Apache Airflow vulnerabilities and CVEs
Known vulnerabilities affecting Apache Airflow, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.
67 vulnerabilities tracked. 1 with public exploit code.
- 9.8 A bug in BaseSerialization.deserialize() allowed unrestricted importstring() of attacker-controlled class paths when the Scheduler / API…
- 9.1 Apache Airflow: the Core API logout endpoint revokes only a session token presented as the token cookie.
- 9.1 Apache Airflow's official documentation at core-concepts/dag-run.html ("Passing Parameters when triggering Dags") showed a verbatim…
- 9.1 When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case…
- 8.8 Apache Airflow's serialization layer reconstructed exception nodes by calling importstring() on a class name taken from the serialized blob…
- 8.8 Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by…
- 8.8 A bug in Apache Airflow's XCom PATCH endpoint PATCH /api/v2/xcomEntries/{key} allowed an authenticated UI/API user with XCom write…
- 8.8 A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate against the Execution API to be passed…
- 8.8 An example of BashOperator in Airflow documentation suggested a way of passing dagrun.conf in the way that could cause unsanitized user…
- 8.8 Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to…
- 8.8 Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a docmd parameter in a…
- 8.1 The example examplexcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that…
- 8.1 Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints…
- 7.5 Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with READ instead of EDIT.
- 7.5 Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to…
- 7.5 A bug in Apache Airflow's bulk Task Instances API (PATCH/DELETE /api/v2/dags/{dagid}/dagRuns/{dagrunid}/taskInstances) evaluated…
- 7.5 In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/exposestacktraces" was set to false.
- 7.5 UI / API User with asset materialize permission could trigger dags they had no access to.
- 7.5 JWT Tokens used by tasks were exposed in logs.
- 7.5 Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay…
- 7.5 Apache Airflow versions 3.1.0 through 3.1.7 session token (token) in cookies is set to path=/ regardless of the configured [webserver]…
- 7.5 In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing…
- 7.5 In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] maxtemplatedfieldlength, sensitive values…
- 7.3 Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new awaitinginput task state swept by the scheduler.
- 7.3 Apache Airflow's scheduler-side deadline-reference decoder (SerializedCustomReference.deserializereference) imported and dispatched…
- 7.2 A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the issafeurl check, enabling…
- 7.2 Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to…
- 6.5 Apache Airflow's secrets masker did not mask var.json Variable values whose value is a dict in the Rendered Templates UI — the dict value…
- 6.5 Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments.
- 6.5 Apache Airflow wrote Variable values and Connection extra contents to the audit log in cleartext when they were submitted through the bulk…
- 6.5 Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in…
- 6.5 Apache Airflow's asset materialization endpoint (POST /api/v2/assets/{assetid}/materialize) and the XCom result check on…
- 6.5 In Apache Airflow before 3.3.0, the REST API task-instance detail and list endpoints returned a deferred task's trigger kwargs without…
- 6.5 The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based shouldhidevalueforkey…
- 6.5 Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file.
- 6.5 The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like AIRFLOWSECRETSBACKENDKWARGSECRETID…
- 6.5 A Dag author could either (a) create a symlink under their task's log directory pointing to an arbitrary file readable by the API server…
- 6.5 A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g.
- 6.5 A bug in Apache Airflow's Variable response masker caused nested-key redaction (triggered by secret-suffixed key names like password,…
- 6.5 A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the…
- 6.5 A bug in the GET /api/v2/connections/{connectionid} REST API endpoint in Apache Airflow allowed an authenticated UI/API user with…
- 6.5 The accesskey and connectionstring connection properties were not marked as sensitive names in secrets masker.
- 6.5 Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read…
- 6.5 Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request…
- 6.5 When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators.
- 6.5 Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions…
- 6.5 Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to…
- 6.5 Apache Airflow 3 introduced a change to the handling of sensitive information in Connections.
- 5.9 Apache Airflow's EmailOperator and the underlying airflow.utils.email helpers established SMTP STARTTLS connections without verifying the…
- 5.9 Apache Airflow's JWTRefreshMiddleware set the JWT auth cookie without the Secure flag, so deployments running the Airflow API server behind…
- 5.4 Apache Airflow's XCom GET /api/v2/{...}/xcomEntries/{key}?deserialize=true endpoint passed a string-literal payload through…
- 5.4 Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope.
- 5.4 API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the…
- 4.6 An example dag exampledagdecorator had non-validated parameter that allowed the UI user to redirect the example to a malicious server and…
- 4.3 Apache Airflow's /assets/events API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the…
- 4.3 Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI.
- 4.3 A bug in Apache Airflow's /ui/dependencies scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized…
- 4.3 The partitioneddagruns endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization.
- 4.3 The Event Log detail endpoint GET /api/v2/eventLogs/{eventlogid} in Apache Airflow fetched audit-log rows directly by numeric ID after only…
- 4.3 The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance records: a…
Showing the 60 that warrant attention first, of 67. Search the full feed for Apache Airflow.
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that Apache Airflow is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other products tracked here
Chrome Zephyr Android Windows Server 2022 Windows 11 Version 24H2 Windows 11 version 26H1 Windows Server 2025 Windows Server 2025 (Server Core installation) Windows 11 Version 25H2 Windows Server 2019 (Server Core installation) Windows Server 2019 Windows 10 Version 21H2 Windows 10 Version 1809 Windows 10 Version 22H2 macOS Red Hat Enterprise Linux 9 Windows Server 2016 Windows Server 2016 (Server Core installation) n/a Windows 10 Version 1607 Windows Server 2012 R2 (Server Core installation) Windows Server 2012 R2 Windows Server 2012 (Server Core installation) Windows Server 2012