© 2025-2026 PySpect
No release of apache-airflow is currently known to be free of vulnerabilities.
Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level matched neither and was returned unmasked. Any authenticated user able to read the logs or rendered templates of a task that references such a Variable could recover the values, with no special configuration required. This is the list-shaped counterpart of CVE-2026-59244, whose fix covered the dict case only, so deployments that upgraded in response to that advisory remain affected and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later.
Fixed in: 3.3.1
Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`). The audit-log masking recognised only top-level request fields, and a bulk request nests its entities two levels below, so no masking was applied to them. Any authenticated user with audit-log read access -- who need not hold Variables or Connections read at all -- could recover those secrets verbatim, and the Connection `extra` copy is stored unencrypted in the log while the connection table encrypts it. The Airflow UI's *Import Variables* action posts to this endpoint, so an ordinary operator import wrote every secret in the file to the log. This is a different code path from CVE-2026-50204: that fix shipped in 3.3.0 and covers the single-entity endpoints only, so deployments that upgraded in response to that advisory remain affected and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later.
Fixed in: 3.3.1
Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse. The authorization dependency parsed it with `int()` while the route handler parsed it as pydantic's `NonNegativeInt`, which accepts values `int()` rejects (`1.0` coerces to `1`); FastAPI resolves dependencies before endpoint validation, so the two acted on different Dags. An authenticated user holding edit permission on any single Dag could therefore read, pause and cancel backfills belonging to any other Dag, including moving another Dag's queued runs to `failed`. No non-default configuration is required and backfill ids are sequential, so finding a target is trivial. Users are advised to upgrade to apache-airflow 3.3.1 or later, which parses the backfill id with the same type the routes declare.
Fixed in: 3.3.1
Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are allowed to contain. When the guard did not apply, the lookup fell through to an unconditional global read that resolved the stored `AIRFLOW_CONN__<TEAM>___<ID>` variable regardless of which team asked. In multi-team mode an authenticated user of one team could therefore have `POST /api/v2/connections/test` resolve another team's Connection and authenticate outward with that team's credentials; the endpoint uses the credentials rather than returning them. Exploitation requires `[core] multi_team` enabled, `[core] test_connection` set to `Enabled` (it ships `Disabled`), team-scoped secrets provisioned as environment variables in the API-server process, and knowledge of the encoded identifier. Redirecting the test at an attacker-controlled host is separately blocked. Users are advised to upgrade to apache-airflow 3.3.1 or later.
Fixed in: 3.3.1
Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncCallback` is itself an Airflow class it passes the default `allowed_deserialization_classes` allow-list, so tightening that setting does not help. A Dag author — who controls a task instance's `next_kwargs` through the task execution API — can therefore cause an arbitrary module to be imported inside the scheduler process, when the scheduler's `awaiting_input` timeout sweep deserializes that value. No non-default configuration is required; the sweep runs unconditionally. Versions before 3.3.0 are not affected: the class existed, but the scheduler sweep that reaches it did not. This is a separate code path from CVE-2026-58076 and CVE-2026-67260, which cover different gadgets reaching deserialization — applying either of those fixes does not address this one. Users are advised to upgrade to apache-airflow 3.3.1 or later.
Fixed in: 3.3.1
Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job. No non-default configuration is required: the sweep runs unconditionally every 15 seconds, and the default `allowed_deserialization_classes` setting does not cover this code path. Versions before 3.3.0 are not affected, because human-in-the-loop tasks deferred onto the triggerer instead. This is a different code path from CVE-2026-58076, which covers the same unguarded exception-node deserialization reached elsewhere — deployments that applied that fix must upgrade for this issue as well. Users are advised to upgrade to apache-airflow 3.3.1 or later.
Fixed in: 3.3.1
Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.
Fixed in: 3.3.1
Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was shown unmasked in the Variables UI. The exposure is limited to the UI: any authenticated user who can see the Variable in the UI can already read its full value through the Variables REST API, so this does not disclose data the user could not otherwise obtain — the masking is a shoulder-surfing defense for the UI, not an access-control boundary.
Fixed in: 3.3.1
Apache Airflow exposes deferred trigger kwargs in task-instance API responses
Fixed in: 3.3.0
apache-airflow DAG source authorization bypass exposes co-located DAG source
Fixed in: 3.3.0
Apache Airflow allows code execution through unsafe serialized DAG deserialization
Fixed in: 3.3.0
Apache Airflow exposes unreadable DAG identifiers in the scheduling dependencies graph
Fixed in: 3.3.0
Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API
Fixed in: 3.3.0
Apache Airflow exposes secrets backend credentials through the Config API
Fixed in: 3.3.0
Apache Airflow has no certificate validation on SMTP STARTTLS connections
Fixed in: 3.2.2
Apache Airflow has an Authorization Bypass Through User-Controlled Key
Fixed in: 3.2.2
Apache Airflow: Auth manager doesn't invalidate JWT tokens after users click logout
Fixed in: 3.2.2
Apache Airflow Vulnerable to Deserialization of Untrusted Data
Fixed in: 3.2.2
Apache Airflow Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Fixed in: 3.2.2
Apache Airflow vulnerable to Improper Neutralization of Special Elements Used in a Template Engine
Fixed in: 3.2.2
Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Fixed in: 3.2.2
Apache Airflow Vulnerable to Authorization Bypass Through User-Controlled Key
Fixed in: 3.2.2
Apache Airflow has a Deserialization of Untrusted Data vulnerability
Fixed in: 3.2.2
Apache Airflow has an Incorrect Authorization issue
Fixed in: 3.2.2
Apache Airflow: Authenticated users can bypass the `is_safe_url` check
Fixed in: 3.2.2
Apache Airflow has a Link Following issue
Fixed in: 3.2.2
Apache Airflow has a Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Fixed in: 3.2.2
Apache Airflow has an Improper Authorization issue
Fixed in: 3.2.2
Apache Airflow has a Missing Authorization issue
Fixed in: 3.2.2
Apache Airflow: Incomplete redaction allowlist exposes secrets in Connection `extra` to read-permitted users
Fixed in: 3.2.2
Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance record
Fixed in: 3.2.1rc1
Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions
Fixed in: 3.2.1rc1
Apache Airflow Exposes Secrets in Variables Saved as JSON Dictionaries
Fixed in: 3.2.0
In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.
Fixed in: 3.2.0
Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low.
Fixed in: 3.2.0
Apache Airflow: JWT token appearing in logs
Fixed in: 3.2.0
Apache Airflow: RCE by race condition in example_xcom dag
Fixed in: 3.2.0
Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access
Fixed in: 3.1.8
Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API
Fixed in: 3.2.0
Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI
Fixed in: 3.2.0
Apache Airflow: JWT token still valid after logout
Fixed in: 3.2.0
Apache Airflow has an authorization bypass in DagRun wait endpoint
Fixed in: 3.2.0
Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange
Fixed in: 1.12.0
Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications
Fixed in: 3.1.8
Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization
Fixed in: 3.1.8
Apache Airflow: DAG authorization bypass
Fixed in: 3.1.8
Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata
Fixed in: 3.1.8
Apache Airflow exposes sensitive information in its log files
Fixed in: 2.11.1
Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate table
Fixed in: 2.11.1
Apache Airflow error reporting may expose full kwargs
Fixed in: 2.11.1, 3.1.5rc1
Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated Users
Fixed in: 3.1.7
Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access
Fixed in: 3.1.7
Apache Airflow secrets in rendered templates could contain parts of sensitive values when truncated
Fixed in: 3.1.6
Apache Airflow proxy credentials for various providers might leak in task logs
Fixed in: 3.1.6, 2.11.1
Edge3 Worker RPC RCE on Airflow 2.
Fixed in: 2.0.0
Apache Airflow exposes secret values to authenticated UI users via rendered templates
Fixed in: 3.1.5, 3.1.4
Apache Airflow `/api/v2/dagReports` executes DAG Python in API
Fixed in: 3.1.1
Apache Airflow's create action can upsert existing Pools/Connections/Variables
Fixed in: 3.1.1
Apache Airflow has a command injection vulnerability in "example_dag_decorator"
Fixed in: 3.0.5
Apache Airflow: Connection sensitive details exposed to users with READ permissions
Fixed in: 3.0.4
Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG authors to unintentionally or intentionally log sensitive configuration variables. Unauthorized users could access these logs, potentially exposing critical data that could be exploited to compromise the security of the Airflow deployment. In version 2.10.3, secrets are now masked in task logs to prevent sensitive configuration variables from being exposed in the logging output. Users should upgrade to Airflow 2.10.3 or the latest version to eliminate this vulnerability. If you suspect that DAG authors could have logged the secret values to the logs and that your logs are not additionally protected, it is also recommended that you update those secrets.
Fixed in: 2.10.3
Apache Airflow vulnerable to Insertion of Sensitive Information Into Sent Data
Fixed in: 2.10.3
Apache Airflow vulnerable to Execution with Unnecessary Privileges
Fixed in: 2.10.1
Apache Airflow vulnerable to Improper Encoding or Escaping of Output
Fixed in: 2.10.1
Apache Airflow Cross-site Scripting Vulnerability
Fixed in: 2.10.0
Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB.
Apache Airflow has DAG Author Code Execution possibility in airflow-scheduler
Fixed in: 2.9.3
Apache Airflow Potential Cross-site Scripting Vulnerability
Fixed in: 2.9.3
Apache Airflow does not return the "Cache-Control" header for dynamic content
Fixed in: 2.9.2
Apache Airflow: XSS vulnerability in Task Instance Log/Log Details
Fixed in: 2.9.1
Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used
Fixed in: 2.9.0
Apache Airflow Improper Preservation of Permissions vulnerability
Fixed in: 2.8.4
Apache Airflow: Ignored Airflow Permission
Fixed in: 2.8.3rc1
Apache Airflow: Incorrect Default Permissions in audit logs for Ops and Viewers users
Fixed in: 2.8.2
Apache Airflow: DAG Code and Import Error Permissions Ignored
Fixed in: 2.8.2
Apache Airflow: pickle deserialization vulnerability in XComs
Fixed in: 2.8.1rc1, 2.8.1
Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service
Fixed in: 2.6.1, 7.0.0
Apache Airflow: Bypass permission verification to read code of other dags
Fixed in: 2.8.1rc1, 2.8.1
Apache Airflow Improper Access Control vulnerability
Fixed in: 2.8.0
Apache Airflow Cross-Site Request Forgery vulnerability
Fixed in: 2.8.0, 2.8.0b1
Apache Airflow vulnerable to Exposure of Resource to Wrong Sphere
Fixed in: 2.8.0
Apache Airflow has a stored cross-site scripting vulnerability
Fixed in: 2.8.0b1
Apache Airflow allows authenticated and DAG-view authorized users to modify some DAG run detail values when submitting notes
Fixed in: 2.7.3
Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Fixed in: 2.7.3
Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerability
Fixed in: 3.4.1, 2.7.0
Apache Airflow vulnerable to Exposure of Sensitive Information
Fixed in: 2.7.2, 2.7.0
Apache Airflow vulnerable to sensitive information exposure
Fixed in: 2.7.2
Apache Airflow vulnerable to sensitive information exposure when users list warnings for all DAGs
Fixed in: 2.7.2
Apache Airflow vulnerable to sensitive information exposure when expose-config is set to non-sensitive-only
Fixed in: 2.7.2
Apache Airflow vulnerable to privilege escalation
Fixed in: 2.7.2
Apache Airflow information exposure vulnerability
Fixed in: 2.7.1
Apache Airflow Incorrect Authorization vulnerability
Fixed in: 2.7.1
Apache Airflow missing Certificate Validation
Fixed in: 1.3.0, 3.3.0, 2.7.0
Apache Airflow Session Fixation vulnerability
Fixed in: 2.7.0rc2, 2.7.1rc1
Apache Airflow denial of service vulnerability
Fixed in: 2.7.0b1, 2.7.0
Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.
Fixed in: 2.4.3
Apache Airflow Execution with Unnecessary Privileges
Fixed in: 2.6.0b1, 2.6.0
Apache Airflow Incorrect Authorization vulnerability
Fixed in: 2.6.3
Apache Airflow Improper Input Validation vulnerability
Fixed in: 2.6.3
Apache Airflow Improper Input Validation vulnerability
Fixed in: 2.6.3
Apache Airflow Path Traversal vulnerability
Fixed in: 2.6.3
Apache Airflow information disclosure vulnerability
Fixed in: 2.6.3
Apache Airflow vulnerable to exposure of sensitive information
Fixed in: 2.6.2rc1, 2.6.2
Apache Airflow vulnerable to Privilege Context Switching Error
Fixed in: 2.6.0b1, 2.6.0
Apache Airflow vulnerable to stored Cross-site Scripting
Fixed in: 2.6.0
Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.This issue affects Apache Airflow Drill Provider: before 2.3.2.
Fixed in: 2.3.2
Sensitive Information in Error Messages in Apache Airflow
Fixed in: 2.5.2rc1, 2.5.2
Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider.
Fixed in: 3.1.1
Command Injection in Apache Airflow and Apache Airflow MySQL Provider
Fixed in: 2.5.1, 4.0.0
OS Command Injection in Apache Airflow
Fixed in: 2.3.0
OS Command Injection in Apache Airflow
Fixed in: 2.3.0
OS Command Injection in Apache Airflow
Fixed in: 2.3.0
Apache Airflow Contains Open Redirect
Fixed in: 2.4.3
Apache Airflow vulnerable to OS Command Injection via example DAGs
Fixed in: 2.4.0
Apache Airflow subject to Exposure of Sensitive Information
Fixed in: 2.3.1
Apache Airflow Cross-site Scripting vulnerability
Fixed in: 2.4.2rc1, 2.4.2
Apache Airflow Open Redirect vulnerability
Fixed in: 2.4.2rc1, 2.4.2
Apache Airflow may allow authenticated users who have been deactivated to continue using the UI or API
Fixed in: 2.4.1rc1, 2.4.2rc1
Apache Airflow vulnerable to Use of Externally-Controlled Format String
Fixed in: 2.4.0rc1, 2.4.0b1
Apache Airflow contains open redirect
Fixed in: 2.4.0rc1, 2.4.0b1
Apache Airflow Session Fixation vulnerability
Fixed in: 2.3.4rc1
Apache Airflow exposes arbitrary file content
Fixed in: 2.3.4
Missing Authentication for Critical Function in Apache Airflow
Fixed in: 2.1.3
Apache Airflow Reflected Cross-site Scripting vulnerability in 404 Endpoint
Fixed in: 1.9.0
Apache Airflow Cross-site Scripting Vulnerability
Fixed in: 2.2.4rc1
OS Command injection in Apache Airflow
Fixed in: 2.2.4
Improper Privilege Management in apache-airflow
Fixed in: 2.2.0, 2.0.0b1
Missing Authorization in Apache Airflow
Fixed in: 2.1.2
Cross-site Scripting in Apache Airflow
Fixed in: 1.10.15, 2.0.2
Improper Authentication in Apache Airflow
Fixed in: 2.0.1rc1, 2.0.1
Apache Airflow Cross-site Scripting
Fixed in: 1.10.12
Authentication bypass in Apache Airflow
Fixed in: 1.10.11
Incorrect Session Validation in Apache Airflow
Fixed in: 1.10.14
Apache Airflow cross-site scripting due to incomplete fix for CVE-2020-13944
Fixed in: 1.10.15rc1, 2.0.2rc1, 1.10.13
Improper Access Control in Apache Airflow
Fixed in: 2.0.1rc1, 2.0.1
SSRF vulnerability in Apache Airflow
Fixed in: 1.10.13
Apache Airflow logs passwords in plaintext
Fixed in: 1.10.13
Stored XSS in Apache Airflow
Fixed in: 1.10.11, 1.10.11rc1
Command injection via Celery broker in Apache Airflow
Fixed in: 1.10.11rc1
Insecure default config of Celery worker in Apache Airflow
Fixed in: 1.10.11, 1.10.11rc1
Remote code execution (RCE) in Apache Airflow
Fixed in: 1.10.11rc1
Multiple stored XSS in RBAC Admin screens in Apache Airflow
Fixed in: 1.10.11, 1.10.11rc1
XSS in Apache Airflow
Fixed in: 1.10.5
A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process.
Fixed in: 1.10.6rc1
Apache Airflow vulnerable to CSRF Attacks
Fixed in: 1.10.3, 1.10.3b1
Apache Airflow vulnerable to Stored XSS
Fixed in: 1.10.3, 1.10.3b1
Apache Airflow vulnerable to Stored XSS
Fixed in: 1.10.2
Improper Certificate Validation in Apache Airflow
Fixed in: 1.10.1
Cross-Site Request Forgery (CSRF) in Apache Airflow
Fixed in: 1.9.0
Apache Airflow vulnerable to XSS
Fixed in: 1.9.0
Improper Input Validation in Apache Airflow resulting in Remote Code Execution
Fixed in: 1.9.0