Search for packages
| purl | pkg:pypi/apache-airflow@2.8.0rc4 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1azm-hsvr-f3e8
Aliases: CVE-2023-25693 GHSA-j69x-v4wc-3fpf PYSEC-2023-314 |
Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider. This issue affects Apache Airflow Sqoop Provider versions before 3.1.1. |
Affected by 14 other vulnerabilities. |
|
VCID-4u8d-ezsr-sqcz
Aliases: BIT-airflow-2023-50943 CVE-2023-50943 GHSA-c3c6-f2ww-xfr2 PYSEC-2024-13 |
Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enable_xcom_pickling=False" configuration setting resulting in poisoned data after XCom deserialization. This vulnerability is considered low since it requires a DAG author to exploit it. Users are recommended to upgrade to version 2.8.1 or later, which fixes this issue. |
Affected by 15 other vulnerabilities. Affected by 13 other vulnerabilities. |
|
VCID-82p8-yujf-hkdd
Aliases: BIT-airflow-2023-50944 CVE-2023-50944 GHSA-vm5m-qmrx-fw8w PYSEC-2024-14 |
Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue. |
Affected by 15 other vulnerabilities. Affected by 13 other vulnerabilities. |
|
VCID-8m3p-yzr8-yyhj
Aliases: BIT-airflow-2024-41937 CVE-2024-41937 GHSA-w7cp-g8v7-r54m PYSEC-2024-181 |
Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This would require the provider to be installed on the web server and the user to click the provider link. Users should upgrade to 2.10.0 or later, which fixes this vulnerability. |
Affected by 7 other vulnerabilities. |
|
VCID-arbk-dryb-qkda
Aliases: BIT-airflow-2024-26280 CVE-2024-26280 GHSA-6xwf-xvf3-v459 PYSEC-2024-42 |
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by default, they need to be explicitly granted permissions to see the logs. Only admin users have audit log permission by default. Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability |
Affected by 12 other vulnerabilities. |
|
VCID-hpf3-3z3m-6ydt
Aliases: BIT-airflow-2024-25142 CVE-2024-25142 GHSA-9xpj-62mm-24h2 PYSEC-2024-195 |
Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. Airflow did not return "Cache-Control" header for dynamic content, which in case of some browsers could result in potentially storing sensitive data in local cache of the browser. This issue affects Apache Airflow: before 2.9.2. Users are recommended to upgrade to version 2.9.2, which fixes the issue. |
Affected by 9 other vulnerabilities. |
|
VCID-j6uh-kx6m-sydp
Aliases: BIT-airflow-2026-25917 CVE-2026-25917 GHSA-6ffj-2wg2-w45j PYSEC-2026-13 |
Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue. |
Affected by 0 other vulnerabilities. |
|
VCID-kb4a-mm13-63bj
Aliases: BIT-airflow-2024-45784 CVE-2024-45784 GHSA-46c3-5xc5-wwhv PYSEC-2024-182 |
Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG authors to unintentionally or intentionally log sensitive configuration variables. Unauthorized users could access these logs, potentially exposing critical data that could be exploited to compromise the security of the Airflow deployment. In version 2.10.3, secrets are now masked in task logs to prevent sensitive configuration variables from being exposed in the logging output. Users should upgrade to Airflow 2.10.3 or the latest version to eliminate this vulnerability. If you suspect that DAG authors could have logged the secret values to the logs and that your logs are not additionally protected, it is also recommended that you update those secrets. |
Affected by 4 other vulnerabilities. |
|
VCID-mbgq-fq5n-kufh
Aliases: BIT-airflow-2024-39877 CVE-2024-39877 GHSA-g5hv-r743-v8pm PYSEC-2024-190 |
Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability. |
Affected by 7 other vulnerabilities. |
|
VCID-nfbc-tutd-37bw
Aliases: BIT-airflow-2023-50783 CVE-2023-50783 GHSA-5938-79hg-xh3q PYSEC-2023-267 |
Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable. This flaw compromises the integrity of variable management, potentially leading to unauthorized data modification. Users are recommended to upgrade to 2.8.0, which fixes this issue |
Affected by 15 other vulnerabilities. |
|
VCID-rysu-xhvt-yqda
Aliases: BIT-airflow-2023-48291 CVE-2023-48291 GHSA-8f57-wcmg-4jmh PYSEC-2023-265 |
Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn't. This is a missing fix for CVE-2023-42792 in Apache Airflow 2.7.2 Users of Apache Airflow are strongly advised to upgrade to version 2.8.0 or newer to mitigate the risk associated with this vulnerability. |
Affected by 15 other vulnerabilities. |
|
VCID-tpjn-4kru-vucv
Aliases: BIT-airflow-2026-30912 CVE-2026-30912 GHSA-w7cf-2pmc-5m4c PYSEC-2026-18 |
In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue. |
Affected by 0 other vulnerabilities. |
|
VCID-vras-f42j-xqfg
Aliases: BIT-airflow-2025-68675 CVE-2025-68675 GHSA-7c2f-r6gc-h92h PYSEC-2026-10 |
In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result, when such connections are rendered or printed to logs, proxy credentials embedded in these fields could be exposed. Users are recommended to upgrade to 3.1.6 or later for Airflow 3, and 2.11.1 or later for Airflow 2 which fixes this issue |
Affected by 4 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-w8ff-8479-rbfq
Aliases: BIT-airflow-2024-45034 CVE-2024-45034 GHSA-92xg-gmrq-5c3w PYSEC-2024-212 |
Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability. |
Affected by 5 other vulnerabilities. |
|
VCID-xwza-guvs-83a9
Aliases: BIT-airflow-2024-39863 CVE-2024-39863 GHSA-j482-47xf-p25c PYSEC-2024-189 |
Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue. |
Affected by 7 other vulnerabilities. |
|
VCID-yrx8-dtav-83av
Aliases: BIT-airflow-2024-27906 CVE-2024-27906 GHSA-6v6w-h8m6-7mv2 PYSEC-2024-245 |
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI. Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability |
Affected by 12 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||