Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service

Modified: 7/13/2026

MEDIUM4.3PyPI

PYSEC-2026-2351· BIT-airflow-2026-38743, CVE-2026-38743

Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance record

Modified: 7/13/2026

HIGH7.5PyPI

PYSEC-2026-2352· BIT-airflow-2026-31987, CVE-2026-31987

Apache Airflow: JWT token appearing in logs

Modified: 7/13/2026

HIGH8.1PyPI

PYSEC-2026-2353· BIT-airflow-2025-54550, CVE-2025-54550

Apache Airflow: RCE by race condition in example_xcom dag

Modified: 7/13/2026

MEDIUM4.3PyPI

PYSEC-2026-2354· BIT-airflow-2026-46764, CVE-2026-46764

Apache Airflow has an Authorization Bypass Through User-Controlled Key

Modified: 7/13/2026

HIGH8.4PyPI

PYSEC-2026-2355· BIT-airflow-2024-56373, CVE-2024-56373

Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate table

Modified: 7/13/2026

MEDIUM4.3PyPI

PYSEC-2026-2356· BIT-airflow-2026-40690, CVE-2026-40690

Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions

Modified: 7/13/2026

MEDIUM4.8PyPI

PYSEC-2026-2357· CVE-2026-32794, GHSA-wrpj-755p-x363

Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange

Modified: 7/13/2026

CRITICAL9.8PyPI

PYSEC-2026-267· BIT-airflow-2022-38649, CVE-2022-38649

OS Command Injection in Apache Airflow

Modified: 7/1/2026

CRITICAL9.8PyPI

PYSEC-2026-268· BIT-airflow-2023-22884, CVE-2023-22884

Command Injection in Apache Airflow and Apache Airflow MySQL Provider

Modified: 7/1/2026

CRITICAL9.1PyPI

PYSEC-2026-269· BIT-airflow-2025-57735, CVE-2025-57735

Apache Airflow: JWT token still valid after logout

Modified: 7/1/2026

CRITICAL9.8PyPI

PYSEC-2026-270· BIT-airflow-2022-40189, CVE-2022-40189

OS Command Injection in Apache Airflow

Modified: 7/1/2026

MEDIUM4.3PyPI

PYSEC-2026-3705· BIT-airflow-2026-54183, CVE-2026-54183

Modified: 10/15/2026

MEDIUM6.5PyPI

PYSEC-2026-3706· BIT-airflow-2026-59244, CVE-2026-59244

Modified: 10/15/2026

HIGH7.3PyPI

PYSEC-2026-3707· BIT-airflow-2026-67260, CVE-2026-67260

Modified: 10/15/2026

HIGH8.8PyPI

PYSEC-2026-3708· BIT-airflow-2026-67587, CVE-2026-67587

Modified: 10/15/2026

MEDIUM5.4PyPI

PYSEC-2026-3709· BIT-airflow-2026-68076, CVE-2026-68076

Modified: 10/15/2026

HIGH7.5PyPI

PYSEC-2026-3710· BIT-airflow-2026-68968, CVE-2026-68968

Modified: 10/15/2026

MEDIUM6.5PyPI

PYSEC-2026-3711· BIT-airflow-2026-68969, CVE-2026-68969

Modified: 10/15/2026

MEDIUM6.5PyPI

PYSEC-2026-3712· BIT-airflow-2026-68970, CVE-2026-68970

Modified: 10/15/2026

MEDIUM6.5PyPI

PYSEC-2026-3806· BIT-airflow-2026-48828, CVE-2026-48828

Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API

Modified: 9/10/2026

MEDIUM4.3PyPI

PYSEC-2026-3988· BIT-airflow-2026-75158, CVE-2026-75158

Modified: 9/26/2026

MEDIUM4.2PyPI

PYSEC-2026-3989· BIT-airflow-2026-82355, CVE-2026-82355

Modified: 9/26/2026

CRITICAL9.1PyPI

PYSEC-2026-3990· BIT-airflow-2026-86473, CVE-2026-86473

Modified: 9/26/2026

HIGH8.8PyPI

PYSEC-2026-3991· BIT-airflow-2026-58076, CVE-2026-58076

Modified: 10/15/2026

MEDIUM5.4PyPI

PYSEC-2026-3992· BIT-airflow-2026-59242, CVE-2026-59242

Modified: 10/15/2026

MEDIUM6.5PyPI

PYSEC-2026-3993· BIT-airflow-2026-65017, CVE-2026-65017

Modified: 10/15/2026

MEDIUM6.5PyPI

PYSEC-2026-3994· BIT-airflow-2026-68971, CVE-2026-68971

Modified: 10/15/2026

MEDIUM5.5PyPI

PYSEC-2026-770· BIT-airflow-2022-40954, CVE-2022-40954

OS Command Injection in Apache Airflow

Modified: 7/7/2026

HIGH7.5PyPI

PYSEC-2026-8· BIT-airflow-2025-66236, CVE-2025-66236

Modified: 6/10/2026

HIGH7.5PyPI

PYSEC-2026-9· BIT-airflow-2025-68438, CVE-2025-68438

Modified: 6/10/2026

MEDIUM6.1PyPI

GHSA-f9fq-78ch-4wmj· BIT-airflow-2022-43985, CVE-2022-43985

Apache Airflow Open Redirect vulnerability

Modified: 5/2/2025

MEDIUM6.5PyPI

GHSA-22hf-vx2v-gjff· BIT-airflow-2026-49487, CVE-2026-49487

Apache Airflow exposes deferred trigger kwargs in task-instance API responses

Modified: 9/4/2026

MEDIUM4.3PyPI

GHSA-2522-mrjc-m688· BIT-airflow-2024-31869, CVE-2024-31869

Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used

Modified: 7/7/2026

HIGH8.8PyPI

GHSA-269x-pg5c-5xgm· BIT-airflow-2023-39508, CVE-2023-39508

Apache Airflow Execution with Unnecessary Privileges

Modified: 2/13/2025

MEDIUM5.4PyPI

GHSA-273c-4g26-4jpm· BIT-airflow-2025-62402, CVE-2025-62402

Apache Airflow `/api/v2/dagReports` executes DAG Python in API

Modified: 7/7/2026

MEDIUM6.5PyPI

GHSA-2883-wwh7-x57v· BIT-airflow-2026-45192, CVE-2026-45192

Apache Airflow: Incomplete redaction allowlist exposes secrets in Connection `extra` to read-permitted users

Modified: 7/8/2026

CRITICAL9.8PyPI

GHSA-2943-9672-r45w· BIT-airflow-2026-33264, CVE-2026-33264

Apache Airflow allows code execution through unsafe serialized DAG deserialization

Modified: 9/4/2026

MEDIUM6.5PyPI

GHSA-2h84-3crq-vgfj· BIT-airflow-2023-35908, CVE-2023-35908

Apache Airflow Incorrect Authorization vulnerability

Modified: 2/13/2025

HIGH8.8PyPI

GHSA-2qjv-p2gc-mjg2· BIT-airflow-2026-67587, CVE-2026-67587

Apache Airflow Task SDK Callback deserialization can import arbitrary modules in the scheduler

Modified: 10/2/2026

HIGH7.3PyPI

GHSA-2r5m-76wx-56gx· BIT-airflow-2026-45360, CVE-2026-45360

Apache Airflow Vulnerable to Deserialization of Untrusted Data

Modified: 9/10/2026

MEDIUM6.5PyPI

GHSA-32wr-qqw6-5mfp· BIT-airflow-2023-42663, CVE-2023-42663

Apache Airflow vulnerable to sensitive information exposure

Modified: 2/13/2025

MEDIUM4.3PyPI

GHSA-3322-mjxh-9mp5· BIT-airflow-2026-48891, CVE-2026-48891

Apache Airflow exposes unreadable DAG identifiers in the scheduling dependencies graph

Modified: 9/4/2026

MEDIUM6.5PyPI

GHSA-33g2-gx67-c2h3· BIT-airflow-2026-42358, CVE-2026-42358

Apache Airflow Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Modified: 7/13/2026

MEDIUM6.5PyPI

GHSA-3h4m-m55v-gx4m· BIT-airflow-2023-36543, CVE-2023-36543

Apache Airflow Improper Input Validation vulnerability

Modified: 11/24/2024

HIGH8.1PyPI

GHSA-3q8r-f3pj-3gc4· BIT-airflow-2022-41672, CVE-2022-41672

Apache Airflow may allow authenticated users who have been deactivated to continue using the UI or API

Modified: 9/11/2024

HIGH7.5PyPI

GHSA-3qmm-r55x-hpxx· BIT-airflow-2025-68438, CVE-2025-68438

Apache Airflow secrets in rendered templates could contain parts of sensitive values when truncated

Modified: 9/10/2026

HIGH8.8PyPI

GHSA-3v7g-4pg3-7r6j· BIT-airflow-2022-24288, CVE-2022-24288

OS Command injection in Apache Airflow

Modified: 9/12/2024

MEDIUM6.1PyPI

GHSA-3xxv-p78r-4fc6· BIT-airflow-2021-28359, CVE-2021-28359

Cross-site Scripting in Apache Airflow

Modified: 9/12/2024

MEDIUM5.5PyPI

GHSA-45r6-j3cc-6mxx· BIT-airflow-2022-40954, CVE-2022-40954

OS Command Injection in Apache Airflow

Modified: 7/7/2026

MEDIUM6.1PyPI

GHSA-4fg5-j4mm-wfpg· BIT-airflow-2022-40754, CVE-2022-40754

Apache Airflow contains open redirect

Modified: 9/11/2024

MEDIUM6.5PyPI

GHSA-4fh7-7jx4-8f6c· BIT-airflow-2026-49296, CVE-2026-49296

apache-airflow DAG source authorization bypass exposes co-located DAG source

Modified: 8/12/2026

HIGH7.5PyPI

GHSA-4fhm-p86v-hwpx· BIT-airflow-2026-28779, CVE-2026-28779

Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications

Modified: 6/5/2026

MEDIUM6.5PyPI

GHSA-4g48-54q2-fg7q· BIT-airflow-2026-25219, CVE-2026-25219

Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access

Modified: 7/13/2026

MEDIUM5.4PyPI

GHSA-fcmm-42r9-mmmm· BIT-airflow-2026-59242, CVE-2026-59242

Apache Airflow XCom API permits unsafe deserialization through JSON string literals

Modified: 10/2/2026

MEDIUM6.5PyPI

GHSA-4jh2-3c85-q67h· BIT-airflow-2021-45230, CVE-2021-45230

Improper Privilege Management in apache-airflow

Modified: 9/3/2024

HIGH7.5PyPI

GHSA-4m3h-wp5w-5hqh· BIT-airflow-2026-26929, CVE-2026-26929

Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata

Modified: 6/5/2026

MEDIUM6.1PyPI

GHSA-4pwq-fj89-6rjc· BIT-airflow-2020-13944, CVE-2020-13944

Apache Airflow Cross-site Scripting

Modified: 9/11/2024

MEDIUM6.5PyPI

GHSA-5247-m8w9-2v4m· BIT-airflow-2026-68971, CVE-2026-68971

Apache Airflow missing team context permits cross-team Dag actions and XCom reads

Modified: 10/2/2026

MEDIUM5.4PyPI

GHSA-52gm-qmg3-r4qp· BIT-airflow-2024-32077, CVE-2024-32077

Apache Airflow: XSS vulnerability in Task Instance Log/Log Details

Modified: 6/5/2026

MEDIUM6.5PyPI

GHSA-563f-2439-rmq4· BIT-airflow-2026-48828, CVE-2026-48828

Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API

Modified: 9/10/2026

MEDIUM6.5PyPI

GHSA-5938-79hg-xh3q· BIT-airflow-2023-50783, CVE-2023-50783

Apache Airflow Improper Access Control vulnerability

Modified: 11/21/2024

MEDIUM6.5PyPI

GHSA-5946-8p38-vffp· BIT-airflow-2023-22888, CVE-2023-22888

Apache Airflow Improper Input Validation vulnerability

Modified: 11/24/2024

MEDIUM5.9PyPI

GHSA-5f35-pq34-c87q· BIT-airflow-2023-39441, CVE-2023-39441

Apache Airflow missing Certificate Validation

Modified: 7/13/2026

CRITICAL9.8PyPI

GHSA-5ff8-7639-6v6g· BIT-airflow-2022-38054, CVE-2022-38054

Apache Airflow Session Fixation vulnerability

Modified: 9/11/2024

MEDIUM6.5PyPI

GHSA-5g2w-9f8g-g5q7· BIT-airflow-2026-24098, CVE-2026-24098

Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated Users

Modified: 9/10/2026

HIGH7.5PyPI

GHSA-5rp4-749p-vx26· BIT-airflow-2022-40604, CVE-2022-40604

Apache Airflow vulnerable to Use of Externally-Controlled Format String

Modified: 9/11/2024

MEDIUM6.1PyPI

GHSA-65xw-pcqw-hjrh· BIT-airflow-2021-45229, CVE-2021-45229

Apache Airflow Cross-site Scripting Vulnerability

Modified: 9/12/2024

HIGH7.5PyPI

GHSA-666g-rfc5-c9jv· BIT-airflow-2023-46215, CVE-2023-46215

Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerability

Modified: 7/13/2026

HIGH8.8PyPI

GHSA-68wv-rjrm-576p· CVE-2017-17835, PYSEC-2019-148

Cross-Site Request Forgery (CSRF) in Apache Airflow

Modified: 9/11/2024

HIGH7.2PyPI

GHSA-6hcw-qqr8-pjj8· BIT-airflow-2026-40961, CVE-2026-40961

Apache Airflow: Authenticated users can bypass the `is_safe_url` check

Modified: 7/13/2026

MEDIUM6.5PyPI

GHSA-6m9r-7wrx-xmr6· BIT-airflow-2023-49920, CVE-2023-49920

Apache Airflow Cross-Site Request Forgery vulnerability

Modified: 11/21/2024

HIGH8.8PyPI

GHSA-6pw3-8h9w-32gc· BIT-airflow-2022-40127, CVE-2022-40127

Apache Airflow vulnerable to OS Command Injection via example DAGs

Modified: 5/1/2025

MEDIUM5.3PyPI

GHSA-6r3p-fcvm-xh7c· BIT-airflow-2020-17513, CVE-2020-17513

SSRF vulnerability in Apache Airflow

Modified: 9/11/2024

MEDIUM5.1PyPI

GHSA-6v6w-h8m6-7mv2· BIT-airflow-2024-27906, CVE-2024-27906

Apache Airflow: DAG Code and Import Error Permissions Ignored

Modified: 5/6/2025

MEDIUM4.7PyPI

GHSA-6xwf-xvf3-v459· BIT-airflow-2024-26280, CVE-2024-26280

Apache Airflow: Incorrect Default Permissions in audit logs for Ops and Viewers users

Modified: 11/1/2024

MEDIUM5.4PyPI

GHSA-75mg-c62r-v95g· BIT-airflow-2026-68076, CVE-2026-68076

Apache Airflow environment-variable secrets backend permits cross-team credential use

Modified: 10/2/2026

HIGH7.5PyPI

GHSA-77rc-x84q-pv4f· CVE-2018-20245, PYSEC-2019-143

Improper Certificate Validation in Apache Airflow

Modified: 9/4/2024

MEDIUM5.9PyPI

GHSA-799x-qp47-8qwq· BIT-airflow-2026-49267, CVE-2026-49267

Apache Airflow has no certificate validation on SMTP STARTTLS connections

Modified: 7/13/2026

HIGH7.5PyPI

GHSA-7c2f-r6gc-h92h· BIT-airflow-2025-68675, CVE-2025-68675

Apache Airflow proxy credentials for various providers might leak in task logs

Modified: 9/10/2026

HIGH7.7PyPI

GHSA-7mx5-x372-xh87· BIT-airflow-2020-17526, CVE-2020-17526

Incorrect Session Validation in Apache Airflow

Modified: 9/11/2024

CRITICAL9.8PyPI

GHSA-7wqf-h36w-47mc· BIT-airflow-2022-38649, CVE-2022-38649

OS Command Injection in Apache Airflow

Modified: 6/29/2026

MEDIUM6.1PyPI

GHSA-86vp-x3pr-79rx· BIT-airflow-2020-17515, CVE-2020-17515

Apache Airflow cross-site scripting due to incomplete fix for CVE-2020-13944

Modified: 9/11/2024

MEDIUM6.5PyPI

GHSA-89cj-xrpx-j79m· BIT-airflow-2026-40861, CVE-2026-40861

Apache Airflow has a Link Following issue

Modified: 7/9/2026

MEDIUM4.3PyPI

GHSA-8f57-wcmg-4jmh· BIT-airflow-2023-48291, CVE-2023-48291

Apache Airflow vulnerable to Exposure of Resource to Wrong Sphere

Modified: 11/21/2024

HIGH8.8PyPI

GHSA-8fg4-j562-mjrc· CVE-2017-15720, PYSEC-2019-147

Improper Input Validation in Apache Airflow resulting in Remote Code Execution

Modified: 9/9/2024

MEDIUM4.8PyPI

GHSA-8p7v-2jvj-v54r· CVE-2019-0216, PYSEC-2019-214

Apache Airflow vulnerable to Stored XSS

Modified: 9/11/2024

HIGH8.8PyPI

GHSA-8prw-8m6x-8w6f· BIT-airflow-2026-58076, CVE-2026-58076

Apache Airflow exception-node deserialization permits arbitrary callable execution

Modified: 10/2/2026

MEDIUM6.5PyPI

GHSA-8r55-rv5w-6pfm· BIT-airflow-2025-27555, CVE-2025-27555

Apache Airflow exposes sensitive information in its log files

Modified: 9/10/2026

HIGH8.1PyPI

GHSA-8x34-9q3v-h7g8· BIT-airflow-2026-30911, CVE-2026-30911

Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization

Modified: 6/5/2026

HIGH8.8PyPI

GHSA-92xg-gmrq-5c3w· BIT-airflow-2024-45034, CVE-2024-45034

Apache Airflow vulnerable to Execution with Unnecessary Privileges

Modified: 9/10/2026

MEDIUM5.9PyPI

GHSA-95v7-h9j5-gvjr· BIT-airflow-2026-41017, CVE-2026-41017

Apache Airflow has a Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Modified: 7/9/2026

CRITICAL9.8PyPI

GHSA-976r-qfjj-c24w· BIT-airflow-2020-11981, CVE-2020-11981

Command injection via Celery broker in Apache Airflow

Modified: 9/11/2024

MEDIUM6.5PyPI

GHSA-9933-5rrp-mfwx· BIT-airflow-2026-48892, CVE-2026-48892

Apache Airflow exposes secrets backend credentials through the Config API

Modified: 9/4/2026

MEDIUM5.5PyPI

GHSA-99cv-8cvv-666c· CVE-2018-20244, PYSEC-2019-142

Apache Airflow vulnerable to Stored XSS

Modified: 9/10/2024

CRITICAL9.8PyPI

GHSA-9g2w-5f3v-mfmm· BIT-airflow-2020-11982, CVE-2020-11982

Insecure default config of Celery worker in Apache Airflow

Modified: 9/11/2024

CRITICAL9.8PyPI

GHSA-9gqg-3fxr-9hv7· CVE-2017-17836, PYSEC-2019-149

Apache Airflow vulnerable to XSS

Modified: 9/12/2024

MEDIUM4.3PyPI

GHSA-9qqg-mh7c-chfq· BIT-airflow-2023-46288, CVE-2023-46288

Apache Airflow vulnerable to Exposure of Sensitive Information

Modified: 2/13/2025

LOWPyPI

GHSA-9xpj-62mm-24h2· BIT-airflow-2024-25142, CVE-2024-25142

Apache Airflow does not return the "Cache-Control" header for dynamic content

Modified: 9/10/2026

HIGH8.8PyPI

GHSA-c392-whpc-vfpr· BIT-airflow-2024-45498, CVE-2024-45498

Apache Airflow vulnerable to Improper Encoding or Escaping of Output

Modified: 9/10/2026

HIGH7.5PyPI

GHSA-c3c6-f2ww-xfr2· BIT-airflow-2023-50943, CVE-2023-50943

Apache Airflow: pickle deserialization vulnerability in XComs

Modified: 2/13/2025

MEDIUM6.5PyPI

GHSA-c56v-8w4g-3mfm· BIT-airflow-2026-65017, CVE-2026-65017

Apache Airflow Config API exposes team-scoped sensitive configuration values

Modified: 10/2/2026

CRITICAL9.8PyPI

GHSA-c732-xvv8-g94c· BIT-airflow-2023-22884, CVE-2023-22884

Command Injection in Apache Airflow and Apache Airflow MySQL Provider

Modified: 6/29/2026

CRITICAL9.1PyPI

GHSA-c85c-g9wv-pph2· BIT-airflow-2026-42252, CVE-2026-42252

Apache Airflow vulnerable to Improper Neutralization of Special Elements Used in a Template Engine

Modified: 7/9/2026

CRITICAL9.1PyPI

GHSA-c92r-g8j5-vhcx· BIT-airflow-2025-57735, CVE-2025-57735

Apache Airflow: JWT token still valid after logout

Modified: 9/10/2026

MEDIUM5.3PyPI

GHSA-cff3-5qrp-hqx7· BIT-airflow-2024-29735, CVE-2024-29735

Apache Airflow Improper Preservation of Permissions vulnerability

Modified: 7/7/2026

MEDIUM6.5PyPI

GHSA-cg3x-89rc-x9mw· BIT-airflow-2026-42360, CVE-2026-42360

Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Modified: 7/9/2026

MEDIUM6.5PyPI

GHSA-cgx2-rrmr-jx43· BIT-airflow-2023-42780, CVE-2023-42780

Apache Airflow vulnerable to sensitive information exposure when users list warnings for all DAGs

Modified: 9/3/2024

MEDIUM6.5PyPI

GHSA-cjv4-7hp2-2x9h· BIT-airflow-2026-68969, CVE-2026-68969

Apache Airflow bulk endpoints log Variable and Connection secrets in cleartext

Modified: 10/2/2026

LOW2.8PyPI

GHSA-cvcq-gmc3-q6m8· BIT-airflow-2020-17511, CVE-2020-17511

Apache Airflow logs passwords in plaintext

Modified: 9/11/2024

MEDIUM6.5PyPI

GHSA-f3c2-j7g8-vpp8· BIT-airflow-2026-68970, CVE-2026-68970

Apache Airflow Task SDK fails to mask list-shaped JSON Variables

Modified: 10/2/2026

MEDIUM6.5PyPI

GHSA-f643-3rc2-j27w· BIT-airflow-2026-59244, CVE-2026-59244

Apache Airflow exposes dict-valued var.json secrets in Rendered Templates

Modified: 10/2/2026

MEDIUM6.5PyPI

GHSA-ffw3-6mp6-jmvj· BIT-airflow-2021-26559, CVE-2021-26559

Improper Access Control in Apache Airflow

Modified: 11/18/2024

MEDIUM5.3PyPI

GHSA-fh37-cx83-q542· BIT-airflow-2021-26697, CVE-2021-26697

Improper Authentication in Apache Airflow

Modified: 9/12/2024

MEDIUM4.3PyPI

GHSA-fpxx-xv4c-gxqp· BIT-airflow-2023-45348, CVE-2023-45348

Apache Airflow vulnerable to sensitive information exposure when expose-config is set to non-sensitive-only

Modified: 3/7/2024

MEDIUM6.5PyPI

GHSA-fv47-pqh6-wxgq· BIT-airflow-2025-66388, CVE-2025-66388

Apache Airflow exposes secret values to authenticated UI users via rendered templates

Modified: 6/5/2026

HIGH7.5PyPI

GHSA-fvw2-2pf7-77vw· BIT-airflow-2022-27949, CVE-2022-27949

Apache Airflow subject to Exposure of Sensitive Information

Modified: 5/1/2025

MEDIUM4.3PyPI

GHSA-g4qj-5vxv-wggf· BIT-airflow-2026-54183, CVE-2026-54183

Apache Airflow Variables UI fails to mask sensitive values in deeply nested iterables

Modified: 10/2/2026

HIGH8.8PyPI

GHSA-g5hv-r743-v8pm· BIT-airflow-2024-39877, CVE-2024-39877

Apache Airflow has DAG Author Code Execution possibility in airflow-scheduler

Modified: 9/10/2026

MEDIUM6.5PyPI

GHSA-gfw7-2v73-69wg· BIT-airflow-2025-65995, CVE-2025-65995

Apache Airflow error reporting may expose full kwargs

Modified: 9/10/2026

MEDIUM6.5PyPI

GHSA-ggwr-4vr8-g7wv· BIT-airflow-2023-22887, CVE-2023-22887

Apache Airflow Path Traversal vulnerability

Modified: 11/24/2024

MEDIUM4.6PyPI

GHSA-gp5f-cx7h-8q6f· BIT-airflow-2025-62503, CVE-2025-62503

Apache Airflow's create action can upsert existing Pools/Connections/Variables

Modified: 7/7/2026

LOW3.1PyPI

GHSA-gprj-xvq8-w53q· BIT-airflow-2026-40963, CVE-2026-40963

Apache Airflow has an Improper Authorization issue

Modified: 7/13/2026

MEDIUMPyPI

GHSA-h574-6646-vfxx· BIT-airflow-2024-28746, CVE-2024-28746

Apache Airflow: Ignored Airflow Permission

Modified: 12/6/2024

MEDIUM6.1PyPI

GHSA-h63r-9xxf-f2c7· BIT-airflow-2022-43982, CVE-2022-43982

Apache Airflow Cross-site Scripting vulnerability

Modified: 5/2/2025

MEDIUM5.3PyPI

GHSA-h6g5-wqqr-3mw3· BIT-airflow-2023-25695, CVE-2023-25695

Sensitive Information in Error Messages in Apache Airflow

Modified: 2/13/2025

CRITICAL9.8PyPI

GHSA-h88f-r7cw-8fv3· BIT-airflow-2021-38540, CVE-2021-38540

Missing Authentication for Critical Function in Apache Airflow

Modified: 9/11/2024

CRITICAL9.8PyPI

GHSA-hhx9-p69v-cx2j· BIT-airflow-2020-13927, CVE-2020-13927

Authentication bypass in Apache Airflow

Modified: 10/22/2025

MEDIUM4.3PyPI

GHSA-hm9r-7f84-25c9· BIT-airflow-2023-47037, CVE-2023-47037

Apache Airflow allows authenticated and DAG-view authorized users to modify some DAG run detail values when submitting notes

Modified: 2/13/2025

MEDIUM6.1PyPI

GHSA-j38c-25fj-mr84· BIT-airflow-2020-9485, CVE-2020-9485

Stored XSS in Apache Airflow

Modified: 9/11/2024

MEDIUM6.5PyPI

GHSA-j3w8-2p2h-mrr9· BIT-airflow-2023-42792, CVE-2023-42792

Apache Airflow vulnerable to privilege escalation

Modified: 2/13/2025

MEDIUM5.4PyPI

GHSA-j482-47xf-p25c· BIT-airflow-2024-39863, CVE-2024-39863

Apache Airflow Potential Cross-site Scripting Vulnerability

Modified: 9/10/2026

HIGH7.5PyPI

GHSA-j4jc-cq9h-xrhr· BIT-airflow-2026-68968, CVE-2026-68968

Apache Airflow Backfill API parser discrepancy permits cross-DAG authorization bypass

Modified: 10/2/2026

MEDIUM6.5PyPI

GHSA-j857-2pwm-jjmm· BIT-airflow-2024-50378, CVE-2024-50378

Apache Airflow vulnerable to Insertion of Sensitive Information Into Sent Data

Modified: 9/10/2026

MEDIUM5.3PyPI

GHSA-j86x-fwp2-qh7v· BIT-airflow-2025-66236, CVE-2025-66236

Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI

Modified: 9/10/2026

CRITICAL9.8PyPI

GHSA-jchm-fm4q-c2fp· BIT-airflow-2023-25754, CVE-2023-25754

Apache Airflow vulnerable to Privilege Context Switching Error

Modified: 2/13/2025

MEDIUM5.3PyPI

GHSA-m6h2-jx9v-58w6· BIT-airflow-2021-35936, CVE-2021-35936

Missing Authorization in Apache Airflow

Modified: 9/11/2024

HIGH8.8PyPI

GHSA-mc4f-r875-v87w· BIT-airflow-2026-33858, CVE-2026-33858

Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API

Modified: 6/5/2026

MEDIUM6.5PyPI

GHSA-mg2x-mggj-6955· BIT-airflow-2023-51702, CVE-2023-51702

Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service

Modified: 7/13/2026

MEDIUM6.5PyPI

GHSA-mjff-wv85-hmcj· BIT-airflow-2023-35005, CVE-2023-35005

Apache Airflow vulnerable to exposure of sensitive information

Modified: 11/22/2024

MEDIUM6.5PyPI

GHSA-mjqh-v5f2-g2mw· BIT-airflow-2023-40712, CVE-2023-40712

Apache Airflow information exposure vulnerability

Modified: 11/22/2024

HIGH7.5PyPI

GHSA-mxq5-f9c5-w4p5· BIT-airflow-2026-41084, CVE-2026-41084

Apache Airflow Vulnerable to Authorization Bypass Through User-Controlled Key

Modified: 7/9/2026

MEDIUM4.3PyPI

GHSA-p3v3-229h-mc63· BIT-airflow-2026-38743, CVE-2026-38743

Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance record

Modified: 7/13/2026

HIGH7.5PyPI

GHSA-phv5-vq5p-qhp7· BIT-airflow-2026-31987, CVE-2026-31987

Apache Airflow: JWT token appearing in logs

Modified: 7/13/2026

MEDIUM6.5PyPI

GHSA-pm44-x5x7-24c4· BIT-airflow-2026-22922, CVE-2026-22922

Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access

Modified: 9/10/2026

HIGH8.0PyPI

GHSA-pm87-24wq-r8w9· BIT-airflow-2023-40273, CVE-2023-40273

Apache Airflow Session Fixation vulnerability

Modified: 9/11/2024

MEDIUM5.4PyPI

GHSA-pxch-wr7m-rwxj· BIT-airflow-2023-47265, CVE-2023-47265

Apache Airflow has a stored cross-site scripting vulnerability

Modified: 2/13/2025

HIGH8.1PyPI

GHSA-q2hg-643c-gw8h· BIT-airflow-2025-54550, CVE-2025-54550

Apache Airflow: RCE by race condition in example_xcom dag

Modified: 7/13/2026

MEDIUM6.6PyPI

GHSA-q475-2pgm-7hvp· BIT-airflow-2025-54831, CVE-2025-54831

Apache Airflow: Connection sensitive details exposed to users with READ permissions

Modified: 6/5/2026

HIGH7.3PyPI

GHSA-q4c3-7575-55j2· BIT-airflow-2026-67260, CVE-2026-67260

Apache Airflow scheduler unsafely deserializes human-in-the-loop task next_kwargs

Modified: 10/2/2026

MEDIUM5.4PyPI

GHSA-q4p3-qw5c-mhpc· BIT-airflow-2020-11983, CVE-2020-11983

Multiple stored XSS in RBAC Admin screens in Apache Airflow

Modified: 9/11/2024

MEDIUM4.7PyPI

GHSA-q8h9-pqcx-59hw· BIT-airflow-2022-38170, CVE-2022-38170

Apache Airflow exposes arbitrary file content

Modified: 9/11/2024

MEDIUM4.3PyPI

GHSA-qphr-3mvq-v466· BIT-airflow-2026-46764, CVE-2026-46764

Apache Airflow has an Authorization Bypass Through User-Controlled Key

Modified: 7/13/2026

MEDIUM6.5PyPI

GHSA-r7vr-m4jw-r794· BIT-airflow-2026-34538, CVE-2026-34538

Apache Airflow has an authorization bypass in DagRun wait endpoint

Modified: 9/10/2026

MEDIUM6.5PyPI

GHSA-r7x6-xfcm-3mxv· BIT-airflow-2023-42781, CVE-2023-42781

Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Modified: 11/24/2024

HIGH8.4PyPI

GHSA-r837-hpv7-pc2f· BIT-airflow-2024-56373, CVE-2024-56373

Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate table

Modified: 9/10/2026

MEDIUM6.1PyPI

GHSA-rg94-84xj-7gq3· BIT-airflow-2022-45402, CVE-2022-45402

Apache Airflow Contains Open Redirect

Modified: 4/30/2025

MEDIUM4.8PyPI

GHSA-rjvg-q57v-mjjc· CVE-2019-12398, PYSEC-2020-162

XSS in Apache Airflow

Modified: 9/3/2024

CRITICAL9.8PyPI

GHSA-rmf2-pwfq-h75j· BIT-airflow-2022-40189, CVE-2022-40189

OS Command Injection in Apache Airflow

Modified: 6/29/2026

MEDIUM6.1PyPI

GHSA-rv25-9wgj-xg75· CVE-2017-12614, PYSEC-2018-45

Apache Airflow Reflected Cross-site Scripting vulnerability in 404 Endpoint

Modified: 9/10/2024

HIGH8.8PyPI

GHSA-rvmq-4x66-q7j3· BIT-airflow-2020-11978, CVE-2020-11978

Remote code execution (RCE) in Apache Airflow

Modified: 10/22/2025

MEDIUM5.2PyPI

GHSA-v3c9-j6h9-66v4· BIT-airflow-2025-54941, CVE-2025-54941

Apache Airflow has a command injection vulnerability in "example_dag_decorator"

Modified: 7/7/2026

MEDIUM5.4PyPI

GHSA-vcf6-3wv2-5vcr· BIT-airflow-2023-29247, CVE-2023-29247

Apache Airflow vulnerable to stored Cross-site Scripting

Modified: 9/12/2024

MEDIUM6.5PyPI

GHSA-vm5m-qmrx-fw8w· BIT-airflow-2023-50944, CVE-2023-50944

Apache Airflow: Bypass permission verification to read code of other dags

Modified: 2/13/2025

MEDIUM6.5PyPI

GHSA-vr7m-c6v4-8cx8· BIT-airflow-2026-48726, CVE-2026-48726

Apache Airflow: Auth manager doesn't invalidate JWT tokens after users click logout

Modified: 7/8/2026

HIGH8.8PyPI

GHSA-w6j4-3gh2-9f5j· CVE-2019-0229, PYSEC-2019-215

Apache Airflow vulnerable to CSRF Attacks

Modified: 9/12/2024

MEDIUM6.1PyPI

GHSA-w7cp-g8v7-r54m· BIT-airflow-2024-41937, CVE-2024-41937

Apache Airflow Cross-site Scripting Vulnerability

Modified: 9/10/2026

MEDIUM4.3PyPI

GHSA-w7rc-q6cm-f5gm· BIT-airflow-2026-40690, CVE-2026-40690

Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions

Modified: 7/13/2026

LOW3.7PyPI

GHSA-w9r4-94fj-xp69· BIT-airflow-2026-32690, CVE-2026-32690

Apache Airflow Exposes Secrets in Variables Saved as JSON Dictionaries

Modified: 7/13/2026

MEDIUM4.3PyPI

GHSA-wpg8-mf6h-gm92· BIT-airflow-2023-40611, CVE-2023-40611

Apache Airflow Incorrect Authorization vulnerability

Modified: 2/13/2025

HIGH8.8PyPI

GHSA-wr76-29cr-67w8· BIT-airflow-2026-42359, CVE-2026-42359

Apache Airflow has a Deserialization of Untrusted Data vulnerability

Modified: 7/9/2026

MEDIUM4.8PyPI

GHSA-wrpj-755p-x363· CVE-2026-32794, PYSEC-2026-2357

Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange

Modified: 7/13/2026

HIGH8.1PyPI

GHSA-x2mh-8fmc-rqgh· BIT-airflow-2023-37379, CVE-2023-37379

Apache Airflow denial of service vulnerability

Modified: 2/13/2025

MEDIUM4.3PyPI

GHSA-x2x7-p37c-43cr· BIT-airflow-2026-41014, CVE-2026-41014

Apache Airflow has a Missing Authorization issue

Modified: 7/9/2026

MEDIUM4.3PyPI

GHSA-x3fv-96qh-67m7· BIT-airflow-2026-28563, CVE-2026-28563

Apache Airflow: DAG authorization bypass

Modified: 6/5/2026

LOW3.1PyPI

GHSA-x5wm-j6wh-2834· BIT-airflow-2026-45426, CVE-2026-45426

Apache Airflow has an Incorrect Authorization issue

Modified: 7/9/2026

MEDIUM6.5PyPI

GHSA-xvw9-3mhm-xjqq· BIT-airflow-2022-46651, CVE-2022-46651

Apache Airflow information disclosure vulnerability

Modified: 2/13/2025