Search for packages
| purl | pkg:pypi/apache-airflow@2.6.2rc2 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-168u-zs7t-pqdf
Aliases: CVE-2023-46215 GHSA-666g-rfc5-c9jv |
Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow. Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend Note: the vulnerability is about the information exposed in the logs not about accessing the logs. This issue affects Apache Airflow Celery provider: from 3.3.0 through 3.4.0; Apache Airflow: from 1.10.0 through 2.6.3. Users are recommended to upgrade Airflow Celery provider to version 3.4.1 and Apache Airlfow to version 2.7.0 which fixes the issue. |
Affected by 43 other vulnerabilities. |
|
VCID-1fke-agqs-bkd1
Aliases: BIT-airflow-2024-41937 CVE-2024-41937 GHSA-w7cp-g8v7-r54m PYSEC-2024-181 |
Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This would require the provider to be installed on the web server and the user to click the provider link. Users should upgrade to 2.10.0 or later, which fixes this vulnerability. |
Affected by 21 other vulnerabilities. |
|
VCID-2r7f-dzef-dfcs
Aliases: BIT-airflow-2023-47037 CVE-2023-47037 GHSA-hm9r-7f84-25c9 PYSEC-2023-232 |
We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then. Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to version 2.7.3 or later which has removed the vulnerability. |
Affected by 33 other vulnerabilities. |
|
VCID-2urm-nyak-63ew
Aliases: BIT-airflow-2023-37379 CVE-2023-37379 GHSA-x2mh-8fmc-rqgh PYSEC-2023-152 |
Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connection feature by sending many requests, leading to a denial of service (DoS) condition on the server. Furthermore, malicious actors can leverage this vulnerability to establish harmful connections with the server. Users of Apache Airflow are strongly advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability. Additionally, administrators are encouraged to review and adjust user permissions to restrict access to sensitive functionalities, reducing the attack surface. |
Affected by 43 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-2w8y-kxer-s7e2
Aliases: BIT-airflow-2023-50944 CVE-2023-50944 GHSA-vm5m-qmrx-fw8w PYSEC-2024-14 |
Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue. |
Affected by 30 other vulnerabilities. Affected by 28 other vulnerabilities. |
|
VCID-4e1s-kjwm-4ffg
Aliases: CVE-2024-50378 GHSA-j857-2pwm-jjmm |
Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive variables were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow database. While this risk is limited to users with audit log access, it is recommended to upgrade to Airflow 2.10.3 or a later version, which addresses this issue. Users who previously used the CLI to set secret variables should manually delete entries with those variables from the log table. |
Affected by 17 other vulnerabilities. |
|
VCID-4n4v-jv1f-1bgk
Aliases: CVE-2025-54550 GHSA-q2hg-643c-gw8h |
The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary execution of code on the worker. Since the UI users are already highly trusted, this is a Low severity vulnerability. It does not affect Airflow release - example_dags are not supposed to be enabled in production environment, however users following the example could replicate the bad pattern. Documentation of Airflow 3.2.0 contains version of the example with improved resiliance for that case. Users who followed that pattern are advised to adjust their implementations accordingly. |
Affected by 13 other vulnerabilities. |
|
VCID-5jy7-w294-kuf8
Aliases: BIT-airflow-2023-35005 CVE-2023-35005 GHSA-mjff-wv85-hmcj PYSEC-2023-89 |
In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all uncensored values are actually sentitive. This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are recommended to update to version 2.6.2 or later. |
Affected by 48 other vulnerabilities. |
|
VCID-619t-7b16-vbax
Aliases: BIT-airflow-2024-39877 CVE-2024-39877 GHSA-g5hv-r743-v8pm PYSEC-2024-190 |
Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability. |
Affected by 21 other vulnerabilities. |
|
VCID-668v-1v1b-9bf2
Aliases: BIT-airflow-2024-25142 CVE-2024-25142 GHSA-9xpj-62mm-24h2 PYSEC-2024-195 |
Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. Airflow did not return "Cache-Control" header for dynamic content, which in case of some browsers could result in potentially storing sensitive data in local cache of the browser. This issue affects Apache Airflow: before 2.9.2. Users are recommended to upgrade to version 2.9.2, which fixes the issue. |
Affected by 23 other vulnerabilities. |
|
VCID-6smg-qne8-hfgj
Aliases: BIT-airflow-2023-48291 CVE-2023-48291 GHSA-8f57-wcmg-4jmh PYSEC-2023-265 |
Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn't. This is a missing fix for CVE-2023-42792 in Apache Airflow 2.7.2 Users of Apache Airflow are strongly advised to upgrade to version 2.8.0 or newer to mitigate the risk associated with this vulnerability. |
Affected by 30 other vulnerabilities. |
|
VCID-6ywu-aujt-dfbz
Aliases: BIT-airflow-2023-40273 CVE-2023-40273 GHSA-pm87-24wq-r8w9 PYSEC-2023-158 |
The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database (for database session backend), or changing the secure_key and restarting the webserver, there were no mechanisms to force-logout the user (and all other users with that). With this fix implemented, when using the database session backend, the existing sessions of the user are invalidated when the password of the user is reset. When using the securecookie session backend, the sessions are NOT invalidated and still require changing the secure key and restarting the webserver (and logging out all other users), but the user resetting the password is informed about it with a flash message warning displayed in the UI. Documentation is also updated explaining this behaviour. Users of Apache Airflow are advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability. |
Affected by 43 other vulnerabilities. Affected by 42 other vulnerabilities. |
|
VCID-881f-vbac-rucw
Aliases: CVE-2025-65995 GHSA-gfw7-2v73-69wg |
When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG. The issue has been fixed in Airflow 3.1.4 and 2.11.1, and users are strongly advised to upgrade to prevent potential disclosure of sensitive information. |
Affected by 13 other vulnerabilities. Affected by 28 other vulnerabilities. |
|
VCID-8aa5-hyy9-e3f1
Aliases: BIT-airflow-2026-48726 CVE-2026-48726 PYSEC-2026-187 |
A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for `FabAuthManager` and `KeycloakAuthManager` did not actually reach the underlying `revoke_token()` call, so the JWT remained accepted by the API server until its natural expiry. An attacker holding a previously-issued JWT for a logged-out user could continue to make authenticated API calls as that user. Affects deployments configured with `FabAuthManager` or `KeycloakAuthManager` (the bug does not affect SimpleAuthManager). This is a residual gap in the fix for CVE-2025-57735, which addressed cookie-side invalidation in PR #57992 / PR #61339 but did not cover the provider-side `revoke_token()` reachability in the FAB / Keycloak code paths. Users who already upgraded for CVE-2025-57735 should additionally upgrade to `apache-airflow` 3.2.2 or later to cover the FAB / Keycloak logout paths. |
Affected by 0 other vulnerabilities. |
|
VCID-8gmn-hbp1-4kbt
Aliases: BIT-airflow-2023-35908 CVE-2023-35908 GHSA-2h84-3crq-vgfj PYSEC-2023-119 |
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL. It is recommended to upgrade to a version that is not affected |
Affected by 43 other vulnerabilities. |
|
VCID-8htr-n7ys-1bbw
Aliases: BIT-airflow-2023-46288 CVE-2023-46288 GHSA-9qqg-mh7c-chfq PYSEC-2023-218 |
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.4.0 to 2.7.0. Sensitive configuration information has been exposed to authenticated users with the ability to read configuration via Airflow REST API for configuration even when the expose_config option is set to non-sensitive-only. The expose_config option is False by default. It is recommended to upgrade to a version that is not affected if you set expose_config to non-sensitive-only configuration. This is a different error than CVE-2023-45348 which allows authenticated user to retrieve individual configuration values in 2.7.* by specially crafting their request (solved in 2.7.2). Users are recommended to upgrade to version 2.7.2, which fixes the issue and additionally fixes CVE-2023-45348. |
Affected by 43 other vulnerabilities. Affected by 35 other vulnerabilities. |
|
VCID-8ze1-k1e3-huhc
Aliases: CVE-2024-56373 GHSA-r837-hpv7-pc2f |
DAG Author (who already has quite a lot of permissions) could manipulate database of Airflow 2 in the way to execute arbitrary code in the web-server context, which they should normally not be able to do, leading to potentially remote code execution in the context of web-server (server-side) as a result of a user viewing historical task information. The functionality responsible for that (log template history) has been disabled by default in 2.11.1 and users should upgrade to Airflow 3 if they want to continue to use log template history. They can also manually modify historical log file names if they want to see historical logs that were generated before the last log template change. |
Affected by 13 other vulnerabilities. |
|
VCID-9y7c-yxq4-f7ha
Aliases: BIT-airflow-2026-42360 CVE-2026-42360 PYSEC-2026-172 |
A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g. nested `password` / `token` / `secret` / `api_key` keys inside a JSON template structure) to be bypassed when the rendered field exceeded `[core] max_templated_field_length`: Airflow stringified the structure before redaction, losing the nested key context, and persisted the plaintext value into `rendered_fields`. An authenticated UI/API user with permission to read rendered template fields could harvest secret values intended to be masked. Affects deployments where Dag authors pass structured JSON to operators with nested sensitive keys. This is a variant of `CWE-200` previously addressed for the user-registered `mask_secret()` patterns in CVE-2025-68438; that fix did not cover the nested sensitive-keyword allowlist. Users who already upgraded for CVE-2025-68438 should additionally upgrade to `apache-airflow` 3.2.2 or later to cover the nested-key path. |
Affected by 0 other vulnerabilities. |
|
VCID-bjtj-v297-cbd7
Aliases: BIT-airflow-2024-45784 CVE-2024-45784 GHSA-46c3-5xc5-wwhv PYSEC-2024-182 |
Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG authors to unintentionally or intentionally log sensitive configuration variables. Unauthorized users could access these logs, potentially exposing critical data that could be exploited to compromise the security of the Airflow deployment. In version 2.10.3, secrets are now masked in task logs to prevent sensitive configuration variables from being exposed in the logging output. Users should upgrade to Airflow 2.10.3 or the latest version to eliminate this vulnerability. If you suspect that DAG authors could have logged the secret values to the logs and that your logs are not additionally protected, it is also recommended that you update those secrets. |
Affected by 17 other vulnerabilities. |
|
VCID-bw9q-wjgg-vqgs
Aliases: CVE-2023-39441 GHSA-5f35-pq34-c87q |
Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL Certificate vulnerability. The default SSL context with SSL library did not check a server's X.509 certificate. Instead, the code accepted any certificate, which could result in the disclosure of mail server credentials or mail contents when the client connects to an attacker in a MITM position. Users are strongly advised to upgrade to Apache Airflow version 2.7.0 or newer, Apache Airflow IMAP Provider version 3.3.0 or newer, and Apache Airflow SMTP Provider version 1.3.0 or newer to mitigate the risk associated with this vulnerability |
Affected by 43 other vulnerabilities. |
|
VCID-bwh8-43re-a3b8
Aliases: BIT-airflow-2024-39863 CVE-2024-39863 GHSA-j482-47xf-p25c PYSEC-2024-189 |
Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue. |
Affected by 21 other vulnerabilities. |
|
VCID-cevw-hkjm-mkc2
Aliases: BIT-airflow-2023-47265 CVE-2023-47265 GHSA-pxch-wr7m-rwxj PYSEC-2023-264 |
Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG. This Javascript can be executed on the client side of any of the user who looks at the tasks in the browser sandbox. While this issue does not allow to exit the browser sandbox or manipulation of the server-side data - more than the DAG author already has, it allows to modify what the user looking at the DAG details sees in the browser - which opens up all kinds of possibilities of misleading other users. Users of Apache Airflow are recommended to upgrade to version 2.8.0 or newer to mitigate the risk associated with this vulnerability |
Affected by 32 other vulnerabilities. |
|
VCID-d6m3-rkux-pfaw
Aliases: BIT-airflow-2023-42792 CVE-2023-42792 GHSA-j3w8-2p2h-mrr9 PYSEC-2023-203 |
Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn't. Users of Apache Airflow are strongly advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability. |
Affected by 35 other vulnerabilities. |
|
VCID-es5x-ee29-6ue8
Aliases: CVE-2026-38743 GHSA-p3v3-229h-mc63 |
The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance records: a logged-in Airflow user with read access to at least one DAG could retrieve HITL prompts (including their request parameters) and full TaskInstance details for DAGs outside their authorized scope. Because HITL prompts and TaskInstance fields routinely carry operator parameters and free-form context attached to a task, the leak widens visibility of DAG-run data beyond the intended per-DAG RBAC boundary for every authenticated user. Users are recommended to upgrade to version 3.2.1 , which fixes this issue. |
Affected by 11 other vulnerabilities. |
|
VCID-etdd-wf1g-5yc6
Aliases: BIT-airflow-2024-45034 CVE-2024-45034 GHSA-92xg-gmrq-5c3w PYSEC-2024-212 |
Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability. |
Affected by 19 other vulnerabilities. |
|
VCID-f5rh-fhtd-wyau
Aliases: BIT-airflow-2026-40861 CVE-2026-40861 PYSEC-2026-181 |
A Dag author could either (a) create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process (read-path attack — e.g. `/etc/passwd` or `airflow.cfg`) or (b) supply a `task_id` containing `..` sequences accepted by the Task SDK's `KEY_REGEX` (write-path attack), and in both cases the FileTaskHandler resolves the log path outside the configured `base_log_folder`, leaking or overwriting arbitrary files. Only affects deployments where the worker log folder is shared with the API server. Users are advised to upgrade to `apache-airflow` 3.2.2 or later. As a defense-in-depth mitigation, deploy the worker and API server with separate log volumes so that worker-controlled paths cannot reach the API server's filesystem. |
Affected by 0 other vulnerabilities. |
|
VCID-g4qz-drbp-gqdp
Aliases: BIT-airflow-2023-50943 CVE-2023-50943 GHSA-c3c6-f2ww-xfr2 PYSEC-2024-13 |
Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enable_xcom_pickling=False" configuration setting resulting in poisoned data after XCom deserialization. This vulnerability is considered low since it requires a DAG author to exploit it. Users are recommended to upgrade to version 2.8.1 or later, which fixes this issue. |
Affected by 30 other vulnerabilities. Affected by 28 other vulnerabilities. |
|
VCID-g4y4-92yj-r3ct
Aliases: BIT-airflow-2023-36543 CVE-2023-36543 GHSA-3h4m-m55v-gx4m PYSEC-2023-106 |
Apache Airflow, versions before 2.6.3, has a vulnerability where an authenticated user can use crafted input to make the current request hang. It is recommended to upgrade to a version that is not affected |
Affected by 43 other vulnerabilities. |
|
VCID-gbn8-8y8d-gkgw
Aliases: BIT-airflow-2026-24098 CVE-2026-24098 GHSA-5g2w-9f8g-g5q7 PYSEC-2026-12 |
Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. Users are advised to upgrade to 3.1.7 or later, which resolves this issue |
Affected by 23 other vulnerabilities. |
|
VCID-h4r7-k7z1-6kgg
Aliases: BIT-airflow-2026-45360 CVE-2026-45360 PYSEC-2026-186 |
Apache Airflow's scheduler-side deadline-reference decoder (`SerializedCustomReference.deserialize_reference`) imported and dispatched arbitrary class paths drawn from DAG-author-controlled serialized state without an allowlist or plugin-registry gate. A DAG author whose code reaches the scheduler — the default on single-host deployments where the DAG bundle is importable from the scheduler process — could embed a custom `DeadlineReference` whose serialized form named an attacker-controlled module path, causing the scheduler to `import_string(...)` and instantiate that class with a live SQLAlchemy session attached. Affects deployments where DAG-author code is less trusted than the scheduler process. Users are advised to upgrade to `apache-airflow` 3.2.2 or later. |
Affected by 0 other vulnerabilities. |
|
VCID-he37-337a-r7ex
Aliases: BIT-airflow-2023-42663 CVE-2023-42663 GHSA-32wr-qqw6-5mfp PYSEC-2023-197 |
Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability. |
Affected by 35 other vulnerabilities. |
|
VCID-k32s-e7tk-gfe7
Aliases: BIT-airflow-2023-42781 CVE-2023-42781 GHSA-r7x6-xfcm-3mxv PYSEC-2023-231 |
Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. This is a different issue than CVE-2023-42663 but leading to similar outcome. Users of Apache Airflow are advised to upgrade to version 2.7.3 or newer to mitigate the risk associated with this vulnerability. |
Affected by 33 other vulnerabilities. |
|
VCID-kgwq-4rwr-dybt
Aliases: BIT-airflow-2023-22887 CVE-2023-22887 GHSA-ggwr-4vr8-g7wv PYSEC-2023-104 |
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended directory structure by manipulating the run_id parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected |
Affected by 43 other vulnerabilities. |
|
VCID-kjra-gghm-sqg2
Aliases: CVE-2025-27555 GHSA-8r55-rv5w-6pfm |
Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive connection parameters were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow database. While this risk is limited to users with audit log access, it is recommended to upgrade to Airflow 2.11.1 or a later version, which addresses this issue. Users who previously used the CLI to set connections should manually delete entries with those connection sensitive values from the log table. This is similar but not the same issue as CVE-2024-50378 |
Affected by 13 other vulnerabilities. |
|
VCID-nz83-fzzb-5ucs
Aliases: CVE-2026-25219 GHSA-4g48-54q2-fg7q |
The `access_key` and `connection_string` connection properties were not marked as sensitive names in secrets masker. This means that user with read permission could see the values in Connection UI, as well as when Connection was accidentaly logged to logs, those values could be seen in the logs. Azure Service Bus used those properties to store sensitive values. Possibly other providers could be also affected if they used the same fields to store sensitive data. If you used Azure Service Bus connection with those values set or if you have other connections with those values storing sensitve values, you should upgrade Airflow to 3.1.8 |
Affected by 19 other vulnerabilities. |
|
VCID-r2bq-ukcr-1fa3
Aliases: BIT-airflow-2025-68675 CVE-2025-68675 GHSA-7c2f-r6gc-h92h PYSEC-2026-10 |
In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result, when such connections are rendered or printed to logs, proxy credentials embedded in these fields could be exposed. Users are recommended to upgrade to 3.1.6 or later for Airflow 3, and 2.11.1 or later for Airflow 2 which fixes this issue |
Affected by 13 other vulnerabilities. Affected by 25 other vulnerabilities. |
|
VCID-rnpn-qfdf-87aq
Aliases: BIT-airflow-2024-26280 CVE-2024-26280 GHSA-6xwf-xvf3-v459 PYSEC-2024-42 |
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by default, they need to be explicitly granted permissions to see the logs. Only admin users have audit log permission by default. Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability |
Affected by 27 other vulnerabilities. |
|
VCID-sxa8-9f89-bfdv
Aliases: BIT-airflow-2024-27906 CVE-2024-27906 GHSA-6v6w-h8m6-7mv2 PYSEC-2024-245 |
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI. Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability |
Affected by 27 other vulnerabilities. |
|
VCID-tbn8-rdjn-nban
Aliases: CVE-2026-40690 GHSA-w7rc-q6cm-f5gm |
The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment and learn the existence and names of DAGs and assets outside their authorized scope. Users are recommended to upgrade to version 3.2.1, which fixes this issue. |
Affected by 11 other vulnerabilities. |
|
VCID-tg1w-9bcx-6fg3
Aliases: BIT-airflow-2023-40712 CVE-2023-40712 GHSA-mjqh-v5f2-g2mw PYSEC-2023-171 |
Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly advised to upgrade to version 2.7.1 or later which has removed the vulnerability. |
Affected by 40 other vulnerabilities. |
|
VCID-ttb5-juj4-uugt
Aliases: BIT-airflow-2026-30912 CVE-2026-30912 GHSA-w7cf-2pmc-5m4c PYSEC-2026-18 |
In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue. |
Affected by 13 other vulnerabilities. |
|
VCID-u42p-urfu-83hn
Aliases: BIT-airflow-2022-46651 CVE-2022-46651 GHSA-xvw9-3mhm-xjqq PYSEC-2023-103 |
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability. |
Affected by 43 other vulnerabilities. |
|
VCID-u7j1-ha9q-xkdd
Aliases: BIT-airflow-2023-22888 CVE-2023-22888 GHSA-5946-8p38-vffp PYSEC-2023-105 |
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to cause a service disruption by manipulating the run_id parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected |
Affected by 43 other vulnerabilities. |
|
VCID-utkw-km71-efgd
Aliases: BIT-airflow-2023-42780 CVE-2023-42780 GHSA-cgx2-rrmr-jx43 PYSEC-2023-202 |
Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAGs. It would reveal the dag_ids and the stack-traces of import errors for those DAGs with import errors. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability. |
Affected by 35 other vulnerabilities. |
|
VCID-vnaq-tba8-ykag
Aliases: BIT-airflow-2026-25917 CVE-2026-25917 GHSA-6ffj-2wg2-w45j PYSEC-2026-13 |
Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue. |
Affected by 13 other vulnerabilities. |
|
VCID-vxqr-wyq5-6yge
Aliases: BIT-airflow-2026-45192 CVE-2026-45192 PYSEC-2026-173 |
A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allowed an authenticated UI/API user with Connection-read permission to retrieve secrets stored in a Connection's `extra` JSON blob under field names not present in the redaction allowlist (`DEFAULT_SENSITIVE_FIELDS`) — for example, official Slack-provider credential field names were returned in plaintext. Affects deployments that store credentials in Connection `extra` blobs and grant Connection-read access to multiple users. Users are advised to upgrade to `apache-airflow` 3.2.2 or later. As a defense-in-depth mitigation, deployment operators can store sensitive credential values in a secret-backend rather than inlined into the Connection's `extra` field. |
Affected by 0 other vulnerabilities. |
|
VCID-vymx-nqhb-pfht
Aliases: BIT-airflow-2023-40611 CVE-2023-40611 GHSA-wpg8-mf6h-gm92 PYSEC-2023-170 |
Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to version 2.7.1 or later which has removed the vulnerability. |
Affected by 40 other vulnerabilities. |
|
VCID-z7rt-fxe3-3udw
Aliases: CVE-2023-25693 GHSA-j69x-v4wc-3fpf PYSEC-2023-314 |
Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider. This issue affects Apache Airflow Sqoop Provider versions before 3.1.1. |
Affected by 29 other vulnerabilities. |
|
VCID-z9pc-46h3-pff1
Aliases: BIT-airflow-2023-50783 CVE-2023-50783 GHSA-5938-79hg-xh3q PYSEC-2023-267 |
Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable. This flaw compromises the integrity of variable management, potentially leading to unauthorized data modification. Users are recommended to upgrade to 2.8.0, which fixes this issue |
Affected by 30 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||