Apache Airflow vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
167 matching records
- Medium4.6User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.Check if you run itEPSS 0.43%Oct 30, 2025
- Medium6.5Apache Airflow 3 introduced a change to the handling of sensitive information in Connections.Check if you run itEPSS 0.94%Sep 26, 2025
- Critical9.1dag-factory is a library for Apache Airflow® to construct DAGs declaratively via configuration files.Check if you run itEPSS 0.76%Jul 26, 2025
- High7.5Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs.Check if you run itEPSS 1.34%Nov 15, 2024
- Medium4.9Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see.Check if you run itEPSS 1.24%Nov 8, 2024
- High8.8Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger pe…Check if you run itEPSS 1.24%Sep 7, 2024
- High8.8Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where…Check if you run itEPSS 1.69%Sep 7, 2024
- Medium6.1Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking o…Check if you run itEPSS 1.73%Aug 21, 2024
- Critical9.8Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB.Check if you run itEPSS 0.93%Aug 5, 2024
- High8.8Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbi…Check if you run itEPSS 1.73%Jul 17, 2024
- Medium5.4Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider.Check if you run itEPSS 1.00%Jul 17, 2024
- Medium5.5Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow.Check if you run itEPSS 0.32%Jun 14, 2024
- Medium5.4Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs.Check if you run itEPSS 1.57%May 14, 2024
- Medium4.3CVE-2024-31869 is listed by inventory_high.Check if you run itEPSS 1.06%Apr 18, 2024
- Medium5.3Improper Preservation of Permissions vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.8.2 through 2.8.3.Check if you run itEPSS 1.46%Mar 26, 2024
- High8.1Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, con…Check if you run itEPSS 1.34%Mar 14, 2024
- Medium4.7Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names a…Check if you run itEPSS 1.86%Mar 1, 2024
- Medium5.9Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to vi…Check if you run itEPSS 0.34%Feb 29, 2024
- Medium6.5Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration f…Check if you run itEPSS 0.39%Jan 24, 2024
- Medium6.5Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access.Check if you run itEPSS 0.98%Jan 24, 2024
- High7.5Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enable_xcom_pickli…Check if you run itEPSS 1.22%Jan 24, 2024
- Medium6.5Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable.Check if you run itEPSS 1.39%Dec 21, 2023
- Medium6.5Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation.Check if you run itEPSS 1.03%Dec 21, 2023
- Medium4.3CVE-2023-48291 is listed by inventory_high.Check if you run itEPSS 1.80%Dec 21, 2023
- Medium5.4Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter…Check if you run itEPSS 1.34%Dec 21, 2023