PYSEC-2026-3993

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

CVE-2026-65017

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

PYSEC-2026-3993

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

CVE-2026-67587

Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default alloweddeserializationclasses allow-list, so tightening that...

CVE-2026-65017

In Apache Airflow , the Config API fails to mask team-scoped sensitive configuration values in multi-team deployments. When multi-team mode is active and the Config API is exposed, an authenticated Viewer with only configuration-read access can read a team-scoped Celery broker URL in cleartext, i...

CVE-2026-65017 Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

CVE-2026-65017 Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

CVE-2026-65017

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

CVE-2026-65017 Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

EUVD-2026-57272

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

CVE-2026-68432

A flaw was found in the Linux kernel's VXLAN Virtual Extensible LAN implementation. A local attacker, with CAPNETADMIN network administration capability in one network namespace, could exploit an incorrect privilege check in the rtnl changelink path. This allows the attacker to modify the...

Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint

Summary The target search endpoint POST /api/latest/fleet/targets returned team enroll secrets and full team configuration, including credential-bearing agent options, to observer-class users. Other team-facing endpoints mask these fields for observers; the target search endpoint did not apply th...

CVE-2026-66016

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users...

MAL-2026-13871 Malicious code in @years17/n8n-nodes-utils-helper-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55dc5bbe5a3b2dfb5bf97920ee68027b585bc2b21f4388e88a25986318754397 The package runs credential-harvesting recon both from its postinstall script and from its main entry executed at require time. The postinstall...

Malicious code in @noxzacode/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d51e06f0702bd125716dddf0bae250e419a3ce6b03f0faab8f64e4fde5146f72 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-13780 Malicious code in @noxzacode/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d51e06f0702bd125716dddf0bae250e419a3ce6b03f0faab8f64e4fde5146f72 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview upshift-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @noxzacode/eslint-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

PT-2026-71463

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description The pgcrypto module allows cleartext storage when disable...

CVE-2026-65017: Exposure of Sensitive Information to an Unauthorized Actor

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...