apache-airflow (PyPI)
Advisories
311
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 3.3.2 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "apache-airflow>=3.3.2"poetry
poetry add "apache-airflow>=3.3.2"uv
uv add "apache-airflow>=3.3.2"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| PYSEC-2026-3990 Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. |
Critical EPSS 0.75% |
>= 3.0.0, < 3.3.2 | 3.3.2 |
| PYSEC-2026-3989 When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie… |
Medium EPSS 0.73% |
<= 3.3.0<= 3.3.1 | No fix yet |
| PYSEC-2026-3988 Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is… |
Medium EPSS 0.64% |
< 3.3.2 | 3.3.2 |
| GHSA-5247-m8w9-2v4m Apache Airflow missing team context permits cross-team Dag actions and XCom reads |
Medium EPSS 0.33% |
< 3.3.1 | 3.3.1 |
| GHSA-5247-m8w9-2v4m Apache Airflow missing team context permits cross-team Dag actions and XCom reads |
Medium EPSS 0.33% |
< 3.3.1 | 3.3.1 |
| GHSA-f3c2-j7g8-vpp8 Apache Airflow Task SDK fails to mask list-shaped JSON Variables |
Medium EPSS 0.23% |
< 3.3.1 | 3.3.1 |
| GHSA-f3c2-j7g8-vpp8 Apache Airflow Task SDK fails to mask list-shaped JSON Variables |
Medium EPSS 0.23% |
< 3.3.1 | 3.3.1 |
| GHSA-cjv4-7hp2-2x9h Apache Airflow bulk endpoints log Variable and Connection secrets in cleartext |
Medium EPSS 0.36% |
< 3.3.1 | 3.3.1 |
| GHSA-cjv4-7hp2-2x9h Apache Airflow bulk endpoints log Variable and Connection secrets in cleartext |
Medium EPSS 0.36% |
< 3.3.1 | 3.3.1 |
| GHSA-j4jc-cq9h-xrhr Apache Airflow Backfill API parser discrepancy permits cross-DAG authorization bypass |
High EPSS 0.42% |
< 3.3.1 | 3.3.1 |
| GHSA-j4jc-cq9h-xrhr Apache Airflow Backfill API parser discrepancy permits cross-DAG authorization bypass |
High EPSS 0.42% |
< 3.3.1 | 3.3.1 |
| GHSA-75mg-c62r-v95g Apache Airflow environment-variable secrets backend permits cross-team credential use |
Medium EPSS 0.34% |
< 3.3.1 | 3.3.1 |
| GHSA-75mg-c62r-v95g Apache Airflow environment-variable secrets backend permits cross-team credential use |
Medium EPSS 0.34% |
< 3.3.1 | 3.3.1 |
| GHSA-2qjv-p2gc-mjg2 Apache Airflow Task SDK Callback deserialization can import arbitrary modules in the scheduler |
High EPSS 0.61% |
>= 3.3.0, < 3.3.1 | 3.3.1 |
| GHSA-2qjv-p2gc-mjg2 Apache Airflow Task SDK Callback deserialization can import arbitrary modules in the scheduler |
High EPSS 0.61% |
>= 3.3.0, < 3.3.1 | 3.3.1 |
| GHSA-q4c3-7575-55j2 Apache Airflow scheduler unsafely deserializes human-in-the-loop task next_kwargs |
High EPSS 0.78% |
>= 3.3.0, < 3.3.1 | 3.3.1 |
| GHSA-q4c3-7575-55j2 Apache Airflow scheduler unsafely deserializes human-in-the-loop task next_kwargs |
High EPSS 0.78% |
>= 3.3.0, < 3.3.1 | 3.3.1 |
| GHSA-c56v-8w4g-3mfm Apache Airflow Config API exposes team-scoped sensitive configuration values |
Medium EPSS 0.39% |
>= 3.3.0, < 3.3.1 | 3.3.1 |
| GHSA-c56v-8w4g-3mfm Apache Airflow Config API exposes team-scoped sensitive configuration values |
Medium EPSS 0.39% |
>= 3.3.0, < 3.3.1 | 3.3.1 |
| GHSA-f643-3rc2-j27w Apache Airflow exposes dict-valued var.json secrets in Rendered Templates |
Medium EPSS 0.23% |
< 3.3.1 | 3.3.1 |
| GHSA-f643-3rc2-j27w Apache Airflow exposes dict-valued var.json secrets in Rendered Templates |
Medium EPSS 0.23% |
< 3.3.1 | 3.3.1 |
| GHSA-fcmm-42r9-mmmm Apache Airflow XCom API permits unsafe deserialization through JSON string literals |
Medium EPSS 0.53% |
< 3.3.1 | 3.3.1 |
| GHSA-fcmm-42r9-mmmm Apache Airflow XCom API permits unsafe deserialization through JSON string literals |
Medium EPSS 0.53% |
< 3.3.1 | 3.3.1 |
| GHSA-8prw-8m6x-8w6f Apache Airflow exception-node deserialization permits arbitrary callable execution |
High EPSS 0.48% |
>= 3.3.0, < 3.3.1 | 3.3.1 |
| GHSA-8prw-8m6x-8w6f Apache Airflow exception-node deserialization permits arbitrary callable execution |
High EPSS 0.48% |
>= 3.3.0, < 3.3.1 | 3.3.1 |
| GHSA-g4qj-5vxv-wggf Apache Airflow Variables UI fails to mask sensitive values in deeply nested iterables |
Medium EPSS 0.42% |
< 3.3.1 | 3.3.1 |
| GHSA-g4qj-5vxv-wggf Apache Airflow Variables UI fails to mask sensitive values in deeply nested iterables |
Medium EPSS 0.42% |
< 3.3.1 | 3.3.1 |
| GHSA-22hf-vx2v-gjff Apache Airflow exposes deferred trigger kwargs in task-instance API responses |
Medium EPSS 0.66% |
< 3.3.0 | 3.3.0 |
| GHSA-22hf-vx2v-gjff Apache Airflow exposes deferred trigger kwargs in task-instance API responses |
Medium EPSS 0.66% |
< 3.3.0 | 3.3.0 |
| GHSA-4fh7-7jx4-8f6c apache-airflow DAG source authorization bypass exposes co-located DAG source |
Medium EPSS 0.60% |
< 3.3.0 | 3.3.0 |
| GHSA-4fh7-7jx4-8f6c apache-airflow DAG source authorization bypass exposes co-located DAG source |
Medium EPSS 0.60% |
< 3.3.0 | 3.3.0 |
| GHSA-9933-5rrp-mfwx Apache Airflow exposes secrets backend credentials through the Config API |
Medium EPSS 0.66% |
< 3.3.0 | 3.3.0 |
| GHSA-9933-5rrp-mfwx Apache Airflow exposes secrets backend credentials through the Config API |
Medium EPSS 0.66% |
< 3.3.0 | 3.3.0 |
| GHSA-3322-mjxh-9mp5 Apache Airflow exposes unreadable DAG identifiers in the scheduling dependencies graph |
Medium EPSS 0.64% |
< 3.3.0 | 3.3.0 |
| GHSA-3322-mjxh-9mp5 Apache Airflow exposes unreadable DAG identifiers in the scheduling dependencies graph |
Medium EPSS 0.64% |
< 3.3.0 | 3.3.0 |
| GHSA-563f-2439-rmq4 Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API |
Medium EPSS 0.66% |
< 3.3.0 | 3.3.0 |
| GHSA-563f-2439-rmq4 Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API |
Medium EPSS 0.66% |
< 3.3.0 | 3.3.0 |
| GHSA-2943-9672-r45w Apache Airflow allows code execution through unsafe serialized DAG deserialization |
Critical EPSS 1.65% |
< 3.3.0 | 3.3.0 |
| GHSA-2943-9672-r45w Apache Airflow allows code execution through unsafe serialized DAG deserialization |
Critical EPSS 1.65% |
< 3.3.0 | 3.3.0 |
| GHSA-799x-qp47-8qwq Apache Airflow has no certificate validation on SMTP STARTTLS connections |
Medium EPSS 0.18% |
>= 2.0.0, < 3.2.2 | 3.2.2 |
| GHSA-799x-qp47-8qwq Apache Airflow has no certificate validation on SMTP STARTTLS connections |
Medium EPSS 0.18% |
>= 2.0.0, < 3.2.2 | 3.2.2 |
| GHSA-vr7m-c6v4-8cx8 Apache Airflow: Auth manager doesn't invalidate JWT tokens after users click logout |
Medium EPSS 0.38% |
< 3.2.2 | 3.2.2 |
| GHSA-vr7m-c6v4-8cx8 Apache Airflow: Auth manager doesn't invalidate JWT tokens after users click logout |
Medium EPSS 0.38% |
< 3.2.2 | 3.2.2 |
| GHSA-qphr-3mvq-v466 Apache Airflow has an Authorization Bypass Through User-Controlled Key |
Medium EPSS 0.37% |
< 3.2.2 | 3.2.2 |
| GHSA-qphr-3mvq-v466 Apache Airflow has an Authorization Bypass Through User-Controlled Key |
Medium EPSS 0.37% |
< 3.2.2 | 3.2.2 |
| GHSA-x5wm-j6wh-2834 Apache Airflow has an Incorrect Authorization issue |
Low EPSS 0.36% |
>= 3.0.0, < 3.2.2 | 3.2.2 |
| GHSA-x5wm-j6wh-2834 Apache Airflow has an Incorrect Authorization issue |
Low EPSS 0.36% |
>= 3.0.0, < 3.2.2 | 3.2.2 |
| GHSA-2r5m-76wx-56gx Apache Airflow Vulnerable to Deserialization of Untrusted Data |
High EPSS 0.68% |
>= 3.2.0, < 3.2.2 | 3.2.2 |
| GHSA-2r5m-76wx-56gx Apache Airflow Vulnerable to Deserialization of Untrusted Data |
High EPSS 0.68% |
< 3.2.2 | 3.2.2 |
| GHSA-cg3x-89rc-x9mw Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor |
Medium EPSS 0.35% |
< 3.2.2 | 3.2.2 |
| GHSA-cg3x-89rc-x9mw Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor |
Medium EPSS 0.35% |
< 3.2.2 | 3.2.2 |
| GHSA-wr76-29cr-67w8 Apache Airflow has a Deserialization of Untrusted Data vulnerability |
High EPSS 0.57% |
>= 3.2.0, < 3.2.2 | 3.2.2 |
| GHSA-wr76-29cr-67w8 Apache Airflow has a Deserialization of Untrusted Data vulnerability |
High EPSS 0.57% |
>= 3.2.0, < 3.2.2 | 3.2.2 |
| GHSA-33g2-gx67-c2h3 Apache Airflow Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor |
Medium EPSS 0.34% |
< 3.2.2 | 3.2.2 |
| GHSA-33g2-gx67-c2h3 Apache Airflow Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor |
Medium EPSS 0.34% |
< 3.2.2 | 3.2.2 |
| GHSA-c85c-g9wv-pph2 Apache Airflow vulnerable to Improper Neutralization of Special Elements Used in a Template Engine |
Critical EPSS 0.38% |
>= 3.0.0, < 3.2.2 | 3.2.2 |
| GHSA-c85c-g9wv-pph2 Apache Airflow vulnerable to Improper Neutralization of Special Elements Used in a Template Engine |
Critical EPSS 0.38% |
>= 3.0.0, < 3.2.2 | 3.2.2 |
| GHSA-mxq5-f9c5-w4p5 Apache Airflow Vulnerable to Authorization Bypass Through User-Controlled Key |
High EPSS 0.48% |
>= 3.2.0, < 3.2.2 | 3.2.2 |
| GHSA-mxq5-f9c5-w4p5 Apache Airflow Vulnerable to Authorization Bypass Through User-Controlled Key |
High EPSS 0.48% |
>= 3.2.0, < 3.2.2 | 3.2.2 |
| GHSA-95v7-h9j5-gvjr Apache Airflow has a Sensitive Cookie in HTTPS Session Without 'Secure' Attribute |
Medium EPSS 0.35% |
>= 3.0.0, < 3.2.2 | 3.2.2 |
| GHSA-95v7-h9j5-gvjr Apache Airflow has a Sensitive Cookie in HTTPS Session Without 'Secure' Attribute |
Medium EPSS 0.35% |
>= 3.0.0, < 3.2.2 | 3.2.2 |
| GHSA-x2x7-p37c-43cr Apache Airflow has a Missing Authorization issue |
Medium EPSS 0.37% |
>= 3.2.0, < 3.2.2 | 3.2.2 |
| GHSA-x2x7-p37c-43cr Apache Airflow has a Missing Authorization issue |
Medium EPSS 0.37% |
>= 3.2.0, < 3.2.2 | 3.2.2 |
| GHSA-gprj-xvq8-w53q Apache Airflow has an Improper Authorization issue |
Low EPSS 0.48% |
>= 3.0.0, < 3.2.2 | 3.2.2 |
| GHSA-gprj-xvq8-w53q Apache Airflow has an Improper Authorization issue |
Low EPSS 0.48% |
>= 3.0.0, < 3.2.2 | 3.2.2 |
| GHSA-6hcw-qqr8-pjj8 Apache Airflow: Authenticated users can bypass the `is_safe_url` check |
High EPSS 0.65% |
< 3.2.2 | 3.2.2 |
| GHSA-6hcw-qqr8-pjj8 Apache Airflow: Authenticated users can bypass the `is_safe_url` check |
High EPSS 0.65% |
< 3.2.2 | 3.2.2 |
| GHSA-89cj-xrpx-j79m Apache Airflow has a Link Following issue |
Medium EPSS 0.69% |
< 3.2.2 | 3.2.2 |
| GHSA-89cj-xrpx-j79m Apache Airflow has a Link Following issue |
Medium EPSS 0.69% |
< 3.2.2 | 3.2.2 |
| GHSA-2883-wwh7-x57v Apache Airflow: Incomplete redaction allowlist exposes secrets in Connection `extra` to read-permitted users |
Medium EPSS 0.43% |
< 3.2.2 | 3.2.2 |
| GHSA-2883-wwh7-x57v Apache Airflow: Incomplete redaction allowlist exposes secrets in Connection `extra` to read-permitted users |
Medium EPSS 0.43% |
< 3.2.2 | 3.2.2 |
| GHSA-w7rc-q6cm-f5gm Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions |
Medium EPSS 0.35% |
< 3.2.1rc1 | 3.2.1rc1 |
| GHSA-w7rc-q6cm-f5gm Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions |
Medium EPSS 0.35% |
< 3.2.1rc1 | 3.2.1rc1 |
| GHSA-p3v3-229h-mc63 Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance record |
Medium EPSS 0.35% |
< 3.2.1rc1 | 3.2.1rc1 |
| GHSA-p3v3-229h-mc63 Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance record |
Medium EPSS 0.35% |
< 3.2.1rc1 | 3.2.1rc1 |
| GHSA-w9r4-94fj-xp69 Apache Airflow Exposes Secrets in Variables Saved as JSON Dictionaries |
Low EPSS 0.42% |
>= 3.0.0, < 3.2.0 | 3.2.0 |
| GHSA-w9r4-94fj-xp69 Apache Airflow Exposes Secrets in Variables Saved as JSON Dictionaries |
Low EPSS 0.42% |
>= 3.0.0, < 3.2.0 | 3.2.0 |
| PYSEC-2026-18 Apache Airflow exposes SQL stack trace despite "api/expose_stack_traces" set to false |
High EPSS 0.45% |
< 3.2.0 | 3.2.0 |
| PYSEC-2026-13 Apache Airflow allows code execution through crafted XCom payloads |
High EPSS 0.82% |
< 3.2.0 | 3.2.0 |
| GHSA-phv5-vq5p-qhp7 Apache Airflow: JWT token appearing in logs |
High EPSS 0.74% |
>= 3.0.0, < 3.2.0 | 3.2.0 |
| GHSA-phv5-vq5p-qhp7 Apache Airflow: JWT token appearing in logs |
High EPSS 0.74% |
>= 3.0.0, < 3.2.0 | 3.2.0 |
| GHSA-4g48-54q2-fg7q Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access |
Medium EPSS 0.55% |
< 3.1.8 | 3.1.8 |
| GHSA-4g48-54q2-fg7q Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access |
Medium EPSS 0.55% |
< 3.1.8 | 3.1.8 |
| GHSA-q2hg-643c-gw8h Apache Airflow: RCE by race condition in example_xcom dag |
High EPSS 0.58% |
< 3.2.0 | 3.2.0 |
| GHSA-q2hg-643c-gw8h Apache Airflow: RCE by race condition in example_xcom dag |
High EPSS 0.58% |
< 3.2.0 | 3.2.0 |
| GHSA-mc4f-r875-v87w Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API |
High EPSS 0.59% |
>= 3.1.8, < 3.2.0 | 3.2.0 |
| GHSA-mc4f-r875-v87w Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API |
High EPSS 0.59% |
>= 3.1.8, < 3.2.0 | 3.2.0 |
| GHSA-j86x-fwp2-qh7v Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI |
High EPSS 0.44% |
>= 3.0.0, < 3.2.0 | 3.2.0 |
| GHSA-j86x-fwp2-qh7v Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI |
High EPSS 0.44% |
>= 3.0.0, < 3.2.0 | 3.2.0 |
| GHSA-c92r-g8j5-vhcx Apache Airflow: JWT token still valid after logout |
Critical EPSS 0.67% |
>= 3.0.0, < 3.2.0 | 3.2.0 |
| GHSA-c92r-g8j5-vhcx Apache Airflow: JWT token still valid after logout |
Critical EPSS 0.67% |
>= 3.0.0, < 3.2.0 | 3.2.0 |
| GHSA-r7vr-m4jw-r794 Apache Airflow has an authorization bypass in DagRun wait endpoint |
Medium EPSS 0.69% |
>= 3.0.0, < 3.2.0 | 3.2.0 |
| GHSA-r7vr-m4jw-r794 Apache Airflow has an authorization bypass in DagRun wait endpoint |
Medium EPSS 0.69% |
>= 3.0.0, < 3.2.0 | 3.2.0 |
| GHSA-wrpj-755p-x363 Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange |
Medium EPSS 0.39% |
>= 1.10.0, < 1.12.0 | 1.12.0 |
| GHSA-wrpj-755p-x363 Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange |
Medium EPSS 0.39% |
>= 1.10.0, < 1.12.0 | 1.12.0 |
| GHSA-8x34-9q3v-h7g8 Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization |
High EPSS 0.56% |
>= 3.1.0, < 3.1.8 | 3.1.8 |
| GHSA-8x34-9q3v-h7g8 Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization |
High EPSS 0.56% |
>= 3.1.0, < 3.1.8 | 3.1.8 |
| GHSA-4fhm-p86v-hwpx Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications |
High EPSS 0.70% |
>= 3.0.0, < 3.1.8 | 3.1.8 |
| GHSA-4fhm-p86v-hwpx Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications |
High EPSS 0.70% |
>= 3.0.0, < 3.1.8 | 3.1.8 |
| GHSA-x3fv-96qh-67m7 Apache Airflow: DAG authorization bypass |
Medium EPSS 0.46% |
>= 3.0.0, < 3.1.8 | 3.1.8 |
| GHSA-x3fv-96qh-67m7 Apache Airflow: DAG authorization bypass |
Medium EPSS 0.46% |
>= 3.0.0, < 3.1.8 | 3.1.8 |
| GHSA-4m3h-wp5w-5hqh Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata |
Medium EPSS 0.42% |
>= 3.0.0, < 3.1.8 | 3.1.8 |
| GHSA-4m3h-wp5w-5hqh Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata |
Medium EPSS 0.42% |
>= 3.0.0, < 3.1.8 | 3.1.8 |
| GHSA-8r55-rv5w-6pfm Apache Airflow exposes sensitive information in its log files |
Medium EPSS 0.42% |
< 2.11.1 | 2.11.1 |
| GHSA-8r55-rv5w-6pfm Apache Airflow exposes sensitive information in its log files |
Medium EPSS 0.42% |
< 2.11.1 | 2.11.1 |
| GHSA-r837-hpv7-pc2f Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate table |
High EPSS 1.23% |
< 2.11.1 | 2.11.1 |
| GHSA-r837-hpv7-pc2f Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate table |
High EPSS 1.23% |
< 2.11.1 | 2.11.1 |
| GHSA-gfw7-2v73-69wg Apache Airflow error reporting may expose full kwargs |
Medium EPSS 0.89% |
< 2.11.1>= 3.0.0b1, < 3.1.5rc1 | 2.11.13.1.5rc1 |
| GHSA-gfw7-2v73-69wg Apache Airflow error reporting may expose full kwargs |
Medium EPSS 0.89% |
< 2.11.1 | 2.11.1 |
| GHSA-gfw7-2v73-69wg Apache Airflow error reporting may expose full kwargs |
Medium EPSS 0.89% |
>= 3.0.0b1, < 3.1.5rc1 | 3.1.5rc1 |
| GHSA-5g2w-9f8g-g5q7 Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated Users |
Medium EPSS 0.83% |
>= 3.0.0, < 3.1.7 | 3.1.7 |
| GHSA-5g2w-9f8g-g5q7 Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated Users |
Medium EPSS 0.83% |
< 3.1.7 | 3.1.7 |
| GHSA-pm44-x5x7-24c4 Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access |
Medium EPSS 0.44% |
>= 3.1.0, < 3.1.7 | 3.1.7 |
| GHSA-pm44-x5x7-24c4 Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access |
Medium EPSS 0.44% |
>= 3.1.0, < 3.1.7 | 3.1.7 |
| GHSA-7c2f-r6gc-h92h Apache Airflow proxy credentials for various providers might leak in task logs |
High EPSS 1.88% |
>= 3.0.0b1, < 3.1.6 | 3.1.6 |
| GHSA-7c2f-r6gc-h92h Apache Airflow proxy credentials for various providers might leak in task logs |
High EPSS 1.88% |
< 2.11.1 | 2.11.1 |
| GHSA-7c2f-r6gc-h92h Apache Airflow proxy credentials for various providers might leak in task logs |
High EPSS 1.88% |
< 3.1.6 | 3.1.6 |
| GHSA-3qmm-r55x-hpxx Apache Airflow secrets in rendered templates could contain parts of sensitive values when truncated |
High EPSS 0.62% |
>= 3.1.0, < 3.1.6 | 3.1.6 |
| GHSA-3qmm-r55x-hpxx Apache Airflow secrets in rendered templates could contain parts of sensitive values when truncated |
High EPSS 0.62% |
>= 3.1.0, < 3.1.6 | 3.1.6 |
| PYSEC-2025-87 Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context |
Critical EPSS 1.17% |
< 2.0.0 | 2.0.0 |
| GHSA-fv47-pqh6-wxgq Apache Airflow exposes secret values to authenticated UI users via rendered templates |
Medium EPSS 0.48% |
>= 3.1.0, < 3.1.4 | 3.1.4 |
| GHSA-fv47-pqh6-wxgq Apache Airflow exposes secret values to authenticated UI users via rendered templates |
Medium EPSS 0.48% |
>= 3.1.0, < 3.1.5 | 3.1.5 |
| GHSA-gp5f-cx7h-8q6f Apache Airflow's create action can upsert existing Pools/Connections/Variables |
Medium EPSS 0.43% |
>= 3.0.0, < 3.1.1 | 3.1.1 |
| GHSA-gp5f-cx7h-8q6f Apache Airflow's create action can upsert existing Pools/Connections/Variables |
Medium EPSS 0.43% |
>= 3.0.0, < 3.1.1 | 3.1.1 |
| GHSA-273c-4g26-4jpm Apache Airflow `/api/v2/dagReports` executes DAG Python in API |
Medium EPSS 0.52% |
>= 3.0.0, < 3.1.1 | 3.1.1 |
| GHSA-273c-4g26-4jpm Apache Airflow `/api/v2/dagReports` executes DAG Python in API |
Medium EPSS 0.52% |
>= 3.0.0, < 3.1.1 | 3.1.1 |
| GHSA-v3c9-j6h9-66v4 Apache Airflow has a command injection vulnerability in "example_dag_decorator" |
Medium EPSS 0.49% |
>= 3.0.0, < 3.0.5 | 3.0.5 |
| GHSA-v3c9-j6h9-66v4 Apache Airflow has a command injection vulnerability in "example_dag_decorator" |
Medium EPSS 0.49% |
>= 3.0.0, < 3.0.5 | 3.0.5 |
| GHSA-q475-2pgm-7hvp Apache Airflow: Connection sensitive details exposed to users with READ permissions |
Medium EPSS 0.94% |
>= 3.0.3, < 3.0.4 | 3.0.4 |
| GHSA-q475-2pgm-7hvp Apache Airflow: Connection sensitive details exposed to users with READ permissions |
Medium EPSS 0.94% |
<= 3.0.3-NA | No fix yet |
| PYSEC-2024-182 Apache Airflow: Sensitive configuration values are not masked in the logs by default |
High EPSS 1.34% |
< 2.10.3 | 2.10.3 |
| GHSA-j857-2pwm-jjmm Apache Airflow vulnerable to Insertion of Sensitive Information Into Sent Data |
Medium EPSS 1.24% |
< 2.10.3 | 2.10.3 |
| GHSA-j857-2pwm-jjmm Apache Airflow vulnerable to Insertion of Sensitive Information Into Sent Data |
Medium EPSS 1.24% |
< 2.10.3 | 2.10.3 |
| GHSA-c392-whpc-vfpr Apache Airflow vulnerable to Improper Encoding or Escaping of Output |
High EPSS 1.24% |
<= 2.10.0-NA | No fix yet |
| GHSA-c392-whpc-vfpr Apache Airflow vulnerable to Improper Encoding or Escaping of Output |
High EPSS 1.24% |
>= 2.10.0, < 2.10.1 | 2.10.1 |
| GHSA-92xg-gmrq-5c3w Apache Airflow vulnerable to Execution with Unnecessary Privileges |
High EPSS 1.69% |
< 2.10.1 | 2.10.1 |
| GHSA-92xg-gmrq-5c3w Apache Airflow vulnerable to Execution with Unnecessary Privileges |
High EPSS 1.69% |
< 2.10.1 | 2.10.1 |
| GHSA-w7cp-g8v7-r54m Apache Airflow Cross-site Scripting Vulnerability |
Medium EPSS 1.73% |
< 2.10.0 | 2.10.0 |
| GHSA-w7cp-g8v7-r54m Apache Airflow Cross-site Scripting Vulnerability |
Medium EPSS 1.73% |
< 2.10.0 | 2.10.0 |
| PYSEC-2024-265 Apache Airflow Providers FAB Insufficient Session Expiration vulnerability |
Critical EPSS 0.93% |
<= 1.2.1<= 1.2.0 | No fix yet |
| GHSA-g5hv-r743-v8pm Apache Airflow has DAG Author Code Execution possibility in airflow-scheduler |
High EPSS 1.73% |
>= 2.4.0, < 2.9.3 | 2.9.3 |
| GHSA-g5hv-r743-v8pm Apache Airflow has DAG Author Code Execution possibility in airflow-scheduler |
High EPSS 1.73% |
>= 2.4.0, < 2.9.3 | 2.9.3 |
| GHSA-j482-47xf-p25c Apache Airflow Potential Cross-site Scripting Vulnerability |
Medium EPSS 1.00% |
< 2.9.3 | 2.9.3 |
| GHSA-j482-47xf-p25c Apache Airflow Potential Cross-site Scripting Vulnerability |
Medium EPSS 1.00% |
< 2.9.3 | 2.9.3 |
| GHSA-9xpj-62mm-24h2 Apache Airflow does not return the "Cache-Control" header for dynamic content |
Medium EPSS 0.32% |
< 2.9.2 | 2.9.2 |
| GHSA-9xpj-62mm-24h2 Apache Airflow does not return the "Cache-Control" header for dynamic content |
Medium EPSS 0.32% |
< 2.9.2 | 2.9.2 |
| GHSA-52gm-qmg3-r4qp Apache Airflow: XSS vulnerability in Task Instance Log/Log Details |
Medium EPSS 1.57% |
<= 2.9.0-NA<= 2.9.0-beta1<= 2.9.0-beta2<= 2.9.0-rc1<= 2.9.0-rc2<= 2.9.0-rc3 | No fix yet |
| GHSA-52gm-qmg3-r4qp Apache Airflow: XSS vulnerability in Task Instance Log/Log Details |
Medium EPSS 1.57% |
>= 2.9.0, < 2.9.1 | 2.9.1 |
| GHSA-2522-mrjc-m688 Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used |
Medium EPSS 1.06% |
>= 2.7.0, < 2.9.0 | 2.9.0 |
| GHSA-2522-mrjc-m688 Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used |
Medium EPSS 1.06% |
>= 2.7.0, < 2.9.0 | 2.9.0 |
| GHSA-cff3-5qrp-hqx7 Apache Airflow Improper Preservation of Permissions vulnerability |
Medium EPSS 1.46% |
>= 2.8.2, < 2.8.4 | 2.8.4 |
| GHSA-cff3-5qrp-hqx7 Apache Airflow Improper Preservation of Permissions vulnerability |
Medium EPSS 1.46% |
>= 2.8.2, < 2.8.4 | 2.8.4 |
| GHSA-h574-6646-vfxx Apache Airflow: Ignored Airflow Permission |
High EPSS 1.34% |
>= 2.8.0, < 2.8.3rc1 | 2.8.3rc1 |
| GHSA-h574-6646-vfxx Apache Airflow: Ignored Airflow Permission |
High EPSS 1.34% |
>= 2.8.0, < 2.8.3rc1 | 2.8.3rc1 |
| GHSA-6xwf-xvf3-v459 Apache Airflow: Incorrect Default Permissions in audit logs for Ops and Viewers users |
Medium EPSS 1.86% |
< 2.8.2 | 2.8.2 |
| GHSA-6xwf-xvf3-v459 Apache Airflow: Incorrect Default Permissions in audit logs for Ops and Viewers users |
Medium EPSS 1.86% |
< 2.8.2 | 2.8.2 |
| GHSA-6v6w-h8m6-7mv2 Apache Airflow: DAG Code and Import Error Permissions Ignored |
Medium EPSS 0.34% |
< 2.8.2 | 2.8.2 |
| GHSA-6v6w-h8m6-7mv2 Apache Airflow: DAG Code and Import Error Permissions Ignored |
Medium EPSS 0.34% |
< 2.8.2 | 2.8.2 |
| GHSA-mg2x-mggj-6955 Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service |
Medium EPSS 0.39% |
>= 2.3.0, < 2.6.1 | 2.6.1 |
| GHSA-mg2x-mggj-6955 Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service |
Medium EPSS 0.39% |
>= 2.3.0, < 2.6.1 | 2.6.1 |
| GHSA-c3c6-f2ww-xfr2 Apache Airflow: pickle deserialization vulnerability in XComs |
High EPSS 1.22% |
< 2.8.1 | 2.8.1 |
| GHSA-vm5m-qmrx-fw8w Apache Airflow: Bypass permission verification to read code of other dags |
Medium EPSS 0.98% |
< 2.8.1 | 2.8.1 |
| GHSA-vm5m-qmrx-fw8w Apache Airflow: Bypass permission verification to read code of other dags |
Medium EPSS 0.98% |
< 2.8.1rc1 | 2.8.1rc1 |
| GHSA-c3c6-f2ww-xfr2 Apache Airflow: pickle deserialization vulnerability in XComs |
High EPSS 1.22% |
< 2.8.1rc1 | 2.8.1rc1 |
| GHSA-pxch-wr7m-rwxj Apache Airflow has a stored cross-site scripting vulnerability |
Medium EPSS 1.34% |
>= 2.6.0, < 2.8.0b1 | 2.8.0b1 |
| GHSA-pxch-wr7m-rwxj Apache Airflow has a stored cross-site scripting vulnerability |
Medium EPSS 1.34% |
>= 2.6.0, < 2.8.0b1 | 2.8.0b1 |
| GHSA-8f57-wcmg-4jmh Apache Airflow vulnerable to Exposure of Resource to Wrong Sphere |
Medium EPSS 1.80% |
< 2.8.0 | 2.8.0 |
| GHSA-8f57-wcmg-4jmh Apache Airflow vulnerable to Exposure of Resource to Wrong Sphere |
Medium EPSS 1.80% |
< 2.8.0 | 2.8.0 |
| GHSA-6m9r-7wrx-xmr6 Apache Airflow Cross-Site Request Forgery vulnerability |
Medium EPSS 1.03% |
>= 2.7.0, < 2.8.0b1 | 2.8.0b1 |
| GHSA-6m9r-7wrx-xmr6 Apache Airflow Cross-Site Request Forgery vulnerability |
Medium EPSS 1.03% |
>= 2.7.0, < 2.8.0 | 2.8.0 |
| GHSA-5938-79hg-xh3q Apache Airflow Improper Access Control vulnerability |
Medium EPSS 1.39% |
< 2.8.0 | 2.8.0 |
| GHSA-5938-79hg-xh3q Apache Airflow Improper Access Control vulnerability |
Medium EPSS 1.39% |
< 2.8.0 | 2.8.0 |
| GHSA-hm9r-7f84-25c9 Apache Airflow allows authenticated and DAG-view authorized users to modify some DAG run detail values when submitting notes |
Medium EPSS 1.50% |
< 2.7.3 | 2.7.3 |
| GHSA-r7x6-xfcm-3mxv Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor |
Medium EPSS 1.66% |
< 2.7.3 | 2.7.3 |
| GHSA-r7x6-xfcm-3mxv Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor |
Medium EPSS 1.66% |
< 2.7.3 | 2.7.3 |
| GHSA-hm9r-7f84-25c9 Apache Airflow allows authenticated and DAG-view authorized users to modify some DAG run detail values when submitting notes |
Medium EPSS 1.50% |
< 2.7.3 | 2.7.3 |
| GHSA-666g-rfc5-c9jv Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerability |
High EPSS 1.56% |
>= 1.10.0, < 2.7.0 | 2.7.0 |
| GHSA-666g-rfc5-c9jv Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerability |
High EPSS 1.56% |
>= 1.10.0, < 2.7.0 | 2.7.0 |
| GHSA-9qqg-mh7c-chfq Apache Airflow vulnerable to Exposure of Sensitive Information |
Medium EPSS 1.84% |
>= 2.4.0, < 2.7.2 | 2.7.2 |
| GHSA-9qqg-mh7c-chfq Apache Airflow vulnerable to Exposure of Sensitive Information |
Medium EPSS 1.84% |
>= 2.4.0, < 2.7.0 | 2.7.0 |
| GHSA-fpxx-xv4c-gxqp Apache Airflow vulnerable to sensitive information exposure when expose-config is set to non-sensitive-only |
Medium EPSS 1.60% |
>= 2.7.0, < 2.7.2 | 2.7.2 |
| GHSA-32wr-qqw6-5mfp Apache Airflow vulnerable to sensitive information exposure |
Medium EPSS 2.01% |
< 2.7.2 | 2.7.2 |
| GHSA-cgx2-rrmr-jx43 Apache Airflow vulnerable to sensitive information exposure when users list warnings for all DAGs |
Medium EPSS 1.44% |
< 2.7.2 | 2.7.2 |
| GHSA-cgx2-rrmr-jx43 Apache Airflow vulnerable to sensitive information exposure when users list warnings for all DAGs |
Medium EPSS 1.44% |
< 2.7.2 | 2.7.2 |
| GHSA-j3w8-2p2h-mrr9 Apache Airflow vulnerable to privilege escalation |
Medium EPSS 1.90% |
< 2.7.2 | 2.7.2 |
| GHSA-32wr-qqw6-5mfp Apache Airflow vulnerable to sensitive information exposure |
Medium EPSS 2.01% |
< 2.7.2 | 2.7.2 |
| GHSA-j3w8-2p2h-mrr9 Apache Airflow vulnerable to privilege escalation |
Medium EPSS 1.90% |
< 2.7.2 | 2.7.2 |
| GHSA-fpxx-xv4c-gxqp Apache Airflow vulnerable to sensitive information exposure when expose-config is set to non-sensitive-only |
Medium EPSS 1.60% |
>= 2.7.0, < 2.7.2 | 2.7.2 |
| GHSA-wpg8-mf6h-gm92 Apache Airflow Incorrect Authorization vulnerability |
Medium EPSS 1.74% |
< 2.7.1 | 2.7.1 |
| GHSA-wpg8-mf6h-gm92 Apache Airflow Incorrect Authorization vulnerability |
Medium EPSS 1.74% |
< 2.7.1 | 2.7.1 |
| GHSA-mjqh-v5f2-g2mw Apache Airflow information exposure vulnerability |
Medium EPSS 2.00% |
< 2.7.1 | 2.7.1 |
| GHSA-mjqh-v5f2-g2mw Apache Airflow information exposure vulnerability |
Medium EPSS 2.00% |
< 2.7.1 | 2.7.1 |
| GHSA-5f35-pq34-c87q Apache Airflow missing Certificate Validation |
Medium EPSS 0.80% |
< 2.7.0 | 2.7.0 |
| GHSA-5f35-pq34-c87q Apache Airflow missing Certificate Validation |
Medium EPSS 0.80% |
< 2.7.0 | 2.7.0 |
| GHSA-x2mh-8fmc-rqgh Apache Airflow denial of service vulnerability |
High EPSS 1.96% |
< 2.7.0 | 2.7.0 |
| GHSA-x2mh-8fmc-rqgh Apache Airflow denial of service vulnerability |
High EPSS 1.96% |
< 2.7.0b1 | 2.7.0b1 |
| GHSA-pm87-24wq-r8w9 Apache Airflow Session Fixation vulnerability |
High EPSS 1.85% |
< 2.7.1rc1 | 2.7.1rc1 |
| GHSA-pm87-24wq-r8w9 Apache Airflow Session Fixation vulnerability |
High EPSS 1.85% |
< 2.7.0rc2 | 2.7.0rc2 |
| PYSEC-2023-136 apache-airflow-providers-apache-drill Improper Input Validation vulnerability |
High EPSS 2.28% |
< 2.4.3 | 2.4.3 |
| GHSA-269x-pg5c-5xgm Apache Airflow Execution with Unnecessary Privileges |
High EPSS 2.63% |
< 2.6.0b1 | 2.6.0b1 |
| GHSA-269x-pg5c-5xgm Apache Airflow Execution with Unnecessary Privileges |
High EPSS 2.63% |
< 2.6.0 | 2.6.0 |
| GHSA-xvw9-3mhm-xjqq Apache Airflow information disclosure vulnerability |
Medium EPSS 1.20% |
< 2.6.3 | 2.6.3 |
| GHSA-ggwr-4vr8-g7wv Apache Airflow Path Traversal vulnerability |
Medium EPSS 1.79% |
< 2.6.3 | 2.6.3 |
| GHSA-5946-8p38-vffp Apache Airflow Improper Input Validation vulnerability |
Medium EPSS 1.42% |
< 2.6.3 | 2.6.3 |
| GHSA-5946-8p38-vffp Apache Airflow Improper Input Validation vulnerability |
Medium EPSS 1.42% |
< 2.6.3 | 2.6.3 |
| GHSA-3h4m-m55v-gx4m Apache Airflow Improper Input Validation vulnerability |
Medium EPSS 1.57% |
< 2.6.3 | 2.6.3 |
| GHSA-3h4m-m55v-gx4m Apache Airflow Improper Input Validation vulnerability |
Medium EPSS 1.57% |
< 2.6.3 | 2.6.3 |
| GHSA-2h84-3crq-vgfj Apache Airflow Incorrect Authorization vulnerability |
Medium EPSS 1.03% |
< 2.6.3 | 2.6.3 |
| GHSA-2h84-3crq-vgfj Apache Airflow Incorrect Authorization vulnerability |
Medium EPSS 1.03% |
< 2.6.3 | 2.6.3 |
| GHSA-ggwr-4vr8-g7wv Apache Airflow Path Traversal vulnerability |
Medium EPSS 1.79% |
< 2.6.3 | 2.6.3 |
| GHSA-xvw9-3mhm-xjqq Apache Airflow information disclosure vulnerability |
Medium EPSS 1.20% |
< 2.6.3 | 2.6.3 |
| GHSA-mjff-wv85-hmcj Apache Airflow vulnerable to exposure of sensitive information |
Medium EPSS 1.53% |
>= 2.5.0, < 2.6.2 | 2.6.2 |
| GHSA-mjff-wv85-hmcj Apache Airflow vulnerable to exposure of sensitive information |
Medium EPSS 1.53% |
>= 2.5.0, < 2.6.2rc1 | 2.6.2rc1 |
| GHSA-jchm-fm4q-c2fp Apache Airflow vulnerable to Privilege Context Switching Error |
Critical EPSS 2.28% |
< 2.6.0b1 | 2.6.0b1 |
| GHSA-jchm-fm4q-c2fp Apache Airflow vulnerable to Privilege Context Switching Error |
Critical EPSS 2.28% |
< 2.6.0 | 2.6.0 |
| GHSA-vcf6-3wv2-5vcr Apache Airflow vulnerable to stored Cross-site Scripting |
Medium EPSS 1.98% |
< 2.6.0 | 2.6.0 |
| GHSA-vcf6-3wv2-5vcr Apache Airflow vulnerable to stored Cross-site Scripting |
Medium EPSS 1.98% |
< 2.6.0 | 2.6.0 |
| PYSEC-2023-3 Apache Airflow Drill Provider vulnerable to improper input validation |
High EPSS 2.06% |
< 2.3.2 | 2.3.2 |
| GHSA-h6g5-wqqr-3mw3 Sensitive Information in Error Messages in Apache Airflow |
Medium EPSS 1.38% |
< 2.5.2rc1 | 2.5.2rc1 |
| GHSA-h6g5-wqqr-3mw3 Sensitive Information in Error Messages in Apache Airflow |
Medium EPSS 1.38% |
< 2.5.2 | 2.5.2 |
| PYSEC-2023-314 Apache Airflow Sqoop Provider Improper Input Validation vulnerability |
Critical EPSS 1.90% |
< 3.1.1 | 3.1.1 |
| GHSA-c732-xvv8-g94c Command Injection in Apache Airflow and Apache Airflow MySQL Provider |
Critical EPSS 11.08% |
< 2.5.1 | 2.5.1 |
| GHSA-c732-xvv8-g94c Command Injection in Apache Airflow and Apache Airflow MySQL Provider |
Critical EPSS 11.08% |
< 2.5.1 | 2.5.1 |
| GHSA-rmf2-pwfq-h75j OS Command Injection in Apache Airflow |
Critical EPSS 4.16% |
< 2.3.0 | 2.3.0 |
| GHSA-7wqf-h36w-47mc OS Command Injection in Apache Airflow |
Critical EPSS 3.40% |
< 2.3.0 | 2.3.0 |
| GHSA-45r6-j3cc-6mxx OS Command Injection in Apache Airflow |
Medium EPSS 1.39% |
< 2.3.0 | 2.3.0 |
| GHSA-45r6-j3cc-6mxx OS Command Injection in Apache Airflow |
Medium EPSS 1.39% |
< 2.3.0 | 2.3.0 |
| GHSA-rmf2-pwfq-h75j OS Command Injection in Apache Airflow |
Critical EPSS 4.16% |
< 2.3.0 | 2.3.0 |
| GHSA-7wqf-h36w-47mc OS Command Injection in Apache Airflow |
Critical EPSS 3.40% |
< 2.3.0 | 2.3.0 |
| GHSA-rg94-84xj-7gq3 Apache Airflow Contains Open Redirect |
Medium EPSS 81.84% |
< 2.4.3 | 2.4.3 |
| GHSA-rg94-84xj-7gq3 Apache Airflow Contains Open Redirect |
Medium EPSS 81.84% |
< 2.4.3 | 2.4.3 |
| GHSA-6pw3-8h9w-32gc Apache Airflow vulnerable to OS Command Injection via example DAGs |
High EPSS 85.65% |
< 2.4.0 | 2.4.0 |
| GHSA-fvw2-2pf7-77vw Apache Airflow subject to Exposure of Sensitive Information |
High EPSS 1.99% |
< 2.3.1 | 2.3.1 |
| GHSA-fvw2-2pf7-77vw Apache Airflow subject to Exposure of Sensitive Information |
High EPSS 1.99% |
< 2.3.1 | 2.3.1 |
| GHSA-6pw3-8h9w-32gc Apache Airflow vulnerable to OS Command Injection via example DAGs |
High EPSS 85.65% |
< 2.4.0 | 2.4.0 |
| GHSA-h63r-9xxf-f2c7 Apache Airflow Cross-site Scripting vulnerability |
Medium EPSS 1.76% |
< 2.4.2 | 2.4.2 |
| GHSA-f9fq-78ch-4wmj Apache Airflow Open Redirect vulnerability |
Medium EPSS 1.83% |
< 2.4.2rc1 | 2.4.2rc1 |
| GHSA-f9fq-78ch-4wmj Apache Airflow Open Redirect vulnerability |
Medium EPSS 1.83% |
< 2.4.2 | 2.4.2 |
| GHSA-h63r-9xxf-f2c7 Apache Airflow Cross-site Scripting vulnerability |
Medium EPSS 1.76% |
< 2.4.2rc1 | 2.4.2rc1 |
| GHSA-3q8r-f3pj-3gc4 Apache Airflow may allow authenticated users who have been deactivated to continue using the UI or API |
High EPSS 1.48% |
< 2.4.2rc1 | 2.4.2rc1 |
| GHSA-3q8r-f3pj-3gc4 Apache Airflow may allow authenticated users who have been deactivated to continue using the UI or API |
High EPSS 1.48% |
< 2.4.1rc1 | 2.4.1rc1 |
| GHSA-5rp4-749p-vx26 Apache Airflow vulnerable to Use of Externally-Controlled Format String |
High EPSS 2.08% |
>= 2.3.0, < 2.4.0b1 | 2.4.0b1 |
| GHSA-5rp4-749p-vx26 Apache Airflow vulnerable to Use of Externally-Controlled Format String |
High EPSS 2.08% |
>= 2.3.0, < 2.4.0rc1 | 2.4.0rc1 |
| GHSA-4fg5-j4mm-wfpg Apache Airflow contains open redirect |
Medium EPSS 1.76% |
>= 2.3.0, < 2.4.0b1 | 2.4.0b1 |
| GHSA-4fg5-j4mm-wfpg Apache Airflow contains open redirect |
Medium EPSS 1.76% |
>= 2.3.0, < 2.4.0rc1 | 2.4.0rc1 |
| GHSA-q8h9-pqcx-59hw Apache Airflow exposes arbitrary file content |
Medium EPSS 0.62% |
< 2.3.4 | 2.3.4 |
| GHSA-5ff8-7639-6v6g Apache Airflow Session Fixation vulnerability |
Critical EPSS 2.19% |
>= 2.2.4, < 2.3.4rc1 | 2.3.4rc1 |
| GHSA-q8h9-pqcx-59hw Apache Airflow exposes arbitrary file content |
Medium EPSS 0.62% |
< 2.3.4 | 2.3.4 |
| GHSA-5ff8-7639-6v6g Apache Airflow Session Fixation vulnerability |
Critical EPSS 2.19% |
>= 2.2.4, < 2.3.4rc1 | 2.3.4rc1 |
| GHSA-65xw-pcqw-hjrh Apache Airflow Cross-site Scripting Vulnerability |
Medium EPSS 2.60% |
< 2.2.4rc1 | 2.2.4rc1 |
| GHSA-3v7g-4pg3-7r6j OS Command injection in Apache Airflow |
High EPSS 77.88% |
< 2.2.4 | 2.2.4 |
| GHSA-65xw-pcqw-hjrh Apache Airflow Cross-site Scripting Vulnerability |
Medium EPSS 2.60% |
< 2.2.4rc1 | 2.2.4rc1 |
| GHSA-3v7g-4pg3-7r6j OS Command injection in Apache Airflow |
High EPSS 77.88% |
< 2.2.4 | 2.2.4 |
| GHSA-4jh2-3c85-q67h Improper Privilege Management in apache-airflow |
Medium EPSS 1.71% |
< 2.2.0 | 2.2.0 |
| GHSA-4jh2-3c85-q67h Improper Privilege Management in apache-airflow |
Medium EPSS 1.71% |
>= 1.10.0, < 2.0.0b1>= 2.0.0, < 2.2.0 | 2.0.0b12.2.0 |
| GHSA-h88f-r7cw-8fv3 Missing Authentication for Critical Function in Apache Airflow |
Critical EPSS 80.94% |
>= 2.0.0, < 2.1.3 | 2.1.3 |
| GHSA-h88f-r7cw-8fv3 Missing Authentication for Critical Function in Apache Airflow |
Critical EPSS 80.94% |
>= 2.0.0, < 2.1.3 | 2.1.3 |
| GHSA-m6h2-jx9v-58w6 Missing Authorization in Apache Airflow |
Medium EPSS 5.45% |
< 2.1.2 | 2.1.2 |
| GHSA-m6h2-jx9v-58w6 Missing Authorization in Apache Airflow |
Medium EPSS 5.45% |
< 2.1.2 | 2.1.2 |
| GHSA-3xxv-p78r-4fc6 Cross-site Scripting in Apache Airflow |
Medium EPSS 14.39% |
< 1.10.15 | 1.10.15 |
| GHSA-3xxv-p78r-4fc6 Cross-site Scripting in Apache Airflow |
Medium EPSS 14.39% |
>= 1.8.1, < 1.10.15>= 2.0.0, < 2.0.2 | 1.10.152.0.2 |
| GHSA-3xxv-p78r-4fc6 Cross-site Scripting in Apache Airflow |
Medium EPSS 14.39% |
>= 2.0.0a1, < 2.0.2 | 2.0.2 |
| GHSA-fh37-cx83-q542 Improper Authentication in Apache Airflow |
Medium EPSS 4.55% |
< 2.0.1 | 2.0.1 |
| GHSA-ffw3-6mp6-jmvj Improper Access Control in Apache Airflow |
Medium EPSS 2.80% |
>= 2.0.0, < 2.0.1rc1 | 2.0.1rc1 |
| GHSA-ffw3-6mp6-jmvj Improper Access Control in Apache Airflow |
Medium EPSS 2.80% |
< 2.0.1 | 2.0.1 |
| GHSA-fh37-cx83-q542 Improper Authentication in Apache Airflow |
Medium EPSS 4.55% |
>= 2.0.0, < 2.0.1rc1 | 2.0.1rc1 |
| GHSA-7mx5-x372-xh87 Incorrect Session Validation in Apache Airflow |
High EPSS 23.86% |
< 1.10.14 | 1.10.14 |
| GHSA-7mx5-x372-xh87 Incorrect Session Validation in Apache Airflow |
High EPSS 23.86% |
< 1.10.14 | 1.10.14 |
| GHSA-6r3p-fcvm-xh7c SSRF vulnerability in Apache Airflow |
Medium EPSS 4.38% |
< 1.10.13 | 1.10.13 |
| GHSA-cvcq-gmc3-q6m8 Apache Airflow logs passwords in plaintext |
Low EPSS 2.62% |
< 1.10.13 | 1.10.13 |
| GHSA-cvcq-gmc3-q6m8 Apache Airflow logs passwords in plaintext |
Low EPSS 2.62% |
< 1.10.13 | 1.10.13 |
| GHSA-6r3p-fcvm-xh7c SSRF vulnerability in Apache Airflow |
Medium EPSS 4.38% |
< 1.10.13 | 1.10.13 |
| GHSA-86vp-x3pr-79rx Apache Airflow cross-site scripting due to incomplete fix for CVE-2020-13944 |
Medium EPSS 16.21% |
< 1.10.13 | 1.10.13 |
| GHSA-86vp-x3pr-79rx Apache Airflow cross-site scripting due to incomplete fix for CVE-2020-13944 |
Medium EPSS 16.21% |
>= 2.0.0b1, < 2.0.2rc1 | 2.0.2rc1 |
| GHSA-86vp-x3pr-79rx Apache Airflow cross-site scripting due to incomplete fix for CVE-2020-13944 |
Medium EPSS 16.21% |
< 1.10.15rc1 | 1.10.15rc1 |
| CVE-2020-13927 Authentication bypass in Apache Airflow Known exploited |
Critical EPSS 99.78% |
< 1.10.11 | 1.10.11 |
| CVE-2020-13927 Authentication bypass in Apache Airflow Known exploited |
Critical EPSS 99.78% |
< 1.10.11 | 1.10.11 |
| CVE-2020-13927 Authentication bypass in Apache Airflow Known exploited |
Critical EPSS 99.78% |
< 1.10.11 | 1.10.11 |
| GHSA-4pwq-fj89-6rjc Apache Airflow Cross-site Scripting |
Medium EPSS 25.08% |
< 1.10.12 | 1.10.12 |
| GHSA-4pwq-fj89-6rjc Apache Airflow Cross-site Scripting |
Medium EPSS 25.08% |
< 1.10.12 | 1.10.12 |
| CVE-2020-11978 Remote code execution (RCE) in Apache Airflow Known exploited |
High EPSS 99.19% |
< 1.10.11rc1 | 1.10.11rc1 |
| CVE-2020-11978 Remote code execution (RCE) in Apache Airflow Known exploited |
High EPSS 99.19% |
< 1.10.11rc1 | 1.10.11rc1 |
| GHSA-j38c-25fj-mr84 Stored XSS in Apache Airflow |
Medium EPSS 2.76% |
< 1.10.11 | 1.10.11 |
| GHSA-j38c-25fj-mr84 Stored XSS in Apache Airflow |
Medium EPSS 2.76% |
< 1.10.11rc1 | 1.10.11rc1 |
| GHSA-976r-qfjj-c24w Command injection via Celery broker in Apache Airflow |
Critical EPSS 36.79% |
< 1.10.11rc1 | 1.10.11rc1 |
| GHSA-976r-qfjj-c24w Command injection via Celery broker in Apache Airflow |
Critical EPSS 36.79% |
< 1.10.11rc1 | 1.10.11rc1 |
| GHSA-q4p3-qw5c-mhpc Multiple stored XSS in RBAC Admin screens in Apache Airflow |
Medium EPSS 1.77% |
< 1.10.11 | 1.10.11 |
| GHSA-q4p3-qw5c-mhpc Multiple stored XSS in RBAC Admin screens in Apache Airflow |
Medium EPSS 1.77% |
< 1.10.11rc1 | 1.10.11rc1 |
| GHSA-9g2w-5f3v-mfmm Insecure default config of Celery worker in Apache Airflow |
Critical EPSS 7.22% |
< 1.10.11rc1 | 1.10.11rc1 |
| GHSA-9g2w-5f3v-mfmm Insecure default config of Celery worker in Apache Airflow |
Critical EPSS 7.22% |
< 1.10.11 | 1.10.11 |
| CVE-2020-11978 Remote code execution (RCE) in Apache Airflow Known exploited |
High EPSS 99.19% |
< 1.10.11rc1 | 1.10.11rc1 |
| GHSA-rjvg-q57v-mjjc XSS in Apache Airflow |
Medium EPSS 2.82% |
< 1.10.5 | 1.10.5 |
| GHSA-rjvg-q57v-mjjc XSS in Apache Airflow |
Medium EPSS 2.82% |
< 1.10.5 | 1.10.5 |
| PYSEC-2020-181 In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to… Withdrawn |
Not rated yet | < 1.10.5 | 1.10.5 |
| PYSEC-2019-216 Apache Airflow vulnerable to XSS and local file disclosure |
Medium EPSS 1.28% |
< 1.10.6rc1 | 1.10.6rc1 |
| GHSA-8p7v-2jvj-v54r Apache Airflow vulnerable to Stored XSS |
Medium EPSS 2.66% |
< 1.10.3 | 1.10.3 |
| GHSA-w6j4-3gh2-9f5j Apache Airflow vulnerable to CSRF Attacks |
High EPSS 1.56% |
< 1.10.3b1 | 1.10.3b1 |
| GHSA-w6j4-3gh2-9f5j Apache Airflow vulnerable to CSRF Attacks |
High EPSS 1.56% |
< 1.10.3 | 1.10.3 |
| GHSA-8p7v-2jvj-v54r Apache Airflow vulnerable to Stored XSS |
Medium EPSS 2.66% |
< 1.10.3b1 | 1.10.3b1 |
| GHSA-99cv-8cvv-666c Apache Airflow vulnerable to Stored XSS |
Medium EPSS 1.96% |
< 1.10.2 | 1.10.2 |
| GHSA-99cv-8cvv-666c Apache Airflow vulnerable to Stored XSS |
Medium EPSS 1.96% |
< 1.10.2 | 1.10.2 |
| GHSA-9gqg-3fxr-9hv7 Apache Airflow vulnerable to XSS |
Critical EPSS 3.19% |
< 1.9.0 | 1.9.0 |
| GHSA-8fg4-j562-mjrc Improper Input Validation in Apache Airflow resulting in Remote Code Execution |
High EPSS 2.53% |
< 1.9.0 | 1.9.0 |
| GHSA-8fg4-j562-mjrc Improper Input Validation in Apache Airflow resulting in Remote Code Execution |
High EPSS 2.53% |
< 1.9.0 | 1.9.0 |
| GHSA-77rc-x84q-pv4f Improper Certificate Validation in Apache Airflow |
High EPSS 1.02% |
< 1.10.1 | 1.10.1 |
| GHSA-68wv-rjrm-576p Cross-Site Request Forgery (CSRF) in Apache Airflow |
High EPSS 2.04% |
< 1.9.0 | 1.9.0 |
| GHSA-9gqg-3fxr-9hv7 Apache Airflow vulnerable to XSS |
Critical EPSS 3.19% |
< 1.9.0 | 1.9.0 |
| GHSA-77rc-x84q-pv4f Improper Certificate Validation in Apache Airflow |
High EPSS 1.02% |
< 1.10.1 | 1.10.1 |
| GHSA-68wv-rjrm-576p Cross-Site Request Forgery (CSRF) in Apache Airflow |
High EPSS 2.04% |
< 1.9.0 | 1.9.0 |
| GHSA-rv25-9wgj-xg75 Apache Airflow Reflected Cross-site Scripting vulnerability in 404 Endpoint |
Medium EPSS 2.02% |
< 1.9.0 | 1.9.0 |
| GHSA-rv25-9wgj-xg75 Apache Airflow Reflected Cross-site Scripting vulnerability in 404 Endpoint |
Medium EPSS 2.02% |
< 1.9.0 | 1.9.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor