Topic
Airflow
5 stories about Airflow that passed the news check, newest first.
Security ·
CVE-2026-113504: Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext
Apache Airflow's secrets masker stops descending into nested structures after five levels.
Open Source Security
Security ·
CVE-2026-111453: Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag_id query value but deletes rows for every readable Dag
The asset queuedEvents DELETE API endpoint checked Dag edit permission against the dag_id query parameter.
Open Source Security
Security ·
CVE-2026-111421: Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow.* classes on the API server
Apache Airflow's Task Execution API stored task-written XCom values without the reserved-key check that is applied elsewhere.
Open Source Security
Security ·
CVE-2026-50204: Apache Airflow: Audit-log secrets masker redacts by key name only, persisting connection and Variable secrets in cleartext
Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the Log.extra column.
Open Source Security
Security ·
CVE-2026-40913: Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcement
Apache Airflow's public Import Errors API returns raw DAG parse-failure stack traces to users holding the ImportError.can_read permission when the failing file lacks complete per-file RBAC enforcement.
Open Source Security