Skip to contentApache Software Foundation Airflow vulnerabilities
- apache airflow mongo provider, apache-airflow-providers-mongo +1 moreApache Airflow Mongo Provider: Certificate validation isn't respected even if SSL is enabled for apache-airflow-providers-mongoCVE-2024-25141Fix available9.1 Critical
- apache airflowApache Airflow: Bypass permission verification to read code of other dagsCVE-2023-50944Fix available6.5 Medium
- apache airflowApache Airflow: Potential pickle deserialization vulnerability in XComsCVE-2023-50943Fix available7.5 High
- apache airflow, apache software foundation airflow cncf kubernetes provider, apache apache-airflow-providers-cncf-kubernetes +2 moreApache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer serviceCVE-2023-51702Fix available6.5 Medium
- apache airflowApache Airflow: Improper access control to DAG resourcesCVE-2023-48291Fix available4.3 Medium
- apache airflowApache Airflow: Improper access control vulnerability on the "varimport" endpointCVE-2023-50783Fix available6.5 Medium
- apache airflowApache Airflow: DAG Params alllow to embed unchecked JavascriptCVE-2023-47265Fix available5.4 Medium
- apache airflowApache Airflow: Missing CSRF protection on DAG/triggerCVE-2023-49920Fix available6.5 Medium
- apache airflowApache Airflow: Permission verification bypass allows viewing dagruns of other dagsCVE-2023-42781Fix available6.5 Medium
- apache airflowApache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access)CVE-2023-47037Fix available4.3 Medium
- apache airflow, airflow celery provider +1 moreApache Airflow Celery provider, Apache Airflow: Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backendCVE-2023-46215Fix available7.5 High
- apache airflowApache Airflow: Sensitive parameters exposed in API when "non-sensitive-only" configuration is setCVE-2023-46288Fix available4.3 Medium
- apache airflowApache Airflow: Bypass permission verification to view task instances of other dagsCVE-2023-42663Fix available6.5 Medium
- apache airflowApache Airflow: Improper access control to DAG resourcesCVE-2023-42792Fix available6.5 Medium
- apache airflowApache Airflow: Configuration information leakage vulnerabilityCVE-2023-45348Fix available4.3 Medium
- apache airflowApache Airflow: Improper access control vulnerability in the "List dag warnings" featureCVE-2023-42780Fix available6.5 Medium
- apache airflow hdfs providerApache HDFS Provider error message suggested installation of incorrect pip packageCVE-2023-41267Fix available7.8 High
- apache airflowApache Airflow: Secrets can be unmasked in the "Rendered Template"CVE-2023-40712Fix available6.5 Medium
- apache airflowApache Airflow Dag Runs Broken Access Control VulnerabilityCVE-2023-40611Fix available4.3 Medium
- apache airflow spark providerApache Airflow Spark Provider Deserialization Vulnerability RCECVE-2023-40195Fix available8.8 High
- apache airflow sqoop providerApache Airflow Sqoop Provider: Airflow Sqoop Provider RCE VulnerabilityCVE-2023-27604Fix available8.8 High
- apache airflow, apache software foundation airflow imap provider, airflow smtp provider +2 more +4 moreApache Airflow SMTP Provider, Apache Airflow IMAP Provider, Apache Airflow: SMTP/IMAP client components allowed MITM due to missing Certificate ValidationCVE-2023-39441Fix available5.9 Medium
- apache airflowApache Airflow: Exposure of sensitive connection information, DOS and SSRF on "test connection" featureCVE-2023-37379Fix available8.1 High
- apache airflowSession fixation in Apache Airflow web interfaceCVE-2023-40273Fix available8.0 High
- apache software foundation airflow spark provider, apache apache-airflow-providers-apache-drill, apache-airflow-providers-apache-spark +2 moreApache Airflow Spark Provider Arbitrary File Read via JDBCCVE-2023-40272Fix available7.5 High
- apache software foundation airflow drill provider, apache apache-airflow-providers-apache-drill +1 moreApache Airflow Drill Provider Arbitrary File Read VulnerabilityCVE-2023-39553Fix available7.5 High
- apache airflowApache Airflow: Airflow "Run task" feature allows execution with unnecessary priviledgesCVE-2023-39508Fix available8.8 High
- apache software foundation airflow apache hive provider, apache apache-airflow-providers-apache-hive +1 moreApache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_userCVE-2023-37415Fix available8.8 High
- apache airflowApache Airflow: Scheduler remote DoSCVE-2023-22888Fix available6.5 Medium
- apache airflowApache Airflow: ReDoS via dags functionCVE-2023-36543Fix available6.5 Medium
- apache airflowApache Airflow: Security vulnerability on AirFlow ConnectionsCVE-2022-46651Fix available6.5 Medium
- apache airflowApache Airflow path traversal by authenticated userCVE-2023-22887Fix available6.5 Medium
- apache airflowApache Airflow: Access to DAGs without relevant permissionCVE-2023-35908Fix available6.5 Medium
- apache software foundation airflow apache hive provider, apache apache-airflow-providers-apache-hive +1 moreApache Airflow Hive Provider Beeline RCE with PrincipalCVE-2023-35797Fix available9.8 Critical
- apache software foundation airflow jdbc provider, apache apache-airflow-providers-jdbc +1 moreApache Airflow JDBC Provider: RCE VulnerabilityCVE-2023-22886Fix available8.8 High
- apache software foundation airflow mssql provider, airflow odbc provider, apache apache-airflow-providers-microsoft-mssql +1 more +3 moreAirflow Apache ODBC and MSSQL Providers Arbitrary File Read VulnerabilityCVE-2023-35798Fix available4.3 Medium
- apache software foundation airflow odbc provider, apache apache-airflow-providers-odbc +1 moreApache Airflow ODBC Provider: Remote code execution vulnerabilityCVE-2023-34395Fix available7.8 High
- apache airflowApache Airflow: Information disclosure on configuration viewCVE-2023-35005Fix available6.5 Medium
- apache airflow cncf kubernetes, apache software foundation airflow cncf kubernetes provider, apache apache-airflow-providers-cncf-kubernetes +2 moreApache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configurationCVE-2023-33234Fix available7.2 High
- apache airflowApache Airflow: Privilege escalation using airflow logsCVE-2023-25754Fix available9.8 Critical
- apache airflowStored XSS on Apache AirflowCVE-2023-29247Fix available5.4 Medium
- apache software foundation airflow spark provider, apache apache-airflow-providers-apache-spark +1 moreApache Airflow Spark Provider Arbitrary File Read via JDBCCVE-2023-28710Fix available7.5 High
- apache airflow hive providerApache Airflow Hive Provider Beeline Remote Command ExecutionCVE-2023-28706Fix available9.8 Critical
- apache software foundation airflow drill provider, apache apache-airflow-providers-apache-drill +1 moreAirflow Apache Drill Provider Arbitrary File Read VulnerabilityCVE-2023-28707Fix available7.5 High
- apache airflowInformation disclosure in Apache AirflowCVE-2023-25695Fix available5.3 Medium
- apache software foundation airflow aws provider, apache apache-airflow-providers-amazon +1 moreApache Airflow AWS Provider: Arbitrary file read via AWS providerCVE-2023-25956Fix available7.5 High
- apache software foundation airflow hive provider, apache apache-airflow-providers-apache-hive +1 moreApache Airflow Hive Provider Beeline RCECVE-2023-25696Fix available9.8 Critical
- apache software foundation airflow sqoop provider, apache apache-airflow-providers-apache-sqoop +1 moreSqoop Apache Airflow Provider Remote Code Execution VulnerabilityCVE-2023-25693Fix available9.8 Critical
- apache software foundation airflow google provider, apache apache-airflow-providers-google +1 moreApache Airflow Google Provider: Google Cloud Sql Provider Denial Of ServiceCVE-2023-25692Fix available7.5 High
- apache software foundation airflow google provider, apache apache-airflow-providers-google +1 moreApache Airflow Google Provider: Google Cloud Sql Provider Remote Command ExecutionCVE-2023-25691Fix available9.8 Critical
- Show moreLoading…