Skip to contentApache Airflow vulnerabilities
- apache airflowApache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in APICVE-2025-62402Fix available5.4 Medium
- apache airflowApache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)CVE-2025-62503Fix available4.6 Medium
- apache airflowApache Airflow: Connection sensitive details exposed to users with READ permissionsCVE-2025-54831Fix available6.5 Medium
- apache software foundation airflow providers snowflake, apache apache-airflow-providers-snowflake +1 moreApache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperatorCVE-2025-50213Fix available9.8 Critical
- apache airflow common sql providerApache Airflow Common SQL Provider: Remote Code Execution via Sql InjectionCVE-2025-30473Fix available8.8 High
- apache software foundation airflow mysql provider, apache apache-airflow-providers-mysql +1 moreApache Airflow MySQL Provider: SQL injection in MySQL provider core functionCVE-2025-27018Fix available6.3 Medium
- apache software foundation airflow fab provider, apache apache-airflow-providers-fab +1 moreApache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cliCVE-2024-45033Fix available8.1 High
- apache airflowApache Airflow: Sensitive configuration values are not masked in the logs by defaultCVE-2024-45784Fix available7.5 High
- apache airflowApache Airflow: Secrets not masked in UI when sensitive variables are set via Airflow cliCVE-2024-50378Fix available4.9 Medium
- apache airflowApache Airflow: Authenticated DAG authors could execute code on scheduler nodesCVE-2024-45034Fix available8.8 High
- apache airflowApache Airflow: Command Injection in an example DAGCVE-2024-45498Fix available8.8 High
- apache airflowApache Airflow: Stored XSS Vulnerability on provider linkCVE-2024-41937Fix available6.1 Medium
- apache software foundation airflow providers fab, apache apache-airflow-providers-fab +1 moreApache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for AirflowCVE-2024-42447Fix available9.8 Critical
- apache airflowApache Airflow: DAG Author Code Execution possibility in airflow-schedulerCVE-2024-39877Fix available8.8 High
- apache airflowApache Airflow: Potential XSS VulnerabilityCVE-2024-39863Fix available5.4 Medium
- apache airflowApache Airflow: Cache Control - Storage of Sensitive Data in Browser CacheCVE-2024-25142Fix available5.5 Medium
- apache airflowApache Airflow: XSS vulnerability in Task Instance Log/Log DetailsCVE-2024-32077Fix available5.4 Medium
- apache airflow, apache software foundation airflow ftp provider, apache apache-airflow-providers-ftp +2 moreApache Airflow FTP Provider: FTP_TLS instance with unverified SSL contextCVE-2024-29733Fix available2.7 Low
- apache airflowApache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config usedCVE-2024-31869Fix available4.3 Medium
- apache airflowApache Airflow: Potentially harmful permission changing by log task handlerCVE-2024-29735Fix available5.3 Medium
- apache airflowApache Airflow: Ignored Airflow PermissionsCVE-2024-28746Fix available8.1 High
- apache airflowApache Airflow: Overly broad default permissions for Viewer/Ops (audit logs)CVE-2024-26280Fix available4.7 Medium
- apache airflowApache Airflow: Dag Code and Import Error Permissions IgnoredCVE-2024-27906Fix available5.9 Medium
- apache airflow mongo provider, apache-airflow-providers-mongo +1 moreApache Airflow Mongo Provider: Certificate validation isn't respected even if SSL is enabled for apache-airflow-providers-mongoCVE-2024-25141Fix available9.1 Critical
- apache airflowApache Airflow: Bypass permission verification to read code of other dagsCVE-2023-50944Fix available6.5 Medium
- apache airflowApache Airflow: Potential pickle deserialization vulnerability in XComsCVE-2023-50943Fix available7.5 High
- apache airflow, apache software foundation airflow cncf kubernetes provider, apache apache-airflow-providers-cncf-kubernetes +2 moreApache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer serviceCVE-2023-51702Fix available6.5 Medium
- apache airflowApache Airflow: Improper access control to DAG resourcesCVE-2023-48291Fix available4.3 Medium
- apache airflowApache Airflow: Improper access control vulnerability on the "varimport" endpointCVE-2023-50783Fix available6.5 Medium
- apache airflowApache Airflow: DAG Params alllow to embed unchecked JavascriptCVE-2023-47265Fix available5.4 Medium
- apache airflowApache Airflow: Missing CSRF protection on DAG/triggerCVE-2023-49920Fix available6.5 Medium
- apache airflowApache Airflow: Permission verification bypass allows viewing dagruns of other dagsCVE-2023-42781Fix available6.5 Medium
- apache airflowApache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access)CVE-2023-47037Fix available4.3 Medium
- apache airflow, airflow celery provider +1 moreApache Airflow Celery provider, Apache Airflow: Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backendCVE-2023-46215Fix available7.5 High
- apache airflowApache Airflow: Sensitive parameters exposed in API when "non-sensitive-only" configuration is setCVE-2023-46288Fix available4.3 Medium
- apache airflowApache Airflow: Bypass permission verification to view task instances of other dagsCVE-2023-42663Fix available6.5 Medium
- apache airflowApache Airflow: Improper access control to DAG resourcesCVE-2023-42792Fix available6.5 Medium
- apache airflowApache Airflow: Configuration information leakage vulnerabilityCVE-2023-45348Fix available4.3 Medium
- apache airflowApache Airflow: Improper access control vulnerability in the "List dag warnings" featureCVE-2023-42780Fix available6.5 Medium
- apache airflow hdfs providerApache HDFS Provider error message suggested installation of incorrect pip packageCVE-2023-41267Fix available7.8 High
- apache airflowApache Airflow: Secrets can be unmasked in the "Rendered Template"CVE-2023-40712Fix available6.5 Medium
- apache airflowApache Airflow Dag Runs Broken Access Control VulnerabilityCVE-2023-40611Fix available4.3 Medium
- apache airflow spark providerApache Airflow Spark Provider Deserialization Vulnerability RCECVE-2023-40195Fix available8.8 High
- apache airflow sqoop providerApache Airflow Sqoop Provider: Airflow Sqoop Provider RCE VulnerabilityCVE-2023-27604Fix available8.8 High
- apache airflow, apache software foundation airflow imap provider, airflow smtp provider +2 more +4 moreApache Airflow SMTP Provider, Apache Airflow IMAP Provider, Apache Airflow: SMTP/IMAP client components allowed MITM due to missing Certificate ValidationCVE-2023-39441Fix available5.9 Medium
- apache airflowApache Airflow: Exposure of sensitive connection information, DOS and SSRF on "test connection" featureCVE-2023-37379Fix available8.1 High
- apache airflowSession fixation in Apache Airflow web interfaceCVE-2023-40273Fix available8.0 High
- apache software foundation airflow spark provider, apache apache-airflow-providers-apache-drill, apache-airflow-providers-apache-spark +2 moreApache Airflow Spark Provider Arbitrary File Read via JDBCCVE-2023-40272Fix available7.5 High
- apache software foundation airflow drill provider, apache apache-airflow-providers-apache-drill +1 moreApache Airflow Drill Provider Arbitrary File Read VulnerabilityCVE-2023-39553Fix available7.5 High
- apache airflowApache Airflow: Airflow "Run task" feature allows execution with unnecessary priviledgesCVE-2023-39508Fix available8.8 High
- Show moreLoading…