Apache Airflow CVE-2026-30911

Remote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controll

Unsafe deserialization in Apache Airflow 3.3.0's Task SDK allows an authenticated DAG author to cause arbitrary module i

Unsafe deserialization in Apache Airflow 3.0.0 through 3.3.0 allows any DAG author to achieve arbitrary code execution i

Command injection in Apache Airflow's BashOperator documentation example allows authenticated attackers to escalate priv

We need to produce a JSON object per the instructions. Let's analyze each field. First, product_name: "1-3 words ONLY.

Information disclosure in Apache Airflow 3.0.0 through 3.1.x stems from incomplete secret masking and under-documented w

Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI

CVE-2026-28779 is a security vulnerability (CVSS 7.5) that allows any application co-hosted under the same domain. High

Apache Airflow 3.0.x prior to 3.2.0 allows remote unauthenticated attackers to trigger unauthorized DAG (Directed Acycli

Authorization bypass in Apache Airflow's Backfill API (all versions prior to 3.3.1) allows any authenticated user holdin

Remote code execution and scheduler-process disruption in Apache Airflow 3.3.0 stems from unguarded deserialization of t

Unauthorized source code disclosure in Apache Airflow before 3.3.0 allows authenticated users to read the source of DAGs