Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Apache Airflow — Vulnerabilities & Security Advisories 146

All 146 CVE vulnerabilities found in Apache Airflow, with AI-generated Chinese analysis, references, and POCs.

This page documents security weaknesses associated with the Apache Airflow workflow orchestration tool, categorized under common vulnerability types and industry-standard tags. It aggregates a comprehensive collection of identified security flaws, including those related to authentication bypass, insecure configuration, and remote code execution risks. The data spans from the initial public release of the software through the most recent updates, ensuring a historical perspective on the product's security posture over time. Visitors to this page can effectively track vendor advisories and official patch releases to stay informed about critical fixes as they are issued. Additionally, users can gain a deeper understanding of specific weakness classes affecting the platform, analyzing how particular defect categories manifest within its architecture. The resource also allows for a detailed lookup of the product’s vulnerability history, enabling security professionals to review past incidents and assess the evolution of risk over various versions. This structured approach supports informed decision-making for system administrators and DevOps engineers responsible for maintaining secure deployment environments. By consolidating these data points, the page serves as a central reference for evaluating the ongoing security health of Apache Airflow installations. It facilitates proactive risk management by highlighting trends and recurring issues that may require immediate attention or mitigation strategies. The information provided is intended solely for technical assessment and does not constitute professional security advice. Users are encouraged to cross-reference this data with official documentation and community reports for the most accurate and timely guidance.

Vendor: Apache Software Foundation

CVE IDTitleCVSSSeverityPublished
CVE-2026-59244 Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI CWE-312--2026-08-12
CVE-2026-58076 Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server CWE-502--2026-08-12
CVE-2026-59242 Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint CWE-502--2026-08-12
CVE-2026-54183 Apache Airflow: Airflow Variables were not masked in the UI for authenticated users CWE-200--2026-08-12
CVE-2026-67260 Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization CWE-502--2026-08-12
CVE-2026-67587 Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget CWE-502--2026-08-12
CVE-2026-65017 Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass) CWE-200--2026-08-12
CVE-2026-68968 Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id CWE-436--2026-08-12
CVE-2026-68969 Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext CWE-532--2026-08-12
CVE-2026-68970 Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI CWE-312--2026-08-12
CVE-2026-68971 Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints CWE-862--2026-08-12
CVE-2026-68076 Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection CWE-639--2026-08-12
CVE-2026-33264 Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize() CWE-502--2026-07-07
CVE-2026-49487 Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs CWE-200--2026-07-07
CVE-2026-48828 Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key CWE-200--2026-07-07
CVE-2026-49296 Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id} CWE-639--2026-07-07
CVE-2026-48891 Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target CWE-200--2026-07-07
CVE-2026-48892 Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options CWE-200--2026-07-07
CVE-2026-40861 Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler CWE-59--2026-06-01
CVE-2026-40961 Apache Airflow: Open Redirect Bypass Vulnerability CWE-601--2026-06-01
CVE-2026-40963 Apache Airflow: DAG authorization bypass on /ui/structure/structure_data CWE-285--2026-06-01
CVE-2026-41014 Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints CWE-862--2026-06-01
CVE-2026-49267 Apache Airflow: No certificate validation on SMTP STARTTLS connections CWE-295--2026-06-01
CVE-2026-41017 Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy CWE-614--2026-06-01
CVE-2026-41084 Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation CWE-639--2026-06-01
CVE-2026-42252 Apache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern CWE-1336--2026-06-01
CVE-2026-42360 Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking CWE-200--2026-06-01
CVE-2026-42358 Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets CWE-200--2026-06-01
CVE-2026-42359 Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator CWE-502--2026-06-01
CVE-2026-45360 Apache Airflow: Arbitrary import in custom deadline-reference deserialization CWE-502--2026-06-01

All 146 known CVE vulnerabilities affecting Apache Airflow with full Chinese analysis, references, and POCs where available.