Apache Airflow
Monthly
Logout on the Apache Airflow Core API revokes only the `_token` browser session cookie and silently ignores a credential presented as an `Authorization: Bearer` header, so an API client that logs out with a bearer token receives the endpoint's normal logout response while its JWT is never invalidated and remains usable until natural expiry (24 hours by default, configurable). Only deployments running Airflow 3.0.0 through 3.3.2 whose API clients authenticate with bearer tokens rather than the browser cookie are affected, and the hard prerequisite is that the attacker already holds a copy of that valid token - obtaining it is explicitly outside the scope of this issue, and no privileges beyond the victim's own are gained. No public exploit code has been identified at time of analysis; the vendor's CVSS 9.1 substantially overstates the exposure, and our independent assessment scores it 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) because the flaw only extends a session the attacker could already use, rather than granting new access.
Unsafe deserialization in Apache Airflow 3.0.0 through 3.3.0 allows any DAG author to achieve arbitrary code execution in the Scheduler and API server by placing a crafted value in an operator's executor_config field. The serialization layer reconstructed exception nodes by calling import_string() on an attacker-controlled class name with no allowlist, enabling import and invocation of arbitrary callables such as subprocess.check_output or builtins.eval. Both affected components hold the metadata database credentials and JWT signing secret, making full infrastructure compromise a realistic outcome. No public exploit has been identified at time of analysis, but no non-default configuration is required. This is a distinct sink from CVE-2026-33264, meaning deployments that already patched that earlier advisory remain fully vulnerable and must upgrade again to apache-airflow 3.3.1.
Remote code execution and scheduler-process disruption in Apache Airflow 3.3.0 stems from unguarded deserialization of task instance `next_kwargs` during the scheduler's unconditional `awaiting_input` sweep, a code path introduced as part of the 3.3.0 human-in-the-loop task rewrite. Any authenticated DAG author who can influence task state through the task execution API can supply a crafted payload that causes arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job entirely. No public exploit has been identified at time of analysis, but a vendor-released patch exists in 3.3.1; deployments that previously patched CVE-2026-58076 are still vulnerable through this distinct code path and must upgrade.
Unsafe deserialization in Apache Airflow 3.3.0's Task SDK allows an authenticated DAG author to cause arbitrary module imports inside the scheduler process. By controlling a task instance's `next_kwargs` via the task execution API, an attacker can inject a crafted callback path that the scheduler's unconditional `awaiting_input` timeout sweep deserializes by re-running the `SyncCallback` constructor - triggering an import of the named module in the scheduler's process space. Because `SyncCallback` is itself an Airflow class, it bypasses the `allowed_deserialization_classes` allow-list, making tightening that setting ineffective. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS score of 8.8 reflects the severity of the potential scheduler process compromise.
Authorization bypass in Apache Airflow's Backfill API (all versions prior to 3.3.1) allows any authenticated user holding edit permission on a single DAG to read, pause, cancel, and fail backfills belonging to any other DAG. The flaw is a type-parsing mismatch in FastAPI's dependency resolution layer: the authorization dependency parsed the `backfill_id` path parameter with Python's `int()` while the route handler declared `NonNegativeInt` via Pydantic, which in lax mode coerces inputs like `'42.0'` that `int()` rejects-causing the two components to authorize and act on different DAGs. Backfill IDs are sequential, making cross-DAG enumeration trivial; no public exploit code has been identified at time of analysis, though the technique is directly reproducible from the published patch diff.
Remote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controlled class path is loaded via an unrestricted import_string() when the Scheduler or API Server deserializes the serialized DAG, executing arbitrary code in those privileged processes and breaking the core Airflow boundary that DAG-author code must never run in the Scheduler/API Server. Reported by Apache with a fix in 3.3.0, it currently has no public exploit identified and a low EPSS of 0.69% (48th percentile), and it is not listed in CISA KEV. The practical severity depends heavily on how much a deployment trusts its DAG authors, since exploitation requires the ability to submit a DAG.
Command injection in Apache Airflow's BashOperator documentation example allows authenticated attackers to escalate privileges from UI user to worker-level code execution. Affects all Airflow versions before 3.2.0. The vulnerability stems from documentation suggesting unsafe handling of dag_run.conf parameters, which organizations may have replicated in production DAGs. EPSS score of 0.03% indicates low observed exploitation probability, though the upstream fix (PR #64129) demonstrates vendor acknowledgment and remediation.
Apache Airflow before 3.2.0 exposes SQL exception stack traces through API responses despite api/expose_stack_traces=false configuration, allowing remote unauthenticated attackers to enumerate database schema details, table names, query structure, and internal filesystem paths. CVSS 7.5 (High) with network vector and no authentication required. EPSS score of 0.02% (4th percentile) indicates low probability of widespread exploitation. Vendor patch available in Airflow 3.2.0 per Apache advisory. No active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis.
Deserialization vulnerability in Apache Airflow webserver (all versions before 3.2.0) allows network-accessible attackers to execute arbitrary code by injecting malicious XCom payloads, despite vendor-assigned Low severity due to the trusted Dag Author threat model. CVSS 9.8 Critical rating reflects unauthenticated network-based RCE capability (AV:N/PR:N), contradicting the description's trust assumption. EPSS 0.07% (22nd percentile) suggests low immediate exploitation likelihood. No active exploitation confirmed; vendor patch available in version 3.2.0 with public GitHub PR.
Apache Airflow 3.0.x prior to 3.2.0 allows remote unauthenticated attackers to trigger unauthorized DAG (Directed Acyclic Graph) execution via the UI or API, bypassing asset materialize permission checks. Despite CVSS 7.5 HIGH, the CVSS vector (PR:N) contradicts the description's requirement for 'UI/API user with asset materialize permission', suggesting authentication IS required-a critical discrepancy that demands verification. EPSS of 0.01% (3rd percentile) indicates minimal observed exploitation activity. Vendor-released patch available in Airflow 3.2.0 per Apache advisory.
Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI user with log access to escalate privileges and impersonate DAG Authors. CVSS rates this 7.5 HIGH for confidentiality impact, though the EPSS score of 0.02% (5th percentile) suggests minimal observed exploitation attempts. No active exploitation is confirmed; vendor patch available in version 3.2.0 released April 2026.
Remote code execution in Apache Airflow 3.1.x allows authenticated DAG Authors to execute arbitrary code in the webserver context through crafted XCom payloads exploiting insecure deserialization (CWE-502). Affects Apache Airflow versions 3.1.8 through <3.2.0. Despite CVSS 8.8, vendor rates severity as Low due to DAG Authors being highly trusted roles. No public exploit identified at time of analysis, with EPSS exploitation probability at 0.07% (21st percentile), indicating minimal real-world risk. Vendor-released patch: Apache Airflow 3.2.0.
CVE-2026-30911 is a security vulnerability (CVSS 8.1) that allows any authenticated task instance. High severity vulnerability requiring prompt remediation. Vendor patch is available.
CVE-2026-28779 is a security vulnerability (CVSS 7.5) that allows any application co-hosted under the same domain. High severity vulnerability requiring prompt remediation. Vendor patch is available.
Credential disclosure in the Apache Airflow Teradata provider (apache-airflow-providers-teradata before 3.7.0) causes cloud storage secrets to be written into SQL text that is then logged and executed, leaking those secrets to two sinks outside Airflow's control. Deployments using S3ToTeradataOperator or AzureBlobStorageToTeradataOperator against a private bucket or container with no teradata_authorization_name configured - the default credential path for both operators - are affected; S3ToTeradataOperator's runtime AWS credentials and STS session token land in the Airflow task log, readable by any user with log-view permission on the Dag, while both operators write credentials into Teradata's DBQL query logs and live monitoring views, where Airflow masking never applies and the values persist for Teradata's log retention period. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, i.e. remote but requiring an already-privileged party with log-read access, and no public exploit identified at time of analysis; impact is information disclosure only, with no integrity or availability effect.
Information disclosure in Apache Airflow's `/assets/events` REST endpoint lets an authenticated user who holds asset-read permission enumerate asset events - source Dag ID, task ID, run ID, timestamps, and total existence counts via pagination - for Dags they have no authorization to read. The endpoint applied no per-Dag readability filter, and because the same filter was missing from the count query, `total_entries` alone revealed the existence of hidden Dags. Affected deployments are apache-airflow versions prior to 3.3.2, and the exposure matters only where per-Dag access control is used to separate teams or tenants; in single-tenant deployments every user is already authorized to see all Dags, so nothing new is disclosed. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), so this is a modest-severity broken-authorization flaw rather than a high-urgency issue. Vendor-released patch: apache-airflow 3.3.2.
Principal confusion in Apache Airflow 3.3.0 and 3.3.1 causes core-API requests that carry both a `_token` session cookie and an explicit `Authorization: Bearer` (or OAuth2) credential to execute - and be recorded in the audit log - as the cookie's principal instead of the identity the client explicitly presented, inverting the intended bearer-over-cookie precedence. Exploitation is not automatic: the attacker must first plant a valid `_token` session cookie of their own into the victim's browser or client (for example by cookie tossing from a sibling subdomain, XSS in a separate application sharing the parent domain, or a shared workstation), and the victim's request must simultaneously carry an explicit credential, so only Airflow UI deployments hosted on a domain shared with other applications are reachable this way. The assessed outcome is misattributed audit records and principal confusion (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/C:N/I:L/A:N) rather than direct privilege escalation, and no public exploit code has been identified at time of analysis.
Secret exposure in Apache Airflow's Rendered Templates UI allows any authenticated user with task-level view access to read plaintext credential values that should have been masked. The secrets masker's `isinstance(str)` guard silently skips dict-typed Python objects, meaning JSON Variables accessed via `var.json` and containing dict payloads (e.g., database credentials, API keys stored as structured JSON) are rendered in cleartext rather than redacted. No public exploit is identified at time of analysis; however, the disclosure requires nothing more than standard UI navigation by a legitimately authenticated user.
Unsafe deserialization in Apache Airflow's XCom REST API allows an authenticated user with XCom write-and-read access to instantiate arbitrary `airflow.*` classes on the API server by smuggling reserved serialization keys inside JSON string literals. The `_check_forbidden_xcom_keys` guard inspected `dict`, `list`, and `tuple` types but did not attempt to JSON-decode `str` values, so a payload like `json.dumps({"__classname__": "airflow.sdk.definitions.connection.Connection"})` passed the write-time check and was later reconstructed into a live Python object when read back via `?deserialize=true`. No public exploit has been identified at time of analysis; vendor-released patch is available in apache-airflow 3.3.1.
Sensitive values stored as deeply nested lists, tuples, or sets in Apache Airflow Variables are displayed unmasked in the Variables UI due to a recursion-depth logic error in the secrets masker. This is an incomplete-fix follow-up to CVE-2026-42358: that prior fix made dictionary traversal unbounded but left list/tuple/set structures subject to the depth cutoff, allowing values beyond that depth to appear in plaintext on screen. The practical impact is narrow - any authenticated user who can see the Variable in the UI already has read access to the full value through the Variables REST API - making this a shoulder-surfing defense gap rather than an access-control bypass. No public exploit has been identified at time of analysis.
Sensitive credential exposure in Apache Airflow 3.3.0 allows an authenticated Viewer with configuration-read access to retrieve team-scoped sensitive options - including Celery broker URLs with embedded credentials - in cleartext via the Config API. The secrets masker evaluated sensitivity against raw section names without resolving team-prefixed sections (e.g., [team_a=celery]) back to their registered base section, so team-scoped overrides silently bypassed masking while equivalent global options were correctly redacted. This is a third distinct masker bypass variant following CVE-2026-48828 and CVE-2026-48892, meaning deployments that already upgraded to 3.3.0 to remediate those issues remain exposed. No public exploit identified at time of analysis.
Cleartext secret exposure in Apache Airflow's audit log affects all versions before 3.3.1, allowing any authenticated user with audit-log read access to recover Variable values and Connection `extra` credentials verbatim - without holding Variables or Connections read permissions. The bulk API endpoints (`PATCH /api/v2/variables`, `PATCH /api/v2/connections`) bypassed audit-log masking because the masker inspected only top-level request fields while bulk payloads nest entities two levels deep under `actions[].entities[]`. The Airflow UI's Import Variables action posts to this same bulk endpoint, meaning a routine operator import silently writes every secret in the uploaded file to the unmasked audit log. No public exploit is identified at time of analysis, but the vulnerability is fully exploitable by any authenticated user with log access, and deployments that upgraded to 3.3.0 in response to the related CVE-2026-50204 remain vulnerable and must upgrade again.
Cleartext exposure of list-shaped Variable secrets in Apache Airflow Task SDK (all versions before 3.3.1) allows any authenticated Airflow user to recover sensitive values directly from task execution logs and the Rendered Templates UI. The masking logic in _mask_and_deserialize_variable correctly handled string- and dict-typed JSON Variable values but contained no branch for the list type, so arrays - which may hold passwords, API tokens, or connection strings - were returned unredacted. No public exploit has been identified at time of analysis; however, organizations that patched CVE-2026-59244 remain fully exposed because that fix addressed only the dict case, and must upgrade again to 3.3.1.
Cross-team DAG authorization bypass in Apache Airflow versions prior to 3.3.1 allows authenticated users in one team to trigger DAG runs and read XCom values belonging to other teams. The asset materialization endpoint (POST /api/v2/assets/{asset_id}/materialize) and the XCom check in wait_dag_run_until_finished both passed DagDetails without resolving the DAG's team_name, causing team-aware auth managers (e.g., Keycloak) to evaluate the permission against the global DAG resource instead of the team-scoped DAG:<team> resource. This is a missing authorization flaw (CWE-862) affecting only deployments running multi-team mode with a team-aware auth manager; FAB auth manager deployments are explicitly unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-team credential access in Apache Airflow before 3.3.1 allows authenticated members of one team to invoke another team's Connection credentials through the POST /api/v2/connections/test API endpoint, exploiting a broken namespace-isolation guard in the environment-variable secrets backend. The flaw-confirmed by Apache with patches in PRs #70736 and #70902-combines a guard that only triggered on unscoped (global) requests with a regex incapable of matching team names containing underscores, even though underscores are explicitly permitted in Airflow team name validation. Exploitation requires a precise configuration alignment of multi_team mode, an explicitly enabled test_connection endpoint, and environment-variable-provisioned team secrets; no public exploit has been identified at time of analysis.
Apache Airflow REST API exposes provider secrets in plaintext through the task-instance detail and list endpoints when tasks are in a deferred state. Any authenticated user holding DAG-scoped task-instance read access - a permission commonly granted to non-admin roles - can retrieve API keys, passwords, or other secrets passed by deferred operators into trigger kwargs. Fixed in Apache Airflow 3.3.0; no public exploit code identified at time of analysis, though exploitation is trivially achievable by any authenticated user with the requisite read permission.
Sensitive credential exposure in Apache Airflow's Bulk Variables API allows authenticated users with bulk Variable read permission to retrieve plaintext values from JSON-typed variables whose key names use secret-suffixed conventions such as `*_password`, `*_token`, or `*_secret`. The redactor function was invoked without passing the variable key, so the `should_hide_value_for_key` check - which is responsible for masking secrets based on key-name patterns - could never fire for JSON-decodable variable values. This affects all deployments prior to 3.3.0 that store sensitive credentials in JSON-typed Airflow Variables under secret-suffixed key names; no public exploit has been identified at time of analysis, and exploitation is bounded by the requirement for authenticated access with a specific permission grant.
Unauthorized source code disclosure in Apache Airflow before 3.3.0 allows authenticated users to read the source of DAGs they are not authorized to, when multiple DAGs are co-located in a single source file. This bypasses per-DAG access control via the REST API endpoint GET /api/v2/dagSources/{dag_id} and the equivalent UI view. No public exploit identified, and EPSS probability is low (0.20%), mitigating immediate risk for most deployments.
Incomplete authorization filtering in Apache Airflow's `/ui/dependencies` scheduling graph endpoint exposes restricted DAG identifiers to authenticated users who lack read permission on those DAGs. The endpoint correctly filters top-level serialized DAG keys against the caller's ACL but leaks referenced DAG IDs through `dep.source` and `dep.target` fields of trigger and sensor dependency entries, enabling cross-team DAG enumeration in multi-tenant deployments. This is a residual gap from an incomplete fix for CVE-2026-28563; no public exploit has been identified at time of analysis, and a vendor patch is available in apache-airflow 3.3.0.
Apache Airflow's Config API leaks plaintext secrets-backend credentials to authenticated users with Config read permission, because per-key environment variable overrides (e.g., AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID) generate synthetic config entries whose names are absent from the sensitive_config_values masking list. Affected deployments are those that configure secrets backends such as HashiCorp Vault via these per-key environment variable patterns, exposing credentials like Vault role_id and secret_id through normal API responses. No public exploit has been identified at the time of analysis; the vendor-released fix is apache-airflow 3.3.0.
Information disclosure in Apache Airflow's GET /api/v2/connections/{connection_id} endpoint allows authenticated users with Connection-read permission to retrieve plaintext secrets from the extra JSON blob because the redaction allowlist omitted critical field names such as webhook_url, bearer, and service_key. No active exploitation or public PoC code was identified at the time of analysis; EPSS indicates very low exploitation probability (0.02%). Users should upgrade to apache-airflow 3.2.2 or later.
Session fixation and login-CSRF in apache-airflow-providers-keycloak prior to 0.7.0 allows remote attackers without prior authentication to hijack user sessions by delivering a crafted OAuth callback URL, enabling credential theft from stored Airflow connections. The vulnerability stems from missing OAuth 2.0 state parameter validation and lack of PKCE implementation, requiring only user interaction to trick victims into clicking a malicious link. EPSS score of 0.01% suggests minimal real-world exploitation despite moderate CVSS impact rating.
Apache Airflow 3.0.0 through 3.1.x fails to redact secrets stored as nested fields within JSON-formatted variables, allowing authenticated users with variable access to retrieve plaintext sensitive values. This information disclosure vulnerability affects deployments that store credentials or API keys as JSON dictionary structures in Airflow variables. The EPSS score of 0.02% and CVSS 3.7 with high attack complexity reflect limited real-world exploitation likelihood, but the vulnerability poses direct risk to organizations using JSON-structured secrets without additional access controls.
2-3 sentence plain-language synthesis. Not copy description. Start with impact, product, etc. Mention actively exploited? KEV? None. POC? Not mentioned, so
Unsafe XCom templating in Apache Airflow's documented example DAG (`example_xcom.py`) allowed an authenticated UI user with XCom modification privileges to inject arbitrary shell commands that execute on the Airflow worker node. The vulnerability exists only in deployments where operators replicated the example's pattern of directly embedding `XComArg` references via f-string interpolation into BashOperator command strings - a pattern explicitly not intended for production. No public exploit code exists, EPSS is 0.03%, and Apache itself rates the practical severity as Low, though worker-level code execution is the worst-case outcome for affected deployments.
Information disclosure in Apache Airflow 3.0.0 through 3.1.x stems from incomplete secret masking and under-documented workload-isolation and JWT-authentication assumptions, allowing sensitive credentials to surface in task logs and role boundaries to be weaker than a Deployment Manager might assume. The fix in 3.2.0 hardens the secrets masker (PR #58662) and formalizes the security model, JWT token authentication, and workload isolation guidance. No public exploit is identified and EPSS is very low (0.04%), making this a hardening/hygiene issue rather than an urgent exploited flaw.
Apache Airflow 3.0.0 through 3.1.8 discloses XCom result values to users with only DAG Run read permissions (such as Viewer role), violating the FAB RBAC model that treats XCom as a protected resource. This information disclosure affects authenticated users and allows them to access sensitive execution results they should not be able to view. The vulnerability is not confirmed as actively exploited, and a patch is available in Apache Airflow 3.2.0.
CVE-2026-28563 is a security vulnerability (CVSS 4.3) that allows an authenticated user with only dag dependencies permission. Remediation should follow standard vulnerability management procedures. Vendor patch is available.
CVE-2026-26929 is a security vulnerability (CVSS 6.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
Logout on the Apache Airflow Core API revokes only the `_token` browser session cookie and silently ignores a credential presented as an `Authorization: Bearer` header, so an API client that logs out with a bearer token receives the endpoint's normal logout response while its JWT is never invalidated and remains usable until natural expiry (24 hours by default, configurable). Only deployments running Airflow 3.0.0 through 3.3.2 whose API clients authenticate with bearer tokens rather than the browser cookie are affected, and the hard prerequisite is that the attacker already holds a copy of that valid token - obtaining it is explicitly outside the scope of this issue, and no privileges beyond the victim's own are gained. No public exploit code has been identified at time of analysis; the vendor's CVSS 9.1 substantially overstates the exposure, and our independent assessment scores it 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) because the flaw only extends a session the attacker could already use, rather than granting new access.
Unsafe deserialization in Apache Airflow 3.0.0 through 3.3.0 allows any DAG author to achieve arbitrary code execution in the Scheduler and API server by placing a crafted value in an operator's executor_config field. The serialization layer reconstructed exception nodes by calling import_string() on an attacker-controlled class name with no allowlist, enabling import and invocation of arbitrary callables such as subprocess.check_output or builtins.eval. Both affected components hold the metadata database credentials and JWT signing secret, making full infrastructure compromise a realistic outcome. No public exploit has been identified at time of analysis, but no non-default configuration is required. This is a distinct sink from CVE-2026-33264, meaning deployments that already patched that earlier advisory remain fully vulnerable and must upgrade again to apache-airflow 3.3.1.
Remote code execution and scheduler-process disruption in Apache Airflow 3.3.0 stems from unguarded deserialization of task instance `next_kwargs` during the scheduler's unconditional `awaiting_input` sweep, a code path introduced as part of the 3.3.0 human-in-the-loop task rewrite. Any authenticated DAG author who can influence task state through the task execution API can supply a crafted payload that causes arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job entirely. No public exploit has been identified at time of analysis, but a vendor-released patch exists in 3.3.1; deployments that previously patched CVE-2026-58076 are still vulnerable through this distinct code path and must upgrade.
Unsafe deserialization in Apache Airflow 3.3.0's Task SDK allows an authenticated DAG author to cause arbitrary module imports inside the scheduler process. By controlling a task instance's `next_kwargs` via the task execution API, an attacker can inject a crafted callback path that the scheduler's unconditional `awaiting_input` timeout sweep deserializes by re-running the `SyncCallback` constructor - triggering an import of the named module in the scheduler's process space. Because `SyncCallback` is itself an Airflow class, it bypasses the `allowed_deserialization_classes` allow-list, making tightening that setting ineffective. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS score of 8.8 reflects the severity of the potential scheduler process compromise.
Authorization bypass in Apache Airflow's Backfill API (all versions prior to 3.3.1) allows any authenticated user holding edit permission on a single DAG to read, pause, cancel, and fail backfills belonging to any other DAG. The flaw is a type-parsing mismatch in FastAPI's dependency resolution layer: the authorization dependency parsed the `backfill_id` path parameter with Python's `int()` while the route handler declared `NonNegativeInt` via Pydantic, which in lax mode coerces inputs like `'42.0'` that `int()` rejects-causing the two components to authorize and act on different DAGs. Backfill IDs are sequential, making cross-DAG enumeration trivial; no public exploit code has been identified at time of analysis, though the technique is directly reproducible from the published patch diff.
Remote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controlled class path is loaded via an unrestricted import_string() when the Scheduler or API Server deserializes the serialized DAG, executing arbitrary code in those privileged processes and breaking the core Airflow boundary that DAG-author code must never run in the Scheduler/API Server. Reported by Apache with a fix in 3.3.0, it currently has no public exploit identified and a low EPSS of 0.69% (48th percentile), and it is not listed in CISA KEV. The practical severity depends heavily on how much a deployment trusts its DAG authors, since exploitation requires the ability to submit a DAG.
Command injection in Apache Airflow's BashOperator documentation example allows authenticated attackers to escalate privileges from UI user to worker-level code execution. Affects all Airflow versions before 3.2.0. The vulnerability stems from documentation suggesting unsafe handling of dag_run.conf parameters, which organizations may have replicated in production DAGs. EPSS score of 0.03% indicates low observed exploitation probability, though the upstream fix (PR #64129) demonstrates vendor acknowledgment and remediation.
Apache Airflow before 3.2.0 exposes SQL exception stack traces through API responses despite api/expose_stack_traces=false configuration, allowing remote unauthenticated attackers to enumerate database schema details, table names, query structure, and internal filesystem paths. CVSS 7.5 (High) with network vector and no authentication required. EPSS score of 0.02% (4th percentile) indicates low probability of widespread exploitation. Vendor patch available in Airflow 3.2.0 per Apache advisory. No active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis.
Deserialization vulnerability in Apache Airflow webserver (all versions before 3.2.0) allows network-accessible attackers to execute arbitrary code by injecting malicious XCom payloads, despite vendor-assigned Low severity due to the trusted Dag Author threat model. CVSS 9.8 Critical rating reflects unauthenticated network-based RCE capability (AV:N/PR:N), contradicting the description's trust assumption. EPSS 0.07% (22nd percentile) suggests low immediate exploitation likelihood. No active exploitation confirmed; vendor patch available in version 3.2.0 with public GitHub PR.
Apache Airflow 3.0.x prior to 3.2.0 allows remote unauthenticated attackers to trigger unauthorized DAG (Directed Acyclic Graph) execution via the UI or API, bypassing asset materialize permission checks. Despite CVSS 7.5 HIGH, the CVSS vector (PR:N) contradicts the description's requirement for 'UI/API user with asset materialize permission', suggesting authentication IS required-a critical discrepancy that demands verification. EPSS of 0.01% (3rd percentile) indicates minimal observed exploitation activity. Vendor-released patch available in Airflow 3.2.0 per Apache advisory.
Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI user with log access to escalate privileges and impersonate DAG Authors. CVSS rates this 7.5 HIGH for confidentiality impact, though the EPSS score of 0.02% (5th percentile) suggests minimal observed exploitation attempts. No active exploitation is confirmed; vendor patch available in version 3.2.0 released April 2026.
Remote code execution in Apache Airflow 3.1.x allows authenticated DAG Authors to execute arbitrary code in the webserver context through crafted XCom payloads exploiting insecure deserialization (CWE-502). Affects Apache Airflow versions 3.1.8 through <3.2.0. Despite CVSS 8.8, vendor rates severity as Low due to DAG Authors being highly trusted roles. No public exploit identified at time of analysis, with EPSS exploitation probability at 0.07% (21st percentile), indicating minimal real-world risk. Vendor-released patch: Apache Airflow 3.2.0.
CVE-2026-30911 is a security vulnerability (CVSS 8.1) that allows any authenticated task instance. High severity vulnerability requiring prompt remediation. Vendor patch is available.
CVE-2026-28779 is a security vulnerability (CVSS 7.5) that allows any application co-hosted under the same domain. High severity vulnerability requiring prompt remediation. Vendor patch is available.
Credential disclosure in the Apache Airflow Teradata provider (apache-airflow-providers-teradata before 3.7.0) causes cloud storage secrets to be written into SQL text that is then logged and executed, leaking those secrets to two sinks outside Airflow's control. Deployments using S3ToTeradataOperator or AzureBlobStorageToTeradataOperator against a private bucket or container with no teradata_authorization_name configured - the default credential path for both operators - are affected; S3ToTeradataOperator's runtime AWS credentials and STS session token land in the Airflow task log, readable by any user with log-view permission on the Dag, while both operators write credentials into Teradata's DBQL query logs and live monitoring views, where Airflow masking never applies and the values persist for Teradata's log retention period. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, i.e. remote but requiring an already-privileged party with log-read access, and no public exploit identified at time of analysis; impact is information disclosure only, with no integrity or availability effect.
Information disclosure in Apache Airflow's `/assets/events` REST endpoint lets an authenticated user who holds asset-read permission enumerate asset events - source Dag ID, task ID, run ID, timestamps, and total existence counts via pagination - for Dags they have no authorization to read. The endpoint applied no per-Dag readability filter, and because the same filter was missing from the count query, `total_entries` alone revealed the existence of hidden Dags. Affected deployments are apache-airflow versions prior to 3.3.2, and the exposure matters only where per-Dag access control is used to separate teams or tenants; in single-tenant deployments every user is already authorized to see all Dags, so nothing new is disclosed. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), so this is a modest-severity broken-authorization flaw rather than a high-urgency issue. Vendor-released patch: apache-airflow 3.3.2.
Principal confusion in Apache Airflow 3.3.0 and 3.3.1 causes core-API requests that carry both a `_token` session cookie and an explicit `Authorization: Bearer` (or OAuth2) credential to execute - and be recorded in the audit log - as the cookie's principal instead of the identity the client explicitly presented, inverting the intended bearer-over-cookie precedence. Exploitation is not automatic: the attacker must first plant a valid `_token` session cookie of their own into the victim's browser or client (for example by cookie tossing from a sibling subdomain, XSS in a separate application sharing the parent domain, or a shared workstation), and the victim's request must simultaneously carry an explicit credential, so only Airflow UI deployments hosted on a domain shared with other applications are reachable this way. The assessed outcome is misattributed audit records and principal confusion (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/C:N/I:L/A:N) rather than direct privilege escalation, and no public exploit code has been identified at time of analysis.
Secret exposure in Apache Airflow's Rendered Templates UI allows any authenticated user with task-level view access to read plaintext credential values that should have been masked. The secrets masker's `isinstance(str)` guard silently skips dict-typed Python objects, meaning JSON Variables accessed via `var.json` and containing dict payloads (e.g., database credentials, API keys stored as structured JSON) are rendered in cleartext rather than redacted. No public exploit is identified at time of analysis; however, the disclosure requires nothing more than standard UI navigation by a legitimately authenticated user.
Unsafe deserialization in Apache Airflow's XCom REST API allows an authenticated user with XCom write-and-read access to instantiate arbitrary `airflow.*` classes on the API server by smuggling reserved serialization keys inside JSON string literals. The `_check_forbidden_xcom_keys` guard inspected `dict`, `list`, and `tuple` types but did not attempt to JSON-decode `str` values, so a payload like `json.dumps({"__classname__": "airflow.sdk.definitions.connection.Connection"})` passed the write-time check and was later reconstructed into a live Python object when read back via `?deserialize=true`. No public exploit has been identified at time of analysis; vendor-released patch is available in apache-airflow 3.3.1.
Sensitive values stored as deeply nested lists, tuples, or sets in Apache Airflow Variables are displayed unmasked in the Variables UI due to a recursion-depth logic error in the secrets masker. This is an incomplete-fix follow-up to CVE-2026-42358: that prior fix made dictionary traversal unbounded but left list/tuple/set structures subject to the depth cutoff, allowing values beyond that depth to appear in plaintext on screen. The practical impact is narrow - any authenticated user who can see the Variable in the UI already has read access to the full value through the Variables REST API - making this a shoulder-surfing defense gap rather than an access-control bypass. No public exploit has been identified at time of analysis.
Sensitive credential exposure in Apache Airflow 3.3.0 allows an authenticated Viewer with configuration-read access to retrieve team-scoped sensitive options - including Celery broker URLs with embedded credentials - in cleartext via the Config API. The secrets masker evaluated sensitivity against raw section names without resolving team-prefixed sections (e.g., [team_a=celery]) back to their registered base section, so team-scoped overrides silently bypassed masking while equivalent global options were correctly redacted. This is a third distinct masker bypass variant following CVE-2026-48828 and CVE-2026-48892, meaning deployments that already upgraded to 3.3.0 to remediate those issues remain exposed. No public exploit identified at time of analysis.
Cleartext secret exposure in Apache Airflow's audit log affects all versions before 3.3.1, allowing any authenticated user with audit-log read access to recover Variable values and Connection `extra` credentials verbatim - without holding Variables or Connections read permissions. The bulk API endpoints (`PATCH /api/v2/variables`, `PATCH /api/v2/connections`) bypassed audit-log masking because the masker inspected only top-level request fields while bulk payloads nest entities two levels deep under `actions[].entities[]`. The Airflow UI's Import Variables action posts to this same bulk endpoint, meaning a routine operator import silently writes every secret in the uploaded file to the unmasked audit log. No public exploit is identified at time of analysis, but the vulnerability is fully exploitable by any authenticated user with log access, and deployments that upgraded to 3.3.0 in response to the related CVE-2026-50204 remain vulnerable and must upgrade again.
Cleartext exposure of list-shaped Variable secrets in Apache Airflow Task SDK (all versions before 3.3.1) allows any authenticated Airflow user to recover sensitive values directly from task execution logs and the Rendered Templates UI. The masking logic in _mask_and_deserialize_variable correctly handled string- and dict-typed JSON Variable values but contained no branch for the list type, so arrays - which may hold passwords, API tokens, or connection strings - were returned unredacted. No public exploit has been identified at time of analysis; however, organizations that patched CVE-2026-59244 remain fully exposed because that fix addressed only the dict case, and must upgrade again to 3.3.1.
Cross-team DAG authorization bypass in Apache Airflow versions prior to 3.3.1 allows authenticated users in one team to trigger DAG runs and read XCom values belonging to other teams. The asset materialization endpoint (POST /api/v2/assets/{asset_id}/materialize) and the XCom check in wait_dag_run_until_finished both passed DagDetails without resolving the DAG's team_name, causing team-aware auth managers (e.g., Keycloak) to evaluate the permission against the global DAG resource instead of the team-scoped DAG:<team> resource. This is a missing authorization flaw (CWE-862) affecting only deployments running multi-team mode with a team-aware auth manager; FAB auth manager deployments are explicitly unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-team credential access in Apache Airflow before 3.3.1 allows authenticated members of one team to invoke another team's Connection credentials through the POST /api/v2/connections/test API endpoint, exploiting a broken namespace-isolation guard in the environment-variable secrets backend. The flaw-confirmed by Apache with patches in PRs #70736 and #70902-combines a guard that only triggered on unscoped (global) requests with a regex incapable of matching team names containing underscores, even though underscores are explicitly permitted in Airflow team name validation. Exploitation requires a precise configuration alignment of multi_team mode, an explicitly enabled test_connection endpoint, and environment-variable-provisioned team secrets; no public exploit has been identified at time of analysis.
Apache Airflow REST API exposes provider secrets in plaintext through the task-instance detail and list endpoints when tasks are in a deferred state. Any authenticated user holding DAG-scoped task-instance read access - a permission commonly granted to non-admin roles - can retrieve API keys, passwords, or other secrets passed by deferred operators into trigger kwargs. Fixed in Apache Airflow 3.3.0; no public exploit code identified at time of analysis, though exploitation is trivially achievable by any authenticated user with the requisite read permission.
Sensitive credential exposure in Apache Airflow's Bulk Variables API allows authenticated users with bulk Variable read permission to retrieve plaintext values from JSON-typed variables whose key names use secret-suffixed conventions such as `*_password`, `*_token`, or `*_secret`. The redactor function was invoked without passing the variable key, so the `should_hide_value_for_key` check - which is responsible for masking secrets based on key-name patterns - could never fire for JSON-decodable variable values. This affects all deployments prior to 3.3.0 that store sensitive credentials in JSON-typed Airflow Variables under secret-suffixed key names; no public exploit has been identified at time of analysis, and exploitation is bounded by the requirement for authenticated access with a specific permission grant.
Unauthorized source code disclosure in Apache Airflow before 3.3.0 allows authenticated users to read the source of DAGs they are not authorized to, when multiple DAGs are co-located in a single source file. This bypasses per-DAG access control via the REST API endpoint GET /api/v2/dagSources/{dag_id} and the equivalent UI view. No public exploit identified, and EPSS probability is low (0.20%), mitigating immediate risk for most deployments.
Incomplete authorization filtering in Apache Airflow's `/ui/dependencies` scheduling graph endpoint exposes restricted DAG identifiers to authenticated users who lack read permission on those DAGs. The endpoint correctly filters top-level serialized DAG keys against the caller's ACL but leaks referenced DAG IDs through `dep.source` and `dep.target` fields of trigger and sensor dependency entries, enabling cross-team DAG enumeration in multi-tenant deployments. This is a residual gap from an incomplete fix for CVE-2026-28563; no public exploit has been identified at time of analysis, and a vendor patch is available in apache-airflow 3.3.0.
Apache Airflow's Config API leaks plaintext secrets-backend credentials to authenticated users with Config read permission, because per-key environment variable overrides (e.g., AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID) generate synthetic config entries whose names are absent from the sensitive_config_values masking list. Affected deployments are those that configure secrets backends such as HashiCorp Vault via these per-key environment variable patterns, exposing credentials like Vault role_id and secret_id through normal API responses. No public exploit has been identified at the time of analysis; the vendor-released fix is apache-airflow 3.3.0.
Information disclosure in Apache Airflow's GET /api/v2/connections/{connection_id} endpoint allows authenticated users with Connection-read permission to retrieve plaintext secrets from the extra JSON blob because the redaction allowlist omitted critical field names such as webhook_url, bearer, and service_key. No active exploitation or public PoC code was identified at the time of analysis; EPSS indicates very low exploitation probability (0.02%). Users should upgrade to apache-airflow 3.2.2 or later.
Session fixation and login-CSRF in apache-airflow-providers-keycloak prior to 0.7.0 allows remote attackers without prior authentication to hijack user sessions by delivering a crafted OAuth callback URL, enabling credential theft from stored Airflow connections. The vulnerability stems from missing OAuth 2.0 state parameter validation and lack of PKCE implementation, requiring only user interaction to trick victims into clicking a malicious link. EPSS score of 0.01% suggests minimal real-world exploitation despite moderate CVSS impact rating.
Apache Airflow 3.0.0 through 3.1.x fails to redact secrets stored as nested fields within JSON-formatted variables, allowing authenticated users with variable access to retrieve plaintext sensitive values. This information disclosure vulnerability affects deployments that store credentials or API keys as JSON dictionary structures in Airflow variables. The EPSS score of 0.02% and CVSS 3.7 with high attack complexity reflect limited real-world exploitation likelihood, but the vulnerability poses direct risk to organizations using JSON-structured secrets without additional access controls.
2-3 sentence plain-language synthesis. Not copy description. Start with impact, product, etc. Mention actively exploited? KEV? None. POC? Not mentioned, so
Unsafe XCom templating in Apache Airflow's documented example DAG (`example_xcom.py`) allowed an authenticated UI user with XCom modification privileges to inject arbitrary shell commands that execute on the Airflow worker node. The vulnerability exists only in deployments where operators replicated the example's pattern of directly embedding `XComArg` references via f-string interpolation into BashOperator command strings - a pattern explicitly not intended for production. No public exploit code exists, EPSS is 0.03%, and Apache itself rates the practical severity as Low, though worker-level code execution is the worst-case outcome for affected deployments.
Information disclosure in Apache Airflow 3.0.0 through 3.1.x stems from incomplete secret masking and under-documented workload-isolation and JWT-authentication assumptions, allowing sensitive credentials to surface in task logs and role boundaries to be weaker than a Deployment Manager might assume. The fix in 3.2.0 hardens the secrets masker (PR #58662) and formalizes the security model, JWT token authentication, and workload isolation guidance. No public exploit is identified and EPSS is very low (0.04%), making this a hardening/hygiene issue rather than an urgent exploited flaw.
Apache Airflow 3.0.0 through 3.1.8 discloses XCom result values to users with only DAG Run read permissions (such as Viewer role), violating the FAB RBAC model that treats XCom as a protected resource. This information disclosure affects authenticated users and allows them to access sensitive execution results they should not be able to view. The vulnerability is not confirmed as actively exploited, and a patch is available in Apache Airflow 3.2.0.
CVE-2026-28563 is a security vulnerability (CVSS 4.3) that allows an authenticated user with only dag dependencies permission. Remediation should follow standard vulnerability management procedures. Vendor patch is available.
CVE-2026-26929 is a security vulnerability (CVSS 6.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.