| CVE-2026-41014 |
The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization
|
Not rated
|
Jun 1, 2026 |
| CVE-2026-49267 |
Apache Airflow's EmailOperator and the underlying `airflow.utils.email` helpers established SMTP STARTTLS connections…
|
Not rated
|
Jun 1, 2026 |
| CVE-2026-41017 |
Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure` flag, so deployments running the…
|
Not rated
|
Jun 1, 2026 |
| CVE-2026-41084 |
A bug in Apache Airflow's bulk Task Instances API (`PATCH/DELETE…
|
Not rated
|
Jun 1, 2026 |
| CVE-2026-42252 |
Apache Airflow's official documentation at `core-concepts/dag-run.html` ("Passing Parameters when triggering Dags")…
|
Not rated
|
Jun 1, 2026 |
| CVE-2026-42360 |
A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g
|
Not rated
|
Jun 1, 2026 |
| CVE-2026-42358 |
A bug in Apache Airflow's Variable response masker caused nested-key redaction (triggered by secret-suffixed key names…
|
Not rated
|
Jun 1, 2026 |
| CVE-2026-42359 |
A bug in Apache Airflow's XCom PATCH endpoint `PATCH /api/v2/xcomEntries/{key}` allowed an authenticated UI/API user…
|
Not rated
|
Jun 1, 2026 |
| CVE-2026-45360 |
Apache Airflow's scheduler-side deadline-reference decoder (`SerializedCustomReference.deserialize_reference`)…
|
Not rated
|
Jun 1, 2026 |
| CVE-2026-45426 |
Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued…
|
Not rated
|
Jun 1, 2026 |
| CVE-2026-46764 |
The Event Log detail endpoint `GET /api/v2/eventLogs/{event_log_id}` in Apache Airflow fetched audit-log rows directly…
|
Not rated
|
Jun 1, 2026 |
| CVE-2026-48726 |
A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked…
|
Not rated
|
Jun 1, 2026 |
| CVE-2026-49298 |
A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate against the Execution…
|
Not rated
|
Jun 1, 2026 |
| CVE-2026-45192 |
A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allowed an authenticated…
|
Not rated
|
Jun 1, 2026 |
| CVE-2026-38743 |
The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and…
|
Not rated
|
Apr 24, 2026 |
| CVE-2026-40690 |
The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at…
|
Not rated
|
Apr 24, 2026 |
| CVE-2026-40948 |
The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0…
|
Not rated
|
Apr 18, 2026 |
| CVE-2026-32690 |
Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by…
|
Not rated
|
Apr 18, 2026 |
| CVE-2026-30898 |
An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could…
|
Not rated
|
Apr 18, 2026 |
| CVE-2026-30912 |
In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to…
|
Not rated
|
Apr 18, 2026 |
| CVE-2026-25917 |
Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing…
|
Not rated
|
Apr 18, 2026 |
| CVE-2026-32228 |
UI / API User with asset materialize permission could trigger dags they had no access to
|
Not rated
|
Apr 18, 2026 |
| CVE-2026-31987 |
JWT Tokens used by tasks were exposed in logs
|
Not rated
|
Apr 16, 2026 |
| CVE-2026-25219 |
The `access_key` and `connection_string` connection properties were not marked as sensitive names in secrets masker
|
Not rated
|
Apr 15, 2026 |
| CVE-2025-54550 |
The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value from…
|
Not rated
|
Apr 15, 2026 |