Topic
Apache
3 stories about Apache that passed the news check, newest first.
Security ·
CVE-2026-111453: Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag_id query value but deletes rows for every readable Dag
The asset queuedEvents DELETE API endpoint checked Dag edit permission against the dag_id query parameter.
Open Source Security
Security ·
CVE-2026-111421: Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow.* classes on the API server
Apache Airflow's Task Execution API stored task-written XCom values without the reserved-key check that is applied elsewhere.
Open Source Security
Security ·
CVE-2026-40913: Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcement
Apache Airflow's public Import Errors API returns raw DAG parse-failure stack traces to users holding the ImportError.can_read permission when the failing file lacks complete per-file RBAC enforcement.
Open Source Security