowCVE-2020-11983Fix available5.4 Medium
- apache airflowInsecure default config of Celery worker in Apache AirflowCVE-2020-11982Fix available9.8 Critical
- apache airflowCommand injection via Celery broker in Apache AirflowCVE-2020-11981Public exploitFix availableEPSS 36.8%9.8 Critical
- apache airflowRemote code execution (RCE) in Apache AirflowCVE-2020-11978In KEVPublic exploitFix availableEPSS 99.2%8.8 High
- apache airflowApache Airflow vulnerable to XSS and local file disclosureCVE-2019-12417Fix available4.8 Medium
- apache airflowApache Airflow vulnerable to Stored XSSCVE-2019-0216Fix available4.8 Medium
- apache airflowApache Airflow vulnerable to CSRF AttacksCVE-2019-0229Fix available8.8 High
- apache airflowApache Airflow vulnerable to Stored XSSCVE-2018-20244Fix available5.5 Medium
- apache airflowImproper Certificate Validation in Apache AirflowCVE-2018-20245Fix available7.5 High
- apache airflowApache Airflow vulnerable to XSSCVE-2017-17836Fix available9.8 Critical
- apache airflowCross-Site Request Forgery (CSRF) in Apache AirflowCVE-2017-17835Fix available8.8 High
- apache airflowImproper Input Validation in Apache Airflow resulting in Remote Code ExecutionCVE-2017-15720Fix available8.8 High
- apache airflowApache Airflow Reflected Cross-site Scripting vulnerability in 404 EndpointCVE-2017-12614Fix available6.1 Medium