Advisories · Technology
Apache Software Foundation Apache Airflow.
Every CVE that names Apache Software Foundation Apache Airflow among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.2 High
Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcement
- Apache Software Foundation Apache Airflow
- Broken access control
- CVSS 6.5 Medium
Apache Airflow: Audit-log secrets masker redacts by key name only, persisting connection and Variable secrets in cleartext
- Apache Software Foundation Apache Airflow
- Information disclosure
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation
- Apache Software Foundation Apache Airflow
- Authentication bypass
- CVSS 8.8 High
Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation
- Apache Software Foundation Apache Airflow
- Insecure deserialization
- CVSS 7.3 High
Apache Airflow: DeadlineAlert fields bypass plugin-registration gate for scheduler-side deserialization
- Apache Software Foundation Apache Airflow
- Insecure deserialization
- CVSS 6.5 Medium
Apache Airflow: CLI argv masking misses Variable values and --conn-extra, persisting secrets in audit logs
- Apache Software Foundation Apache Airflow
- Information disclosure
- CVSS 8.8 High
Apache Airflow: Scheduler: next_kwargs deserialized before the dict check, so resume data still invokes constructors
- Apache Software Foundation Apache Airflow
- Insecure deserialization
- CVSS 7.5 High
Apache Airflow: Logout token revocation fails open; errors silently swallowed
- Apache Software Foundation Apache Airflow
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+
Apache Airflow: Shell command injection in the example_dag_decorator example Dag via an IPv6 zone identifier
- Apache Software Foundation Apache Airflow
- Command injection
- CVSS 6.5 Medium
Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext
- Apache Software Foundation Apache Airflow
- Information disclosure
- CVSS 6.5 Medium
Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext
- Apache Software Foundation Apache Airflow
- Hard-coded credentials
- CVSS 8.2 High
Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline callbacks
- Apache Software Foundation Apache Airflow
- Insecure deserialization
- CVSS 8.8 High
Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow.* classes on the API server
- Apache Software Foundation Apache Airflow
- Insecure deserialization
- CVSS 6.5 Medium
Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhookUrl) not matched against the sensitive-field list
- Apache Software Foundation Apache Airflow
- Hard-coded credentials
- CVSS 4.3 Medium
Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag_id query value but deletes rows for every readable Dag
- Apache Software Foundation Apache Airflow
- Broken access control
- CVSS 6.5 Medium
Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read
- Apache Software Foundation Apache Airflow
- Information disclosure
- CVSS 6.5 Medium
Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit
- Apache Software Foundation Apache Airflow
- Broken access control
- CVSS 7.5 High
Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)
- Apache Software Foundation Apache Airflow
- Broken access control
- CVSS 8.8 High
Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf
- Apache Software Foundation Apache Airflow
- Command injection