apache-airflow vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-45360Highapache-airflow: Apache Airflow Vulnerable to Deserialization of Untrusted Data CVE-2026-42358Mediumapache-airflow: Apache Airflow Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2026-42252Criticalapache-airflow: Apache Airflow vulnerable to Improper Neutralization of Special Elements Used in a Template Engine CVE-2026-41017Mediumapache-airflow: Apache Airflow has a Sensitive Cookie in HTTPS Session Without 'Secure' Attribute CVE-2026-41014Mediumapache-airflow: Apache Airflow has a Missing Authorization issue CVE-2026-40961Highapache-airflow: Apache Airflow: Authenticated users can bypass the `is_safe_url` check CVE-2026-40861Mediumapache-airflow: Apache Airflow has a Link Following issue CVE-2026-40963Lowapache-airflow: Apache Airflow has an Improper Authorization issue CVE-2026-45192Mediumapache-airflow: Apache Airflow: Incomplete redaction allowlist exposes secrets in Connection `extra` to read-permitted users CVE-2026-40690Mediumapache-airflow: Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions CVE-2026-38743Mediumapache-airflow: Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and…CVE-2026-32690Lowapache-airflow-core: Apache Airflow Exposes Secrets in Variables Saved as JSON Dictionaries CVE-2026-31987Mediumapache-airflow: Apache Airflow: JWT token appearing in logs CVE-2025-54550Highapache-airflow: Apache Airflow: RCE by race condition in example_xcom dag CVE-2026-25219Mediumapache-airflow: Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access CVE-2026-33858Highapache-airflow: Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API CVE-2025-66236Mediumapache-airflow: Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI CVE-2025-57735Criticalapache-airflow: Apache Airflow: JWT token still valid after logout CVE-2026-34538Mediumapache-airflow: Apache Airflow has an authorization bypass in DagRun wait endpoint CVE-2026-32794Mediumapache-airflow: Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange CVE-2026-30911Highapache-airflow: Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization CVE-2026-28779Highapache-airflow: Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications CVE-2026-28563Mediumapache-airflow: Apache Airflow: DAG authorization bypass CVE-2026-26929Highapache-airflow: Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata CVE-2025-27555Mediumapache-airflow: Apache Airflow exposes sensitive information in its log files

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo