Topic
Apache Airflow
10 stories about Apache Airflow that passed the news check, newest first.
Security ·
CVE-2026-113508: Apache Airflow: Logout token revocation fails open; errors silently swallowed
Apache Airflow's logout endpoint tried to revoke the presented token on the server, but failures during revocation were silently ignored.
Open Source Security
Security ·
CVE-2026-111455: Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit
Apache Airflow 3.3.0 before 3.4.0 has CVE-2026-111455 in its Connections API.
Open Source Security
Security ·
CVE-2026-111454: Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read
Apache Airflow asset API endpoints returned IDs of Dags that schedule, produce, or consume an asset without checking the caller's read permission.
Open Source Security
Security ·
CVE-2026-111452: Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhookUrl) not matched against the sensitive-field list
Apache Airflow's secrets masker matched sensitive key names only in snake_case form.
Open Source Security
Security ·
CVE-2026-111395: Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline callbacks
Apache Airflow 3.2.0 before 3.4.0 did not reject reserved serialization keys inside a Dag run's conf.
Open Source Security
Security · High impact ·
CVE-2026-107474: Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext
Apache Airflow's connections API did not mask the apprise provider's `config` connection extra.
Open Source Security
Security ·
CVE-2026-101031: Apache Airflow: Shell command injection in the example_dag_decorator example Dag via an IPv6 zone identifier
Apache Airflow's shipped example_dag_decorator example Dag had a shell command injection flaw, tracked as CVE-2026-101031.
Open Source Security
Security ·
CVE-2026-96285: Apache Airflow: Scheduler: next_kwargs deserialized before the dict check, so resume data still invokes constructors
CVE-2026-96285 affects Apache Airflow 3.3.0 before 3.4.0 and is rated moderate by the source.
Open Source Security
Security · High impact ·
CVE-2026-86829: Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation
Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies.
Open Source Security
Security · High impact ·
CVE-2026-68982: Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation
Apache Airflow before 3.4.0 ran CeleryExecutor callback workloads (ExecuteCallback, used for deadline-alert callbacks) without validating the workload token.
Open Source Security