apache-airflow vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-68970Mediumapache-airflow: Apache Airflow Task SDK fails to mask list-shaped JSON Variables CVE-2026-68969Mediumapache-airflow: Apache Airflow bulk endpoints log Variable and Connection secrets in cleartext CVE-2026-68971Mediumapache-airflow: Apache Airflow missing team context permits cross-team Dag actions and XCom reads CVE-2026-67260Highapache-airflow: Apache Airflow scheduler unsafely deserializes human-in-the-loop task next_kwargs CVE-2026-59242Mediumapache-airflow: Apache Airflow XCom API permits unsafe deserialization through JSON string literals CVE-2026-67587Highapache-airflow: Apache Airflow Task SDK Callback deserialization can import arbitrary modules in the scheduler CVE-2026-54183Mediumapache-airflow: Apache Airflow Variables UI fails to mask sensitive values in deeply nested iterables CVE-2026-65017Mediumapache-airflow: Apache Airflow Config API exposes team-scoped sensitive configuration values CVE-2026-68076Mediumapache-airflow: Apache Airflow environment-variable secrets backend permits cross-team credential use CVE-2026-68968Highapache-airflow: Apache Airflow Backfill API parser discrepancy permits cross-DAG authorization bypass CVE-2026-59244Mediumapache-airflow: Apache Airflow exposes dict-valued var.json secrets in Rendered Templates CVE-2026-58076Highapache-airflow: Apache Airflow exception-node deserialization permits arbitrary callable execution CVE-2026-49296Mediumapache-airflow: apache-airflow DAG source authorization bypass exposes co-located DAG source CVE-2026-49487Mediumapache-airflow: Apache Airflow exposes deferred trigger kwargs in task-instance API responses CVE-2026-33264Criticalapache-airflow: Apache Airflow allows code execution through unsafe serialized DAG deserialization CVE-2026-48892Mediumapache-airflow: Apache Airflow exposes secrets backend credentials through the Config API CVE-2026-48891Mediumapache-airflow: Apache Airflow exposes unreadable DAG identifiers in the scheduling dependencies graph CVE-2026-48828Mediumapache-airflow: Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API CVE-2026-46764Mediumapache-airflow: Apache Airflow has an Authorization Bypass Through User-Controlled Key CVE-2026-49267Mediumapache-airflow: Apache Airflow has no certificate validation on SMTP STARTTLS connections CVE-2026-48726Mediumapache-airflow: Apache Airflow: Auth manager doesn't invalidate JWT tokens after users click logout CVE-2026-42360Mediumapache-airflow: Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2026-41084Highapache-airflow: Apache Airflow Vulnerable to Authorization Bypass Through User-Controlled Key CVE-2026-45426Lowapache-airflow: Apache Airflow has an Incorrect Authorization issue CVE-2026-42359Highapache-airflow: Apache Airflow has a Deserialization of Untrusted Data vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo