agentprime: apache-software-foundation-apache-airflowEvery new CVE for apache-software-foundation-apache-airflow.https://agentprime.io/CVE-2026-40913: Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcementhttps://agentprime.io/advisories/CVE-2026-40913/https://agentprime.io/advisories/CVE-2026-40913/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 09 Nov 2026 10:00:01 GMTCVECVE-2026-50204: Apache Airflow: Audit-log secrets masker redacts by key name only, persisting connection and Variable secrets in cleartexthttps://agentprime.io/advisories/CVE-2026-50204/https://agentprime.io/advisories/CVE-2026-50204/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 09 Nov 2026 09:57:52 GMTCVECVE-2026-68982: Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validationhttps://agentprime.io/advisories/CVE-2026-68982/https://agentprime.io/advisories/CVE-2026-68982/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 09 Nov 2026 09:55:00 GMTCVEcriticalCVE-2026-86829: Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluationhttps://agentprime.io/advisories/CVE-2026-86829/https://agentprime.io/advisories/CVE-2026-86829/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 09 Nov 2026 09:52:44 GMTCVECVE-2026-82337: Apache Airflow: DeadlineAlert fields bypass plugin-registration gate for scheduler-side deserializationhttps://agentprime.io/advisories/CVE-2026-82337/https://agentprime.io/advisories/CVE-2026-82337/CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 09 Nov 2026 09:51:35 GMTCVECVE-2026-86468: Apache Airflow: CLI argv masking misses Variable values and --conn-extra, persisting secrets in audit logshttps://agentprime.io/advisories/CVE-2026-86468/https://agentprime.io/advisories/CVE-2026-86468/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 09 Nov 2026 09:49:18 GMTCVECVE-2026-96285: Apache Airflow: Scheduler: next_kwargs deserialized before the dict check, so resume data still invokes constructorshttps://agentprime.io/advisories/CVE-2026-96285/https://agentprime.io/advisories/CVE-2026-96285/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 09 Nov 2026 09:47:22 GMTCVECVE-2026-113508: Apache Airflow: Logout token revocation fails open; errors silently swallowedhttps://agentprime.io/advisories/CVE-2026-113508/https://agentprime.io/advisories/CVE-2026-113508/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 09 Nov 2026 09:46:14 GMTCVECVE-2026-101031: Apache Airflow: Shell command injection in the example_dag_decorator example Dag via an IPv6 zone identifierhttps://agentprime.io/advisories/CVE-2026-101031/https://agentprime.io/advisories/CVE-2026-101031/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 09 Nov 2026 09:44:39 GMTCVEcriticalCVE-2026-113504: Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartexthttps://agentprime.io/advisories/CVE-2026-113504/https://agentprime.io/advisories/CVE-2026-113504/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 09 Nov 2026 09:21:35 GMTCVECVE-2026-107474: Apache Airflow: Connections API: apprise connection "config" extra returned in cleartexthttps://agentprime.io/advisories/CVE-2026-107474/https://agentprime.io/advisories/CVE-2026-107474/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 09 Nov 2026 09:19:48 GMTCVECVE-2026-111395: Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline callbackshttps://agentprime.io/advisories/CVE-2026-111395/https://agentprime.io/advisories/CVE-2026-111395/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 09 Nov 2026 09:18:35 GMTCVECVE-2026-111421: Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow.* classes on the API serverhttps://agentprime.io/advisories/CVE-2026-111421/https://agentprime.io/advisories/CVE-2026-111421/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 09 Nov 2026 09:15:29 GMTCVECVE-2026-111452: Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhookUrl) not matched against the sensitive-field listhttps://agentprime.io/advisories/CVE-2026-111452/https://agentprime.io/advisories/CVE-2026-111452/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 09 Nov 2026 09:12:05 GMTCVECVE-2026-111453: Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag_id query value but deletes rows for every readable Daghttps://agentprime.io/advisories/CVE-2026-111453/https://agentprime.io/advisories/CVE-2026-111453/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 09 Nov 2026 09:10:58 GMTCVECVE-2026-111454: Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot readhttps://agentprime.io/advisories/CVE-2026-111454/https://agentprime.io/advisories/CVE-2026-111454/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 09 Nov 2026 09:07:30 GMTCVECVE-2026-111455: Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commithttps://agentprime.io/advisories/CVE-2026-111455/https://agentprime.io/advisories/CVE-2026-111455/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 09 Nov 2026 09:06:33 GMTCVECVE-2026-75157: Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)https://agentprime.io/advisories/CVE-2026-75157/https://agentprime.io/advisories/CVE-2026-75157/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 07:51:23 GMTCVECVE-2026-30898: Apache Airflow: Bad example of BashOperator shell injection via dag_run.confhttps://agentprime.io/advisories/CVE-2026-30898/https://agentprime.io/advisories/CVE-2026-30898/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 18 Apr 2026 06:20:48 GMTCVE