HIGH8.8PyPI
PYSEC-2026-2358· BIT-airflow-2026-49298, CVE-2026-49298Apache Airflow: Execution API JWT leaked via KubernetesExecutor worker command-line args
Modified: 7/13/2026
package
PyPI/apache-airflow-core
pkg:pypi/apache-airflow-core
HIGH7.2PyPI
PYSEC-2026-2359· BIT-airflow-2026-25917, CVE-2026-25917Apache Airflow allows code execution through crafted XCom payloads
Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-2360· BIT-airflow-2026-32228, CVE-2026-32228Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions
Modified: 7/13/2026
MEDIUM5.3PyPI
PYSEC-2026-2361· BIT-airflow-2026-30912, CVE-2026-30912Apache Airflow exposes SQL stack trace despite "api/expose_stack_traces" set to false
Modified: 7/13/2026
LOW3.7PyPI
PYSEC-2026-2362· BIT-airflow-2026-32690, CVE-2026-32690Apache Airflow Exposes Secrets in Variables Saved as JSON Dictionaries
Modified: 7/13/2026
HIGH8.8PyPI
GHSA-5j6p-jrrm-6x94· BIT-airflow-2026-49298, CVE-2026-49298Apache Airflow: Execution API JWT leaked via KubernetesExecutor worker command-line args
Modified: 7/13/2026
HIGH7.2PyPI
GHSA-6ffj-2wg2-w45j· BIT-airflow-2026-25917, CVE-2026-25917Apache Airflow allows code execution through crafted XCom payloads
Modified: 7/13/2026
HIGH7.5PyPI
GHSA-h97w-pm3w-mwmc· BIT-airflow-2026-32228, CVE-2026-32228Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions
Modified: 7/13/2026
MEDIUM5.3PyPI
GHSA-w7cf-2pmc-5m4c· BIT-airflow-2026-30912, CVE-2026-30912Apache Airflow exposes SQL stack trace despite "api/expose_stack_traces" set to false
Modified: 7/13/2026
LOW3.7PyPI
GHSA-w9r4-94fj-xp69· BIT-airflow-2026-32690, CVE-2026-32690Apache Airflow Exposes Secrets in Variables Saved as JSON Dictionaries
Modified: 7/13/2026