Airflow
Monthly
Arbitrary code execution in the control plane of Apache Airflow deployments using the Apache Kafka provider 1.15.0 up to but not including 2.0.0: an authenticated user who can edit Airflow connections (PR:L) can plant a dotted-path string in a Kafka connection's extra field that the provider resolves into a Python callable via import_string without any allowlist, and confluent-kafka then invokes it inside the scheduler process. Exploitation is conditional and the limiting factors are substantial: the Kafka event producer must be explicitly enabled through dag_run_events_enabled or task_instance_events_enabled (both disabled by default), and the broker must be a plain Kafka cluster or Amazon MSK, since Google Managed Kafka overwrites the user-supplied oauth_cb and is unaffected. This breaks the Airflow security model because connection-configuration users are only supposed to reach code execution on workers, not the scheduler, and EPSS is low at 0.45% (38th percentile) with no public exploit identified at time of analysis; the assessed vector uses AC:H to reflect the required preconditions.
Authentication bypass in the Apache Airflow FAB provider (apache-airflow-providers-fab before 3.9.0) allows an attacker who holds an OIDC id_token that the same Authentik identity provider minted for a different client application to log into Airflow as the named user, because the Authentik OAuth path in the FAB auth manager never validates the token's issuer or audience claims. Only deployments using the FAB auth manager with Authentik OAuth are affected, and only where that same Authentik instance also serves at least one other application, so the attacker must already possess a valid token from that other application (the assessed vector is AV:N/AC:H/PR:L/UI:N, reflecting these gated prerequisites). Risk is high on confidentiality and integrity for exposed deployments, but the exploit path is narrow; no public exploit has been identified at time of analysis and EPSS is low at 0.14% (4th percentile), so this is a strongly gated authentication-bypass issue rather than a broad remote-takeover vector.
Insufficient session expiration in apache-airflow-providers-fab 2.4.2 through 3.9.0 means an attacker who already holds a copy of a victim's valid session cookie retains authenticated access to Apache Airflow even after an administrator (or the user) performs a password reset as a containment step. The flaw affects only deployments using the FAB auth manager with `[fab] session_backend=database`, where the reset routine compares the string identifier Flask-Login stores in server-side session records against the user's integer database ID, so the comparison never matches and no session is actually deleted; this is a persistence/containment-bypass issue rather than a standalone break-in, since the attacker must have obtained the cookie through some prior compromise. There is no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), but the vendor's CVSS of 9.8 conflicts with the assessed vector (AV:N/AC:H/PR:N/UI:N), which reflects the substantial preconditions - a non-default session backend plus a pre-existing cookie theft. A single upgrade to apache-airflow-providers-fab 3.9.0 or later also closes CVE-2026-86462, a second independent route to the same outcome via the Admin user-edit endpoint.
Stolen database-backed session cookies keep working after a password change in Apache Airflow deployments that use the FAB auth manager (apache-airflow-providers-fab 3.2.0 through 3.9.0), so an attacker already holding a copy of a victim's session cookie is never evicted and retains full access as that user. The flaw is CWE-613 (insufficient session expiration): the Admin user-edit PATCH endpoint applies the new password but never calls the session-invalidation helper, and the trigger is a routine password change performed by an administrator or the user themselves - no interaction by the attacker is required. The vendor scores this 9.1, while our independent assessment is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, because exploitation depends entirely on a prior, separate session-cookie theft and on the non-default database-backed session configuration, making this a post-compromise persistence/containment failure rather than an initial access vector. EPSS is low at 0.19% (9th percentile); no public exploit code and no CISA KEV entry were identified at time of analysis, and a vendor-released patch exists in version 3.9.0.
Deactivating a user account in Apache Airflow 3 deployments that run the FAB auth manager with Core API token authentication fails to revoke tokens already issued to that account, so the disabled user can keep replaying an unexpired token - and use it to mint a replacement - after an administrator has turned the account off. The credential is the account's own legitimate token, so there is no signature forgery and no privilege escalation: access stays bounded to the roles the account already held, but the administrative containment action silently fails and the account keeps role-scoped API access until the token finally expires. No public exploit code identified at time of analysis; EPSS is low at 0.25% (16th percentile); a vendor fix is available in apache-airflow-providers-fab 3.9.0.
Authentication bypass in the Apache Airflow Keycloak auth manager provider (apache-airflow-providers-keycloak below 0.10.0) lets a remote attacker exchange credentials belonging to any confidential client in a shared Keycloak realm for a signed Airflow session token, even though those credentials have nothing to do with Airflow. The unauthenticated POST /auth/token client_credentials grant performed no allowlist check on client_id, so an unrelated application's service-account secret became a valid Airflow login; the resulting access is limited to whatever that service account is authorized for per subject, plus endpoints gated only on being authenticated. Exploitation requires a non-default topology - a Keycloak auth manager deployment whose realm is shared with at least one other confidential client - and the attacker must already hold valid credentials for one of those clients; no public exploit code has been identified at time of analysis, EPSS is low (0.19%, 9th percentile), and a vendor patch is available in provider version 0.10.0.
Privilege escalation in the Apache Airflow Keycloak auth manager (apache-airflow-providers-keycloak) affecting Airflow 3.3 and later lets an authenticated user who already holds a valid Airflow session pair it with another subject's Keycloak access or refresh token - obtained out of band via cookie theft, proxy capture or a leaked token - so Airflow authorizes their requests with the foreign token's privileges while the audit log, cache keys and session identity continue to name the attacker's own account. The official CVSS of 9.1 overstates practical risk: exploitation requires both a valid Airflow login and a genuine (not forged) Keycloak token belonging to someone else, and the opt-in Keycloak auth manager is not Airflow's default authentication backend, so the independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N rather than AV:N/AC:L/PR:N. There is no public exploit code and no confirmed active exploitation (EPSS 0.21%, 11th percentile); upgrading the provider to 0.10.0 or later restores the subject binding between session and Keycloak tokens.
Server-side template injection in Apache Airflow versions 3.0.0 through 3.2.1 allows low-privilege authenticated users to inject Jinja2 expressions via dag_run.conf parameters that are unsafely interpolated into BashOperator commands, leading to arbitrary command execution in the worker context. The flaw carries a 9.1 CVSS but EPSS sits at just 0.03% (9th percentile), and there is no public exploit identified at time of analysis despite a vendor patch being available. Disclosure occurred via the oss-security mailing list on 2026-05-31 alongside several other Airflow advisories.
Sensitive information disclosure in Apache Airflow versions prior to 3.2.2 exposes JWT authentication tokens via KubernetesExecutor command-line arguments, allowing low-privileged users with process listing access on worker pods to harvest credentials and impersonate workers against the Execution API. The flaw, addressed in PR #60108 alongside a redesign of workload/execution token lifetimes, carries a CVSS 8.8 due to high impact across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis and EPSS sits at 0.02%, suggesting limited mass-exploitation activity.
Open redirect bypass in Apache Airflow 3.0.0 through 3.2.1 allows remote unauthenticated attackers to craft URLs that evade the `is_safe_url` host check by using triple-slash (`///`), backslash, or URL-encoded backslash prefixes, redirecting victims to attacker-controlled domains. The flaw stems from a parsing inconsistency between WHATWG URL semantics and Python's urllib. No public exploit has been identified at time of analysis, and EPSS rates exploitation probability at only 0.01% (4th percentile).
Arbitrary Python module import in Apache Airflow versions prior to 3.2.2 occurs when the scheduler deserializes custom DeadlineReference objects, because the prior implementation called import_string() directly on an attacker-controllable __class_path field. Rated CVSS 7.3 with low confidentiality/integrity/availability impact, this issue has no public exploit identified at time of analysis and EPSS estimates exploitation probability at 0.02% (6th percentile).
API authorization bypass in Apache Airflow 3.2.0 through versions before 3.2.2 allows authenticated users with access to one DAG to mutate TaskInstances belonging to other DAGs they should not control, via the bulk TaskInstances PUT/DELETE endpoints. The flaw stems from the bulk handler omitting per-DAG authorization checks, enabling cross-DAG state tampering with high integrity impact (CVSS 7.5, vector AV:N/AC:L/PR:N/UI:N/I:H). No public exploit identified at time of analysis and EPSS probability is low at 0.01%.
Authenticated remote code execution in Apache Airflow 3.2.0 through 3.2.1 allows users with permission to update XCom entries to achieve code execution by submitting reserved deserialization metadata keys (e.g. __classname__, __type, __data__, __var) to the PATCH XCom endpoint. The XComUpdateBody datamodel omitted the FORBIDDEN_XCOM_KEYS validator that XComCreateBody enforced, letting attackers smuggle a malicious typed payload that is later deserialized into an arbitrary Python class. No public exploit identified at time of analysis and EPSS risk is negligible (0.02%), but a vendor fix has shipped and the root cause is a classic CWE-502 untrusted deserialization.
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was found in Apache Airflow versions 1.10.10 and below. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
JWT session cookies in Apache Airflow's JWTRefreshMiddleware are set without the Secure flag when Airflow runs behind an HTTPS-terminating reverse proxy, exposing them to network interception. Affected versions span Apache Airflow 3.0.0 through 3.2.1 (exclusive), where the middleware checked only for a local ssl_cert configuration setting to determine cookie security - missing the common deployment pattern where TLS is offloaded at a load balancer or proxy layer. An unauthenticated network adversary positioned for man-in-the-middle interception could capture a user's JWT refresh cookie and take over their authenticated session. No public exploit code or CISA KEV listing exists at time of analysis; EPSS of 0.01% reflects low automated exploitation likelihood.
Arbitrary file read in Apache Airflow's FileTaskHandler allows authenticated users to read files outside the designated log directory by placing symlinks within the log folder tree. Versions prior to 3.2.2 are affected. Because FileTaskHandler._read_from_local() resolved glob matches without first verifying that a symlink's real path stays within the configured base log folder, a low-privileged Airflow user could exfiltrate sensitive server-side files - credentials, keys, or configuration - by directing log reads through a crafted symlink. No public exploit code exists and the vulnerability is not in CISA KEV, though the CVSS C:H rating reflects genuine confidentiality risk.
Cross-DAG log file disclosure in Apache Airflow’s log server allows authenticated users to bypass JWT authorization using a Python lstrip() character-stripping flaw. Affected versions 3.0.0 through 3.2.1 can be exploited to read unauthorized log files from other DAGs. A proof-of-concept exists, but exploitation likelihood is extremely low (EPSS 0.01%) and the impact is limited to low confidentiality.
DAG authorization bypass in Apache Airflow 3.0.0-3.2.1 allows authenticated low-privileged users to enumerate DAG structure and cross-DAG dependency topology for DAGs they are not authorized to view, by querying the `/ui/structure/structure_data` endpoint without proper RBAC enforcement. The endpoint returned external dependency nodes and edges without applying the `ReadableDagsFilterDep` authorization filter, crossing per-DAG RBAC boundaries. No public exploit exists and EPSS is 0.01% (4th percentile); impact is confined to confidentiality of workflow topology in multi-tenant or fine-grained RBAC deployments.
The event log detail endpoint in Apache Airflow before 3.2.2 applies a generic DAG-level audit log permission check rather than scoping authorization to the specific DAG that owns the requested event log entry, allowing any authenticated low-privilege user to read audit log entries belonging to DAGs outside their permitted scope. The flaw is a broken object-level authorization (IDOR) pattern - classified as CWE-639 - where the user-supplied `event_log_id` path parameter can reference log rows from unauthorized DAGs without triggering a rejection. No public exploit code exists and the issue is not listed in CISA KEV, but the attack is trivially executable by any authenticated Airflow user in a multi-tenant deployment.
The SecretsMasker component in Apache Airflow prior to 3.2.2 returns cleartext sensitive values when those values are stored under recognized sensitive key names (password, token, secret, api_key) nested deeper than five dict levels in structured payloads. Authenticated low-privilege users can craft dag_run.conf or XCom payloads exceeding this depth threshold, causing secrets to surface in task logs, rendered templates, and API responses. No public exploit code exists and EPSS is 0.02% at the 5th percentile - this is not confirmed actively exploited (not in CISA KEV) - but the CVSS confidentiality impact is rated High given that the bypass can expose real credentials to any user who can review logs.
Missing certificate validation during SMTP STARTTLS negotiation in Apache Airflow 2.0.0 through 3.2.1 exposes email traffic to man-in-the-middle interception. Both the core email utility (airflow.utils.email.send_email) and the SMTP provider hook (SmtpHook.get_conn, SmtpHook.aget_conn) called starttls() without an SSL context, causing Python's smtplib to accept any server certificate unconditionally. An unauthenticated network-adjacent attacker who can intercept traffic between the Airflow instance and its configured SMTP relay can present a fraudulent TLS certificate, successfully complete the upgrade handshake, and read all outbound email content in cleartext. No public exploit identified at time of analysis and EPSS is 0.01%, but the impact class is high confidentiality loss per CVSS.
Per-DAG RBAC bypass in Apache Airflow 3.2.0-3.2.1 allows authenticated users with restricted DAG permissions to read partitioned DAG run metadata for DAGs outside their authorized scope via the /ui/partitioned_dag_runs endpoint. The route enforced asset-level access control via requires_access_asset but omitted the parallel DAG-level check (requires_access_dag) and result-set filtering by readable DAG IDs, creating a gap in the multi-layer authorization model. No public exploit identified at time of analysis; EPSS is 0.01% (4th percentile), indicating very low exploitation probability consistent with the authenticated, information-disclosure-only impact.
JWT session tokens remain valid after logout in Apache Airflow deployments using FabAuthManager or KeycloakAuthManager due to an unreachable revoke_token() call in the logout code path. Versions before 3.2.2 are affected. When the configured auth manager returns an external redirect URL on logout (as Keycloak-backed deployments do), the logout handler redirects the browser before invoking revoke_token(), leaving the JWT - with its embedded jti claim - unregistered in the RevokedToken table and therefore still accepted by the API. No public exploit is identified at time of analysis, and EPSS exploitation probability stands at 0.01% (4th percentile), but the impact is meaningful in environments where session hijacking or token theft is a realistic threat model.
Rendered template field serialization in Apache Airflow before 3.2.2 exposes nested secrets in cleartext when template field values exceed the configured max_templated_field_length threshold. Authenticated low-privilege users with access to rendered template views can read values stored under documented sensitive keys (password, token, secret, api_key) embedded in nested dictionaries - the pre-fix code stringified the structured object before invoking the secrets masker, destroying the nested key context required for recursive redaction. No public exploit is identified at time of analysis; EPSS is 0.02% (5th percentile), and this CVE is not listed in the CISA KEV catalog.
Apache Airflow versions prior to 3.2.1 allow authenticated users with read access to at least one directed acyclic graph (DAG) to enumerate and discover the names and existence of all other DAGs and assets in the deployment, regardless of their assigned permissions. This information disclosure vulnerability enables privilege escalation reconnaissance by revealing the complete asset topology to users with limited scope authorization. The vulnerability requires valid user credentials but no elevated privileges, and has no known public exploit code at time of analysis.
Apache Airflow versions prior to 3.2.1 fail to enforce per-DAG access control on the /ui/dags endpoint, allowing authenticated users with read access to at least one DAG to retrieve Human-in-the-Loop prompts and full TaskInstance details for DAGs outside their authorized scope. This information disclosure bypasses the intended per-DAG RBAC boundary, exposing operator parameters and task context data to all authenticated users regardless of their assigned DAG permissions.
Apache Airflow 3.0.0 through 3.1.x fails to invalidate JWT tokens at logout, allowing intercepted tokens to remain valid for unauthorized API access. This session management weakness enables replay attacks against the workflow orchestration platform's REST API. No active exploitation confirmed (EPSS 3rd percentile), but SSVC rates as automatable with partial technical impact. Vendor-released patch: Apache Airflow 3.2.0.
Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive connection parameters were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow database. While this risk is limited to users with audit log access, it is recommended to upgrade to Airflow 2.11.1 or a later version, which addresses this issue. User...
DAG Author (who already has quite a lot of permissions) could manipulate database of Airflow 2 in the way to execute arbitrary code in the web-server context, which they should normally not be able to do, leading to potentially remote code execution in the context of web-server (server-side) as a result of a user viewing historical task information. [CVSS 8.4 HIGH]
When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG. [CVSS 6.5 MEDIUM]
Apache Airflow 3.0.0 through 3.1.6 allows authenticated users with access to specific DAGs to view import error messages from other DAGs they lack permission to access, resulting in unintended information disclosure. An authenticated attacker can leverage this privilege escalation to gather sensitive information about other workflows and their configurations. Apache recommends upgrading to version 3.1.7 or later to remediate this vulnerability.
Airflow versions up to 3.1.6 contains a vulnerability that allows attackers to an authenticated user with custom permissions limited to task access to view tas (CVSS 6.5).
In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result, when such connections are rendered or printed to logs, proxy credentials embedded in these fields could be exposed. Users are recommended to upgrade to 3.1.6 or later for Airflow 3, and 2.11.1 or la...
In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the Rendered Templates UI. [CVSS 7.5 HIGH]
Authenticated users of Apache Airflow can read secret values exposed in the Rendered Templates view because operator template fields were serialized and sent to the API server without first applying the secrets masker, so values registered via mask_secret() appeared in plaintext in the UI. Exploitation requires a valid Airflow UI account (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, PR:L - authenticated) that can reach rendered task-instance fields but is not authorized for the underlying secrets, making this a real concern mainly in multi-user or multi-tenant deployments where DAGs and tasks actually pass secrets through templated fields. The flaw is a moderate-severity information disclosure issue (CVSS 6.5, CWE-201) affecting Airflow releases before 3.1.4; no public exploit code has been identified at time of analysis and EPSS is low at 0.48 percent (39th percentile), so it should be treated as a patch-soon rather than emergency item.
An authenticated Apache Airflow user who holds only the CREATE permission (without UPDATE) on Pools, Connections, or Variables can overwrite existing records by invoking the bulk create API endpoint with the 'overwrite' action, effectively gaining modification rights that RBAC was meant to deny. The flaw is CWE-250 (Execution with Unnecessary Privileges): the bulk endpoint authorizes the request against the CREATE privilege while still honoring the 'overwrite' flag, so no UPDATE check is performed on the targeted record. Impact is limited to integrity of those configuration objects (assessed CVSS 4.6, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), and it is only reachable in deployments that deliberately separate CREATE from UPDATE via fine-grained RBAC; no public exploit identified at time of analysis, and EPSS is low at 0.43% (36th percentile).
Authenticated API users can trigger DAG code execution in Apache Airflow's api-server context via the /api/v2/dagReports endpoint when the api-server is deployed with access to DAG files, leading to privilege escalation within that process. This moderate-severity flaw (CVSS 5.4) requires a valid API user (PR:L) and a specific deployment topology where DAG files are co-located with or readable by the api-server; default locked-down configurations with strict separation are not exploitable. No public exploit code or active exploitation has been identified, and EPSS is low at 0.52%.
OS command injection in Apache Airflow's bundled `example_dag_decorator` example DAG allows an authenticated web UI user to supply an unvalidated parameter that redirects the example to an attacker-controlled server and executes code on the Airflow worker. Exploitation is narrow: it requires that example DAGs be explicitly enabled in production (not the default, since Airflow ships example loading disabled) or that the vulnerable example code was copied into a user-built DAG, and it further requires the user to trigger an actual DAG run, so only misconfigured or copy-reused environments are realistically exposed. No public exploit has been identified at time of analysis, EPSS is low at 0.49% (~40th percentile), and per NVD the issue is rated modestly (CVSS 3.1 base 4.6), with the independent assessment raising attack complexity to High; the vendor-released fix is Airflow 3.0.5.
Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Improper Preservation of Permissions vulnerability in Apache Airflow.8.2 through 2.8.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable.
Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Default Permissions vulnerability could allow attackers to access resources due to overly permissive default settings.
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI. Rated medium severity (CVSS 5.9), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Resource to Wrong Sphere vulnerability could allow attackers to access resources from an unintended security context.
Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.4.0 to 2.7.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when the "expose_config" option is set to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Resource to Wrong Sphere vulnerability could allow attackers to access resources from an unintended security context.
Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL Certificate vulnerability. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Apache Airflow, versions before 2.6.3, has a vulnerability where an authenticated user can use crafted input to make the current request hang. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to cause a service disruption by manipulating the run_id parameter. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended directory structure by manipulating the run_id. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.6.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Task instance details page in the UI is vulnerable to a stored XSS.6.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.5.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to control commands executed. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter.4.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example when they were depending on past and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's `/confirm` endpoint. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Arbitrary code execution in the control plane of Apache Airflow deployments using the Apache Kafka provider 1.15.0 up to but not including 2.0.0: an authenticated user who can edit Airflow connections (PR:L) can plant a dotted-path string in a Kafka connection's extra field that the provider resolves into a Python callable via import_string without any allowlist, and confluent-kafka then invokes it inside the scheduler process. Exploitation is conditional and the limiting factors are substantial: the Kafka event producer must be explicitly enabled through dag_run_events_enabled or task_instance_events_enabled (both disabled by default), and the broker must be a plain Kafka cluster or Amazon MSK, since Google Managed Kafka overwrites the user-supplied oauth_cb and is unaffected. This breaks the Airflow security model because connection-configuration users are only supposed to reach code execution on workers, not the scheduler, and EPSS is low at 0.45% (38th percentile) with no public exploit identified at time of analysis; the assessed vector uses AC:H to reflect the required preconditions.
Authentication bypass in the Apache Airflow FAB provider (apache-airflow-providers-fab before 3.9.0) allows an attacker who holds an OIDC id_token that the same Authentik identity provider minted for a different client application to log into Airflow as the named user, because the Authentik OAuth path in the FAB auth manager never validates the token's issuer or audience claims. Only deployments using the FAB auth manager with Authentik OAuth are affected, and only where that same Authentik instance also serves at least one other application, so the attacker must already possess a valid token from that other application (the assessed vector is AV:N/AC:H/PR:L/UI:N, reflecting these gated prerequisites). Risk is high on confidentiality and integrity for exposed deployments, but the exploit path is narrow; no public exploit has been identified at time of analysis and EPSS is low at 0.14% (4th percentile), so this is a strongly gated authentication-bypass issue rather than a broad remote-takeover vector.
Insufficient session expiration in apache-airflow-providers-fab 2.4.2 through 3.9.0 means an attacker who already holds a copy of a victim's valid session cookie retains authenticated access to Apache Airflow even after an administrator (or the user) performs a password reset as a containment step. The flaw affects only deployments using the FAB auth manager with `[fab] session_backend=database`, where the reset routine compares the string identifier Flask-Login stores in server-side session records against the user's integer database ID, so the comparison never matches and no session is actually deleted; this is a persistence/containment-bypass issue rather than a standalone break-in, since the attacker must have obtained the cookie through some prior compromise. There is no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), but the vendor's CVSS of 9.8 conflicts with the assessed vector (AV:N/AC:H/PR:N/UI:N), which reflects the substantial preconditions - a non-default session backend plus a pre-existing cookie theft. A single upgrade to apache-airflow-providers-fab 3.9.0 or later also closes CVE-2026-86462, a second independent route to the same outcome via the Admin user-edit endpoint.
Stolen database-backed session cookies keep working after a password change in Apache Airflow deployments that use the FAB auth manager (apache-airflow-providers-fab 3.2.0 through 3.9.0), so an attacker already holding a copy of a victim's session cookie is never evicted and retains full access as that user. The flaw is CWE-613 (insufficient session expiration): the Admin user-edit PATCH endpoint applies the new password but never calls the session-invalidation helper, and the trigger is a routine password change performed by an administrator or the user themselves - no interaction by the attacker is required. The vendor scores this 9.1, while our independent assessment is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, because exploitation depends entirely on a prior, separate session-cookie theft and on the non-default database-backed session configuration, making this a post-compromise persistence/containment failure rather than an initial access vector. EPSS is low at 0.19% (9th percentile); no public exploit code and no CISA KEV entry were identified at time of analysis, and a vendor-released patch exists in version 3.9.0.
Deactivating a user account in Apache Airflow 3 deployments that run the FAB auth manager with Core API token authentication fails to revoke tokens already issued to that account, so the disabled user can keep replaying an unexpired token - and use it to mint a replacement - after an administrator has turned the account off. The credential is the account's own legitimate token, so there is no signature forgery and no privilege escalation: access stays bounded to the roles the account already held, but the administrative containment action silently fails and the account keeps role-scoped API access until the token finally expires. No public exploit code identified at time of analysis; EPSS is low at 0.25% (16th percentile); a vendor fix is available in apache-airflow-providers-fab 3.9.0.
Authentication bypass in the Apache Airflow Keycloak auth manager provider (apache-airflow-providers-keycloak below 0.10.0) lets a remote attacker exchange credentials belonging to any confidential client in a shared Keycloak realm for a signed Airflow session token, even though those credentials have nothing to do with Airflow. The unauthenticated POST /auth/token client_credentials grant performed no allowlist check on client_id, so an unrelated application's service-account secret became a valid Airflow login; the resulting access is limited to whatever that service account is authorized for per subject, plus endpoints gated only on being authenticated. Exploitation requires a non-default topology - a Keycloak auth manager deployment whose realm is shared with at least one other confidential client - and the attacker must already hold valid credentials for one of those clients; no public exploit code has been identified at time of analysis, EPSS is low (0.19%, 9th percentile), and a vendor patch is available in provider version 0.10.0.
Privilege escalation in the Apache Airflow Keycloak auth manager (apache-airflow-providers-keycloak) affecting Airflow 3.3 and later lets an authenticated user who already holds a valid Airflow session pair it with another subject's Keycloak access or refresh token - obtained out of band via cookie theft, proxy capture or a leaked token - so Airflow authorizes their requests with the foreign token's privileges while the audit log, cache keys and session identity continue to name the attacker's own account. The official CVSS of 9.1 overstates practical risk: exploitation requires both a valid Airflow login and a genuine (not forged) Keycloak token belonging to someone else, and the opt-in Keycloak auth manager is not Airflow's default authentication backend, so the independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N rather than AV:N/AC:L/PR:N. There is no public exploit code and no confirmed active exploitation (EPSS 0.21%, 11th percentile); upgrading the provider to 0.10.0 or later restores the subject binding between session and Keycloak tokens.
Server-side template injection in Apache Airflow versions 3.0.0 through 3.2.1 allows low-privilege authenticated users to inject Jinja2 expressions via dag_run.conf parameters that are unsafely interpolated into BashOperator commands, leading to arbitrary command execution in the worker context. The flaw carries a 9.1 CVSS but EPSS sits at just 0.03% (9th percentile), and there is no public exploit identified at time of analysis despite a vendor patch being available. Disclosure occurred via the oss-security mailing list on 2026-05-31 alongside several other Airflow advisories.
Sensitive information disclosure in Apache Airflow versions prior to 3.2.2 exposes JWT authentication tokens via KubernetesExecutor command-line arguments, allowing low-privileged users with process listing access on worker pods to harvest credentials and impersonate workers against the Execution API. The flaw, addressed in PR #60108 alongside a redesign of workload/execution token lifetimes, carries a CVSS 8.8 due to high impact across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis and EPSS sits at 0.02%, suggesting limited mass-exploitation activity.
Open redirect bypass in Apache Airflow 3.0.0 through 3.2.1 allows remote unauthenticated attackers to craft URLs that evade the `is_safe_url` host check by using triple-slash (`///`), backslash, or URL-encoded backslash prefixes, redirecting victims to attacker-controlled domains. The flaw stems from a parsing inconsistency between WHATWG URL semantics and Python's urllib. No public exploit has been identified at time of analysis, and EPSS rates exploitation probability at only 0.01% (4th percentile).
Arbitrary Python module import in Apache Airflow versions prior to 3.2.2 occurs when the scheduler deserializes custom DeadlineReference objects, because the prior implementation called import_string() directly on an attacker-controllable __class_path field. Rated CVSS 7.3 with low confidentiality/integrity/availability impact, this issue has no public exploit identified at time of analysis and EPSS estimates exploitation probability at 0.02% (6th percentile).
API authorization bypass in Apache Airflow 3.2.0 through versions before 3.2.2 allows authenticated users with access to one DAG to mutate TaskInstances belonging to other DAGs they should not control, via the bulk TaskInstances PUT/DELETE endpoints. The flaw stems from the bulk handler omitting per-DAG authorization checks, enabling cross-DAG state tampering with high integrity impact (CVSS 7.5, vector AV:N/AC:L/PR:N/UI:N/I:H). No public exploit identified at time of analysis and EPSS probability is low at 0.01%.
Authenticated remote code execution in Apache Airflow 3.2.0 through 3.2.1 allows users with permission to update XCom entries to achieve code execution by submitting reserved deserialization metadata keys (e.g. __classname__, __type, __data__, __var) to the PATCH XCom endpoint. The XComUpdateBody datamodel omitted the FORBIDDEN_XCOM_KEYS validator that XComCreateBody enforced, letting attackers smuggle a malicious typed payload that is later deserialized into an arbitrary Python class. No public exploit identified at time of analysis and EPSS risk is negligible (0.02%), but a vendor fix has shipped and the root cause is a classic CWE-502 untrusted deserialization.
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was found in Apache Airflow versions 1.10.10 and below. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
JWT session cookies in Apache Airflow's JWTRefreshMiddleware are set without the Secure flag when Airflow runs behind an HTTPS-terminating reverse proxy, exposing them to network interception. Affected versions span Apache Airflow 3.0.0 through 3.2.1 (exclusive), where the middleware checked only for a local ssl_cert configuration setting to determine cookie security - missing the common deployment pattern where TLS is offloaded at a load balancer or proxy layer. An unauthenticated network adversary positioned for man-in-the-middle interception could capture a user's JWT refresh cookie and take over their authenticated session. No public exploit code or CISA KEV listing exists at time of analysis; EPSS of 0.01% reflects low automated exploitation likelihood.
Arbitrary file read in Apache Airflow's FileTaskHandler allows authenticated users to read files outside the designated log directory by placing symlinks within the log folder tree. Versions prior to 3.2.2 are affected. Because FileTaskHandler._read_from_local() resolved glob matches without first verifying that a symlink's real path stays within the configured base log folder, a low-privileged Airflow user could exfiltrate sensitive server-side files - credentials, keys, or configuration - by directing log reads through a crafted symlink. No public exploit code exists and the vulnerability is not in CISA KEV, though the CVSS C:H rating reflects genuine confidentiality risk.
Cross-DAG log file disclosure in Apache Airflow’s log server allows authenticated users to bypass JWT authorization using a Python lstrip() character-stripping flaw. Affected versions 3.0.0 through 3.2.1 can be exploited to read unauthorized log files from other DAGs. A proof-of-concept exists, but exploitation likelihood is extremely low (EPSS 0.01%) and the impact is limited to low confidentiality.
DAG authorization bypass in Apache Airflow 3.0.0-3.2.1 allows authenticated low-privileged users to enumerate DAG structure and cross-DAG dependency topology for DAGs they are not authorized to view, by querying the `/ui/structure/structure_data` endpoint without proper RBAC enforcement. The endpoint returned external dependency nodes and edges without applying the `ReadableDagsFilterDep` authorization filter, crossing per-DAG RBAC boundaries. No public exploit exists and EPSS is 0.01% (4th percentile); impact is confined to confidentiality of workflow topology in multi-tenant or fine-grained RBAC deployments.
The event log detail endpoint in Apache Airflow before 3.2.2 applies a generic DAG-level audit log permission check rather than scoping authorization to the specific DAG that owns the requested event log entry, allowing any authenticated low-privilege user to read audit log entries belonging to DAGs outside their permitted scope. The flaw is a broken object-level authorization (IDOR) pattern - classified as CWE-639 - where the user-supplied `event_log_id` path parameter can reference log rows from unauthorized DAGs without triggering a rejection. No public exploit code exists and the issue is not listed in CISA KEV, but the attack is trivially executable by any authenticated Airflow user in a multi-tenant deployment.
The SecretsMasker component in Apache Airflow prior to 3.2.2 returns cleartext sensitive values when those values are stored under recognized sensitive key names (password, token, secret, api_key) nested deeper than five dict levels in structured payloads. Authenticated low-privilege users can craft dag_run.conf or XCom payloads exceeding this depth threshold, causing secrets to surface in task logs, rendered templates, and API responses. No public exploit code exists and EPSS is 0.02% at the 5th percentile - this is not confirmed actively exploited (not in CISA KEV) - but the CVSS confidentiality impact is rated High given that the bypass can expose real credentials to any user who can review logs.
Missing certificate validation during SMTP STARTTLS negotiation in Apache Airflow 2.0.0 through 3.2.1 exposes email traffic to man-in-the-middle interception. Both the core email utility (airflow.utils.email.send_email) and the SMTP provider hook (SmtpHook.get_conn, SmtpHook.aget_conn) called starttls() without an SSL context, causing Python's smtplib to accept any server certificate unconditionally. An unauthenticated network-adjacent attacker who can intercept traffic between the Airflow instance and its configured SMTP relay can present a fraudulent TLS certificate, successfully complete the upgrade handshake, and read all outbound email content in cleartext. No public exploit identified at time of analysis and EPSS is 0.01%, but the impact class is high confidentiality loss per CVSS.
Per-DAG RBAC bypass in Apache Airflow 3.2.0-3.2.1 allows authenticated users with restricted DAG permissions to read partitioned DAG run metadata for DAGs outside their authorized scope via the /ui/partitioned_dag_runs endpoint. The route enforced asset-level access control via requires_access_asset but omitted the parallel DAG-level check (requires_access_dag) and result-set filtering by readable DAG IDs, creating a gap in the multi-layer authorization model. No public exploit identified at time of analysis; EPSS is 0.01% (4th percentile), indicating very low exploitation probability consistent with the authenticated, information-disclosure-only impact.
JWT session tokens remain valid after logout in Apache Airflow deployments using FabAuthManager or KeycloakAuthManager due to an unreachable revoke_token() call in the logout code path. Versions before 3.2.2 are affected. When the configured auth manager returns an external redirect URL on logout (as Keycloak-backed deployments do), the logout handler redirects the browser before invoking revoke_token(), leaving the JWT - with its embedded jti claim - unregistered in the RevokedToken table and therefore still accepted by the API. No public exploit is identified at time of analysis, and EPSS exploitation probability stands at 0.01% (4th percentile), but the impact is meaningful in environments where session hijacking or token theft is a realistic threat model.
Rendered template field serialization in Apache Airflow before 3.2.2 exposes nested secrets in cleartext when template field values exceed the configured max_templated_field_length threshold. Authenticated low-privilege users with access to rendered template views can read values stored under documented sensitive keys (password, token, secret, api_key) embedded in nested dictionaries - the pre-fix code stringified the structured object before invoking the secrets masker, destroying the nested key context required for recursive redaction. No public exploit is identified at time of analysis; EPSS is 0.02% (5th percentile), and this CVE is not listed in the CISA KEV catalog.
Apache Airflow versions prior to 3.2.1 allow authenticated users with read access to at least one directed acyclic graph (DAG) to enumerate and discover the names and existence of all other DAGs and assets in the deployment, regardless of their assigned permissions. This information disclosure vulnerability enables privilege escalation reconnaissance by revealing the complete asset topology to users with limited scope authorization. The vulnerability requires valid user credentials but no elevated privileges, and has no known public exploit code at time of analysis.
Apache Airflow versions prior to 3.2.1 fail to enforce per-DAG access control on the /ui/dags endpoint, allowing authenticated users with read access to at least one DAG to retrieve Human-in-the-Loop prompts and full TaskInstance details for DAGs outside their authorized scope. This information disclosure bypasses the intended per-DAG RBAC boundary, exposing operator parameters and task context data to all authenticated users regardless of their assigned DAG permissions.
Apache Airflow 3.0.0 through 3.1.x fails to invalidate JWT tokens at logout, allowing intercepted tokens to remain valid for unauthorized API access. This session management weakness enables replay attacks against the workflow orchestration platform's REST API. No active exploitation confirmed (EPSS 3rd percentile), but SSVC rates as automatable with partial technical impact. Vendor-released patch: Apache Airflow 3.2.0.
Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive connection parameters were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow database. While this risk is limited to users with audit log access, it is recommended to upgrade to Airflow 2.11.1 or a later version, which addresses this issue. User...
DAG Author (who already has quite a lot of permissions) could manipulate database of Airflow 2 in the way to execute arbitrary code in the web-server context, which they should normally not be able to do, leading to potentially remote code execution in the context of web-server (server-side) as a result of a user viewing historical task information. [CVSS 8.4 HIGH]
When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG. [CVSS 6.5 MEDIUM]
Apache Airflow 3.0.0 through 3.1.6 allows authenticated users with access to specific DAGs to view import error messages from other DAGs they lack permission to access, resulting in unintended information disclosure. An authenticated attacker can leverage this privilege escalation to gather sensitive information about other workflows and their configurations. Apache recommends upgrading to version 3.1.7 or later to remediate this vulnerability.
Airflow versions up to 3.1.6 contains a vulnerability that allows attackers to an authenticated user with custom permissions limited to task access to view tas (CVSS 6.5).
In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result, when such connections are rendered or printed to logs, proxy credentials embedded in these fields could be exposed. Users are recommended to upgrade to 3.1.6 or later for Airflow 3, and 2.11.1 or la...
In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the Rendered Templates UI. [CVSS 7.5 HIGH]
Authenticated users of Apache Airflow can read secret values exposed in the Rendered Templates view because operator template fields were serialized and sent to the API server without first applying the secrets masker, so values registered via mask_secret() appeared in plaintext in the UI. Exploitation requires a valid Airflow UI account (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, PR:L - authenticated) that can reach rendered task-instance fields but is not authorized for the underlying secrets, making this a real concern mainly in multi-user or multi-tenant deployments where DAGs and tasks actually pass secrets through templated fields. The flaw is a moderate-severity information disclosure issue (CVSS 6.5, CWE-201) affecting Airflow releases before 3.1.4; no public exploit code has been identified at time of analysis and EPSS is low at 0.48 percent (39th percentile), so it should be treated as a patch-soon rather than emergency item.
An authenticated Apache Airflow user who holds only the CREATE permission (without UPDATE) on Pools, Connections, or Variables can overwrite existing records by invoking the bulk create API endpoint with the 'overwrite' action, effectively gaining modification rights that RBAC was meant to deny. The flaw is CWE-250 (Execution with Unnecessary Privileges): the bulk endpoint authorizes the request against the CREATE privilege while still honoring the 'overwrite' flag, so no UPDATE check is performed on the targeted record. Impact is limited to integrity of those configuration objects (assessed CVSS 4.6, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), and it is only reachable in deployments that deliberately separate CREATE from UPDATE via fine-grained RBAC; no public exploit identified at time of analysis, and EPSS is low at 0.43% (36th percentile).
Authenticated API users can trigger DAG code execution in Apache Airflow's api-server context via the /api/v2/dagReports endpoint when the api-server is deployed with access to DAG files, leading to privilege escalation within that process. This moderate-severity flaw (CVSS 5.4) requires a valid API user (PR:L) and a specific deployment topology where DAG files are co-located with or readable by the api-server; default locked-down configurations with strict separation are not exploitable. No public exploit code or active exploitation has been identified, and EPSS is low at 0.52%.
OS command injection in Apache Airflow's bundled `example_dag_decorator` example DAG allows an authenticated web UI user to supply an unvalidated parameter that redirects the example to an attacker-controlled server and executes code on the Airflow worker. Exploitation is narrow: it requires that example DAGs be explicitly enabled in production (not the default, since Airflow ships example loading disabled) or that the vulnerable example code was copied into a user-built DAG, and it further requires the user to trigger an actual DAG run, so only misconfigured or copy-reused environments are realistically exposed. No public exploit has been identified at time of analysis, EPSS is low at 0.49% (~40th percentile), and per NVD the issue is rated modestly (CVSS 3.1 base 4.6), with the independent assessment raising attack complexity to High; the vendor-released fix is Airflow 3.0.5.
Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Improper Preservation of Permissions vulnerability in Apache Airflow.8.2 through 2.8.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable.
Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Default Permissions vulnerability could allow attackers to access resources due to overly permissive default settings.
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI. Rated medium severity (CVSS 5.9), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Resource to Wrong Sphere vulnerability could allow attackers to access resources from an unintended security context.
Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.4.0 to 2.7.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when the "expose_config" option is set to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Resource to Wrong Sphere vulnerability could allow attackers to access resources from an unintended security context.
Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL Certificate vulnerability. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Apache Airflow, versions before 2.6.3, has a vulnerability where an authenticated user can use crafted input to make the current request hang. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to cause a service disruption by manipulating the run_id parameter. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended directory structure by manipulating the run_id. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.6.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Task instance details page in the UI is vulnerable to a stored XSS.6.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.5.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to control commands executed. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter.4.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example when they were depending on past and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's `/confirm` endpoint. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.