Skip to contentApache Airflow vulnerabilities
- apache software foundation airflow apache hive provider, apache apache-airflow-providers-apache-hive +1 moreApache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_userCVE-2023-37415Fix available8.8 High
- apache airflowApache Airflow: Scheduler remote DoSCVE-2023-22888Fix available6.5 Medium
- apache airflowApache Airflow: ReDoS via dags functionCVE-2023-36543Fix available6.5 Medium
- apache airflowApache Airflow: Security vulnerability on AirFlow ConnectionsCVE-2022-46651Fix available6.5 Medium
- apache airflowApache Airflow path traversal by authenticated userCVE-2023-22887Fix available6.5 Medium
- apache airflowApache Airflow: Access to DAGs without relevant permissionCVE-2023-35908Fix available6.5 Medium
- apache software foundation airflow apache hive provider, apache apache-airflow-providers-apache-hive +1 moreApache Airflow Hive Provider Beeline RCE with PrincipalCVE-2023-35797Fix available9.8 Critical
- apache software foundation airflow jdbc provider, apache apache-airflow-providers-jdbc +1 moreApache Airflow JDBC Provider: RCE VulnerabilityCVE-2023-22886Fix available8.8 High
- apache software foundation airflow mssql provider, airflow odbc provider, apache apache-airflow-providers-microsoft-mssql +1 more +3 moreAirflow Apache ODBC and MSSQL Providers Arbitrary File Read VulnerabilityCVE-2023-35798Fix available4.3 Medium
- apache software foundation airflow odbc provider, apache apache-airflow-providers-odbc +1 moreApache Airflow ODBC Provider: Remote code execution vulnerabilityCVE-2023-34395Fix available7.8 High
- apache airflowApache Airflow: Information disclosure on configuration viewCVE-2023-35005Fix available6.5 Medium
- apache airflow cncf kubernetes, apache software foundation airflow cncf kubernetes provider, apache apache-airflow-providers-cncf-kubernetes +2 moreApache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configurationCVE-2023-33234Fix available7.2 High
- apache airflowApache Airflow: Privilege escalation using airflow logsCVE-2023-25754Fix available9.8 Critical
- apache airflowStored XSS on Apache AirflowCVE-2023-29247Fix available5.4 Medium
- apache software foundation airflow spark provider, apache apache-airflow-providers-apache-spark +1 moreApache Airflow Spark Provider Arbitrary File Read via JDBCCVE-2023-28710Fix available7.5 High
- apache airflow hive providerApache Airflow Hive Provider Beeline Remote Command ExecutionCVE-2023-28706Fix available9.8 Critical
- apache software foundation airflow drill provider, apache apache-airflow-providers-apache-drill +1 moreAirflow Apache Drill Provider Arbitrary File Read VulnerabilityCVE-2023-28707Fix available7.5 High
- apache airflowInformation disclosure in Apache AirflowCVE-2023-25695Fix available5.3 Medium
- apache software foundation airflow aws provider, apache apache-airflow-providers-amazon +1 moreApache Airflow AWS Provider: Arbitrary file read via AWS providerCVE-2023-25956Fix available7.5 High
- apache software foundation airflow hive provider, apache apache-airflow-providers-apache-hive +1 moreApache Airflow Hive Provider Beeline RCECVE-2023-25696Fix available9.8 Critical
- apache software foundation airflow sqoop provider, apache apache-airflow-providers-apache-sqoop +1 moreSqoop Apache Airflow Provider Remote Code Execution VulnerabilityCVE-2023-25693Fix available9.8 Critical
- apache software foundation airflow google provider, apache apache-airflow-providers-google +1 moreApache Airflow Google Provider: Google Cloud Sql Provider Denial Of ServiceCVE-2023-25692Fix available7.5 High
- apache software foundation airflow google provider, apache apache-airflow-providers-google +1 moreApache Airflow Google Provider: Google Cloud Sql Provider Remote Command ExecutionCVE-2023-25691Fix available9.8 Critical
- apache airflow, apache software foundation airflow mysql provider, apache apache-airflow-providers-mysql +2 moreApache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache AirflowCVE-2023-22884Public exploitFix availableEPSS 11.9%9.8 Critical
- apache software foundation airflow hive provider, apache apache-airflow-providers-apache-hive +1 moreApache Airflow Hive Provider: Hive Provider RCE vulnerability with hive_cli_paramsCVE-2022-46421Fix available9.8 Critical
- apache airflow, apache software foundation airflow hive provider, apache apache-airflow-providers-apache-hive +2 moreApache Airflow Hive Provider vulnerability (command injection via hive_cli connection)CVE-2022-41131Fix available7.8 High
- apache airflow, apache software foundation airflow spark provider, apache apache-airflow-providers-apache-spark +2 moreApache Airflow Spark Provider RCE that bypass restrictions to read arbitrary filesCVE-2022-40954Fix available5.5 Medium
- apache airflow, apache software foundation airlfow pig provider, apache apache-airflow-providers-apache-pig +2 moreApache Airlfow Pig Provider RCECVE-2022-40189Fix available9.8 Critical
- apache airflow, apache software foundation airflow pinot provider, apache apache-airflow-providers-apache-pinot +2 moreApache Airflow Pinot provider allowed Command InjectionCVE-2022-38649Fix available9.8 Critical
- apache airflowApache Airflow: Open redirect during loginCVE-2022-45402Fix availableEPSS 81.1%6.1 Medium
- apache airflowApache Airflow <2.4.0 has an RCE in a bash exampleCVE-2022-40127Public exploitFix availableEPSS 85.7%8.8 High
- apache airflowApache Airflow prior to 2.3.1 may include sensitive values in rendered templateCVE-2022-27949Fix available7.5 High
- apache airflowApache Airflow prior to 2.4.2 has an open redirectCVE-2022-43985Fix available6.1 Medium
- apache airflowApache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URLCVE-2022-43982Fix available6.1 Medium
- apache airflowSession still functional after user is deactivatedCVE-2022-41672Fix available8.1 High
- apache airflowOpen RedirectCVE-2022-40754Fix available6.1 Medium
- apache airflowFormat String VulnerabilityCVE-2022-40604Fix available7.5 High
- apache airflowOverly permissive umask for daemonsCVE-2022-38170Fix available4.7 Medium
- apache airflowSession FixationCVE-2022-38054Fix available9.8 Critical
- apache software foundation airflow, apache apache-airflow-providers-docker +1 moreDocker Provider <3.0 RCE vulnerability in example dagCVE-2022-38362Fix available8.8 High
- apache airflowApache Airflow: RCE in example DAGsCVE-2022-24288Fix availableEPSS 78.4%8.8 High
- apache airflowApache Airflow: Reflected XSS via Origin Query Argument in URLCVE-2021-45229Fix available6.1 Medium
- apache airflowApache Airflow: Creating DagRuns didn't respect Dag-level permissions in the WebserverCVE-2021-45230Fix available6.5 Medium
- apache airflowApache Airflow: Variable Import endpoint missed authentication checkCVE-2021-38540Public exploitFix availableEPSS 80.9%9.8 Critical
- apache airflowNo Authentication on Logging ServerCVE-2021-35936Fix available5.3 Medium
- dpgaspar flask-appbuilder, apache airflow +1 moreObservable Response Discrepancy in Flask-AppBuilderCVE-2021-29621Fix available5.3 Medium
- apache airflowApache Airflow Reflected XSS via Origin Query Argument in URLCVE-2021-28359Fix availableEPSS 14.4%6.1 Medium
- apache airflowApache Airflow: Lineage API endpoint for Experimental API missed authentication checkCVE-2021-26697Fix available5.3 Medium
- apache airflowCWE-284 Improper Access Control on Configurations Endpoint for the Stable APICVE-2021-26559Fix available6.5 Medium
- apache airflowIncorrect Session Validation in Apache AirflowCVE-2020-17526Fix availableEPSS 23.9%7.7 High
- Show moreLoading…