Security
فارسی
All products

apache-airflow

PyPI · Package
158 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Apache Airflow: Authenticated users can bypass the `is_safe_url` checkCVE-2026-40961 · GHSA-6HCW-QQR8-PJJ8Version ranges need review. apache-airflow PyPI High Fix reported
Command Injection in Apache Airflow and Apache Airflow MySQL ProviderCVE-2023-22884 · GHSA-C732-XVV8-G94CVersion ranges need review. apache-airflow-providers-mysqlapache-airflow PyPI Critical Fix reported
Apache Airflow Sqoop Provider Improper Input Validation vulnerabilityCVE-2023-25693 · GHSA-J69X-V4WC-3FPFVersion ranges need review. apache-airflow-providers-apache-sqoopapache-airflow PyPI Critical Fix reported
Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server contextCVE-2025-67895 · GHSA-66H8-3G48-6HX8Version ranges need review. apache-airflow-providers-edge3apache-airflow PyPI Critical Fix reported
Apache Airflow: JWT token still valid after logoutCVE-2025-57735 · GHSA-C92R-G8J5-VHCXVersion ranges need review. apache-airflow PyPI Critical Fix reported
OS Command Injection in Apache AirflowCVE-2022-38649 · GHSA-7WQF-H36W-47MCVersion ranges need review. apache-airflow PyPI Critical Fix reported
OS Command Injection in Apache AirflowCVE-2022-40189 · GHSA-RMF2-PWFQ-H75JVersion ranges need review. apache-airflow PyPI Critical Fix reported
Apache Airflow exception-node deserialization permits arbitrary callable executionCVE-2026-58076 · GHSA-8PRW-8M6X-8W6FVersion ranges need review. apache-airflow PyPI High Fix reported
Apache Airflow XCom API permits unsafe deserialization through JSON string literalsCVE-2026-59242 · GHSA-FCMM-42R9-MMMMVersion ranges need review. apache-airflow PyPI Medium Fix reported
Apache Airflow Config API exposes team-scoped sensitive configuration valuesCVE-2026-65017 · GHSA-C56V-8W4G-3MFMVersion ranges need review. apache-airflow PyPI Medium Fix reported
Apache Airflow Task SDK Callback deserialization can import arbitrary modules in the schedulerCVE-2026-67587 · GHSA-2QJV-P2GC-MJG2Version ranges need review. apache-airflow PyPI High Fix reported
Apache Airflow Task SDK fails to mask list-shaped JSON VariablesCVE-2026-68970 · GHSA-F3C2-J7G8-VPP8Version ranges need review. apache-airflow PyPI Medium Fix reported
Apache Airflow missing team context permits cross-team Dag actions and XCom readsCVE-2026-68971 · GHSA-5247-M8W9-2V4MVersion ranges need review. apache-airflow PyPI Medium Fix reported
Apache Airflow scheduler unsafely deserializes human-in-the-loop task next_kwargsCVE-2026-67260 · GHSA-Q4C3-7575-55J2Version ranges need review. apache-airflow PyPI High Fix reported
Apache Airflow Backfill API parser discrepancy permits cross-DAG authorization bypassCVE-2026-68968 · GHSA-J4JC-CQ9H-XRHRVersion ranges need review. apache-airflow PyPI High Fix reported
Apache Airflow environment-variable secrets backend permits cross-team credential useCVE-2026-68076 · GHSA-75MG-C62R-V95GVersion ranges need review. apache-airflow PyPI Medium Fix reported
Apache Airflow exposes dict-valued var.json secrets in Rendered TemplatesCVE-2026-59244 · GHSA-F643-3RC2-J27WVersion ranges need review. apache-airflow PyPI Medium Fix reported
Apache Airflow bulk endpoints log Variable and Connection secrets in cleartextCVE-2026-68969 · GHSA-CJV4-7HP2-2X9HVersion ranges need review. apache-airflow PyPI Medium Fix reported
Apache Airflow Variables UI fails to mask sensitive values in deeply nested iterablesCVE-2026-54183 · GHSA-G4QJ-5VXV-WGGFVersion ranges need review. apache-airflow PyPI Medium Fix reported
PYSEC-2026-3989CVE-2026-82355 · PYSEC-2026-3989 apache-airflow PyPI Medium No fix reported