Vulnerabilities for apache-airflow-core

First version without a known vulnerability: 3.2.2

Details

• GHSA-5j6p-jrrm-6x942026-06-01

  Apache Airflow: Execution API JWT leaked via KubernetesExecutor worker command-line args

  Fixed in: 3.2.2

• GHSA-6ffj-2wg2-w45j2026-04-18

  Apache Airflow allows code execution through crafted XCom payloads

  Fixed in: 3.2.0

• GHSA-h97w-pm3w-mwmc2026-04-18

  Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions

  Fixed in: 3.2.0

• GHSA-w7cf-2pmc-5m4c2026-04-18

  Apache Airflow exposes SQL stack trace despite "api/expose_stack_traces" set to false

  Fixed in: 3.2.0

• GHSA-w9r4-94fj-xp692026-04-18

  Apache Airflow Exposes Secrets in Variables Saved as JSON Dictionaries

  Fixed in: 3.2.0