Apache Airflow vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
167 matching records
- UnknownApache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it.Check if you run itEPSS 0.26%Oct 20, 2026
- UnknownApache Airflow SFTP provider: Async SFTP hook disables host-key verification by defaultCheck if you run itEPSS 0.38%Oct 15, 2026
- MediumApache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement tokenCheck if you run itEPSS 0.37%Oct 15, 2026
- UnknownApache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by defaultCheck if you run itEPSS 0.60%Oct 15, 2026
- UnknownThe Apache Airflow Keycloak provider's multi-team provisioning ( ) granted every team role global read access to audit logs.Check if you run itEPSS 0.26%Oct 15, 2026
- Medium4.2When a request to the Airflow core API carries both a session cookie and an explicit token, Airflow resolves the caller from the cookie and ignores the bearer token, i…Check if you run itEPSS 0.73%Sep 21, 2026
- Medium4.3Apache Airflow's API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read.Check if you run itEPSS 0.64%Sep 21, 2026
- Critical9.1Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie.Check if you run itEPSS 0.75%Sep 21, 2026
- Medium6.5Apache Airflow's asset materialization endpoint ( ) and the XCom result check on authorized the target Dag without its team, unlike every other authorization site.Check if you run itEPSS 0.33%Aug 12, 2026
- Medium6.5CVE-2026-68970 is listed by inventory_high.Check if you run itEPSS 0.23%Aug 12, 2026
- Medium6.5CVE-2026-68969 is listed by inventory_high.Check if you run itEPSS 0.36%Aug 12, 2026
- High7.5Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the path segment failed to parse.Check if you run itEPSS 0.42%Aug 12, 2026
- Medium5.4Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope.Check if you run itEPSS 0.34%Aug 12, 2026
- High8.8CVE-2026-67587 is listed by Apache Airflow's Task SDK rebuilt a object from serialized data by re-running its constructor, which imports the module named by the stored…Check if you run itEPSS 0.61%Aug 12, 2026
- High7.3CVE-2026-67260 is listed by Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new task state swept by the scheduler..Check if you run itEPSS 0.78%Aug 12, 2026
- Medium6.5CVE-2026-65017 is listed by Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments..Check if you run itEPSS 0.39%Aug 12, 2026
- Medium6.5Apache Airflow's secrets masker did not mask Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an guard — so a secret stored a…Check if you run itEPSS 0.23%Aug 12, 2026
- Medium5.4Apache Airflow's XCom endpoint passed a string-literal payload through without the guard, allowing an authenticated API user with XCom write-and-read access to instant…Check if you run itEPSS 0.53%Aug 12, 2026
- High8.8CVE-2026-58076 is listed by inventory_high.Check if you run itEPSS 0.48%Aug 12, 2026
- Medium4.3CVE-2026-54183 is listed by Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI..Check if you run itEPSS 0.42%Aug 12, 2026
- Medium6.5In Apache Airflow before 3.3.0, the REST API task-instance detail and list endpoints returned a deferred task's trigger kwargs without masking.Check if you run itEPSS 0.66%Jul 7, 2026
- Medium6.5Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file.Check if you run itEPSS 0.60%Jul 7, 2026
- Medium6.5The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like and ) as synthetic config options whose option names were not i…Check if you run itEPSS 0.66%Jul 7, 2026
- Medium4.3A bug in Apache Airflow's scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs t…Check if you run itEPSS 0.64%Jul 7, 2026
- Medium6.5The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based check (which triggers on secret-suffixed key names li…Check if you run itEPSS 0.66%Jul 7, 2026