apache-airflow vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-46764Mediumapache-airflow: Apache Airflow has an Authorization Bypass Through User-Controlled Key CVE-2026-49267Mediumapache-airflow: Apache Airflow has no certificate validation on SMTP STARTTLS connections CVE-2026-48726Mediumapache-airflow: Apache Airflow: Auth manager doesn't invalidate JWT tokens after users click logout CVE-2026-42360Mediumapache-airflow: Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2026-41084Highapache-airflow: Apache Airflow Vulnerable to Authorization Bypass Through User-Controlled Key CVE-2026-45426Lowapache-airflow: Apache Airflow has an Incorrect Authorization issue CVE-2026-42359Highapache-airflow: Apache Airflow has a Deserialization of Untrusted Data vulnerability CVE-2026-45360Highapache-airflow: Apache Airflow Vulnerable to Deserialization of Untrusted Data CVE-2026-42358Mediumapache-airflow: Apache Airflow Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2026-42252Criticalapache-airflow: Apache Airflow vulnerable to Improper Neutralization of Special Elements Used in a Template Engine CVE-2026-41017Mediumapache-airflow: Apache Airflow has a Sensitive Cookie in HTTPS Session Without 'Secure' Attribute CVE-2026-41014Mediumapache-airflow: Apache Airflow has a Missing Authorization issue CVE-2026-40961Highapache-airflow: Apache Airflow: Authenticated users can bypass the `is_safe_url` check CVE-2026-40861Mediumapache-airflow: Apache Airflow has a Link Following issue CVE-2026-40963Lowapache-airflow: Apache Airflow has an Improper Authorization issue CVE-2026-45192Mediumapache-airflow: Apache Airflow: Incomplete redaction allowlist exposes secrets in Connection `extra` to read-permitted users CVE-2026-40690Mediumapache-airflow: Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions CVE-2026-38743Mediumapache-airflow: Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and…CVE-2026-32690Lowapache-airflow-core: Apache Airflow Exposes Secrets in Variables Saved as JSON Dictionaries CVE-2026-31987Mediumapache-airflow: Apache Airflow: JWT token appearing in logs CVE-2025-54550Highapache-airflow: Apache Airflow: RCE by race condition in example_xcom dag CVE-2026-25219Mediumapache-airflow: Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access CVE-2026-33858Highapache-airflow: Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API CVE-2025-66236Mediumapache-airflow: Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI CVE-2025-57735Criticalapache-airflow: Apache Airflow: JWT token still valid after logout

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo