Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Apache Airflow — Vulnerabilities & Security Advisories 146

All 146 CVE vulnerabilities found in Apache Airflow, with AI-generated Chinese analysis, references, and POCs.

This page documents security weaknesses associated with the Apache Airflow workflow orchestration tool, categorized under common vulnerability types and industry-standard tags. It aggregates a comprehensive collection of identified security flaws, including those related to authentication bypass, insecure configuration, and remote code execution risks. The data spans from the initial public release of the software through the most recent updates, ensuring a historical perspective on the product's security posture over time. Visitors to this page can effectively track vendor advisories and official patch releases to stay informed about critical fixes as they are issued. Additionally, users can gain a deeper understanding of specific weakness classes affecting the platform, analyzing how particular defect categories manifest within its architecture. The resource also allows for a detailed lookup of the product’s vulnerability history, enabling security professionals to review past incidents and assess the evolution of risk over various versions. This structured approach supports informed decision-making for system administrators and DevOps engineers responsible for maintaining secure deployment environments. By consolidating these data points, the page serves as a central reference for evaluating the ongoing security health of Apache Airflow installations. It facilitates proactive risk management by highlighting trends and recurring issues that may require immediate attention or mitigation strategies. The information provided is intended solely for technical assessment and does not constitute professional security advice. Users are encouraged to cross-reference this data with official documentation and community reports for the most accurate and timely guidance.

Vendor: Apache Software Foundation

CVE ID Title CVSS Severity Published
CVE-2023-45348 Apache Airflow: Configuration information leakage vulnerability CWE-200 4.3 - 2023-10-14
CVE-2023-42780 Apache Airflow: Improper access control vulnerability in the "List dag warnings" feature CWE-200 4.3 - 2023-10-14
CVE-2023-40712 Apache Airflow: Secrets can be unmasked in the "Rendered Template" CWE-200 4.3 - 2023-09-12
CVE-2023-40611 Apache Airflow Dag Runs Broken Access Control Vulnerability CWE-863 7.1 - 2023-09-12
CVE-2023-37379 Apache Airflow: Exposure of sensitive connection information, DOS and SSRF on "test connection" feature CWE-400 8.1 - 2023-08-23
CVE-2023-40273 Session fixation in Apache Airflow web interface CWE-384 8.8 - 2023-08-23
CVE-2023-39508 Apache Airflow: Airflow "Run task" feature allows execution with unnecessary priviledges CWE-250 8.8 - 2023-08-05
CVE-2023-22888 Apache Airflow: Scheduler remote DoS CWE-20 6.5 - 2023-07-12
CVE-2023-36543 Apache Airflow: ReDoS via dags function CWE-1333 6.5 - 2023-07-12
CVE-2022-46651 Apache Airflow: Security vulnerability on AirFlow Connections CWE-200 6.5 - 2023-07-12
CVE-2023-22887 Apache Airflow path traversal by authenticated user CWE-22 6.5 - 2023-07-12
CVE-2023-35908 Apache Airflow: Access to DAGs without relevant permission CWE-863 5.3 - 2023-07-12
CVE-2023-35005 Apache Airflow: Information disclosure on configuration view CWE-200 7.5 - 2023-06-19
CVE-2023-25754 Apache Airflow: Privilege escalation using airflow logs CWE-270 7.5 - 2023-05-08
CVE-2023-29247 Stored XSS on Apache Airflow CWE-79 6.1 - 2023-05-08
CVE-2023-25695 Information disclosure in Apache Airflow CWE-209 5.3 - 2023-03-15
CVE-2023-22884 Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow CWE-77 9.8 - 2023-01-21
CVE-2022-45402 Apache Airflow: Open redirect during login CWE-601 6.1 - 2022-11-15
CVE-2022-27949 Apache Airflow prior to 2.3.1 may include sensitive values in rendered template CWE-200 7.5 - 2022-11-14
CVE-2022-40127 Apache Airflow <2.4.0 has an RCE in a bash example CWE-94 8.8 - 2022-11-14
CVE-2022-43982 Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL CWE-79 6.1 - 2022-11-02
CVE-2022-43985 Apache Airflow prior to 2.4.2 has an open redirect CWE-601 6.1 - 2022-11-02
CVE-2022-41672 Session still functional after user is deactivated CWE-613 8.1 - 2022-10-07
CVE-2022-40754 Open Redirect CWE-601 6.1 - 2022-09-21
CVE-2022-40604 Format String Vulnerability CWE-134 7.5 - 2022-09-21
CVE-2022-38054 Session Fixation CWE-384 9.8 - 2022-09-02
CVE-2022-38170 Overly permissive umask for daemons 4.7 - 2022-09-02
CVE-2022-38362 Docker Provider <3.0 RCE vulnerability in example dag 8.8 - 2022-08-16
CVE-2022-24288 Apache Airflow: RCE in example DAGs CWE-78 8.8 - 2022-02-25
CVE-2021-45229 Apache Airflow: Reflected XSS via Origin Query Argument in URL CWE-79 6.1 - 2022-02-25

All 146 known CVE vulnerabilities affecting Apache Airflow with full Chinese analysis, references, and POCs where available.