CVE-2026-45360— Apache Airflow 安全漏洞
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1195 · Supply Chain CompromiseAffected Version Matrix 1
| ベンダー | プロダクト | Version Range | ステータス |
|---|---|---|---|
| Apache Software Foundation | Apache Airflow | < 3.2.2 | affected |
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-45360の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Apache Airflow: Arbitrary import in custom deadline-reference deserialization
ソース: CVE Program / CVE List V5
脆弱性説明
Apache Airflow's scheduler-side deadline-reference decoder (`SerializedCustomReference.deserialize_reference`) imported and dispatched arbitrary class paths drawn from DAG-author-controlled serialized state without an allowlist or plugin-registry gate. A DAG author whose code reaches the scheduler — the default on single-host deployments where the DAG bundle is importable from the scheduler process — could embed a custom `DeadlineReference` whose serialized form named an attacker-controlled module path, causing the scheduler to `import_string(...)` and instantiate that class with a live SQLAlchemy session attached. Affects deployments where DAG-author code is less trusted than the scheduler process. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.
ソース: CVE Program / CVE List V5
CVSS情報
N/A
ソース: CVE Program / CVE List V5
脆弱性タイプ
可信数据的反序列化
ソース: CVE Program / CVE List V5
脆弱性タイトル
Apache Airflow 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Apache Airflow是美国阿帕奇（Apache）基金会的一套具有创建、管理和监控工作流程功能的开源平台。该平台具有可扩展和动态监控等特点。 Apache Airflow 3.2.2之前版本存在安全漏洞，该漏洞源于调度器端的序列化自定义引用反序列化器未使用白名单或插件注册表门控，可能导致DAG作者嵌入自定义DeadlineReference，其序列化形式命名攻击者控制的模块路径，导致调度器导入并实例化该类。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| Apache Software Foundation | Apache Airflow | 0 ~ 3.2.2 | - |
II. CVE-2026-45360の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-45360のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-45360 补丁与修复 (1)
CVE-2026-45360 邮件列表归档 (1)
Same Patch Batch · Apache Software Foundation · 2026-06-01 · 28 CVEs total
| CVE-2026-44825 | 8.1 HIGH | Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users |
| CVE-2026-48827 | 7.1 HIGH | Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git |
| CVE-2026-42358 | Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets | |
| CVE-2026-49328 | Apache Fesod (Incubating): Improper validation of user-supplied URLs leading to SSRF | |
| CVE-2026-49361 | Apache Fluss Netty Frame Decoder Memory Exhaustion Vulnerability | |
| CVE-2026-40861 | Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler | |
| CVE-2026-40961 | Apache Airflow: Open Redirect Bypass Vulnerability | |
| CVE-2026-40963 | Apache Airflow: DAG authorization bypass on /ui/structure/structure_data | |
| CVE-2026-41014 | Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints | |
| CVE-2026-49267 | Apache Airflow: No certificate validation on SMTP STARTTLS connections | |
| CVE-2026-41017 | Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-termin | |
| CVE-2026-41084 | Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation | |
| CVE-2026-42252 | Apache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user patter | |
| CVE-2026-42360 | Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking | |
| CVE-2026-45192 | Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response | |
| CVE-2026-42359 | Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDD | |
| CVE-2026-45426 | Apache Airflow: Log server JWT authorization bypass via Python lstrip() character strippin | |
| CVE-2026-46764 | Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter | |
| CVE-2026-48726 | Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout | |
| CVE-2026-49298 | Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments |
Showing 20 of 28 CVEs. View all on vendor page →
IV. 関連脆弱性
同じ製品: Apache Airflow
- CVE-2026-59244
Apache Airflow: Secrets masker: `var.json` Variable values n - CVE-2026-58076
Apache Airflow: Unguarded import_string() of airflow_exc_ser - CVE-2026-59242
Apache Airflow: Arbitrary airflow.* class instantiation on t - CVE-2026-54183
Apache Airflow: Airflow Variables were not masked in the UI - CVE-2026-67260
Apache Airflow: DAG-author remote code execution on the Sche
同じベンダー: Apache Software Foundation
- CVE-2026-34884
Apache SkyWalking MCP: SSRF via set_skywalking_url Tool and - CVE-2026-73632
Apache Struts: Shared serialization state in the JSON plugin - CVE-2026-73631
Apache Struts: Shared parsing state in the JSON plugin - CVE-2026-73635
Apache Struts: Unbounded growth of localized-text caches dri - CVE-2026-73634
Apache Struts: Unbounded read of a Content Security Policy v
同じ弱点: CWE-502
- CVE-2026-16138
Remote code execution via unsafe deserialization in Progress - CVE-2024-13784
Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= - CVE-2026-10035
Turnkey bbPress by WeaverTheme <= 1.7.1 - Authenticated (Adm - CVE-2026-16099
Podlove Podcast Publisher <= 4.5.3 - Authenticated (Contribu - CVE-2025-7639
AVEVA Enterprise SCADA Deserialization of Untrusted Data
V. CVE-2026-45360へのコメント
まだコメントはありません