CVE-2026-59243_exploit

CVE-2026-59243 — Apache Airflow FAB Provider OAuth 認証バイパス → DAG RCE Apache Airflow の FAB 認証マネージャープロバイダー（apache-airflow-providers-fab）における認証バイパス。トリガーされた DAG を介してリモートコード実行（RCE）に至ります。 このプロバイダーは Azure OAuthidtoken を、署名検証がデフォルトで無効のままデコードします（airflow/providers/fab/authmanager/securitymanager/override.py...

CVE-2026-32794

CVE-2026-32794: Apache Airflow Databricks Provider における TLS 証明書検証バイパス キーワード: TLS、証明書検証、MITM、Kubernetes、Databricks、OAuth、CWE-295、Apache Airflow 目次 概要 脆弱性の詳細 技術分析 攻撃チェーン 影響 修復策 タイムライン 参考情報 連絡先 免責事項 概要 apache-airflow-providers-databricks パッケージは、フェデレーショントークン交換中に Kubernetes API サーバーと通信する際、TLS...

airflowscan

airflowscan Checklist and tools for increasing security of Apache Airflow. DISCLAIMER This project NOT AFFILIATED with the Apache Foundation and the Airflow project, and is not endorsed by them. Contents The purpose of this project is provide tools to increase security of Apache Airflow...

airflowscan

airflowscan Apache Airflow의 보안을 강화하기 위한 체크리스트 및 도구입니다. 면책 조항 이 프로젝트는 Apache Foundation 및 Airflow 프로젝트와 제휴 관계가 없으며, 이들로부터 승인받지 않았습니다. 목차 이 프로젝트의 목적은 Apache Airflow 설치의 보안을 강화하는 도구를 제공하는 것입니다. 이 프로젝트는 다음 도구들을 제공합니다: 보안 설정이 강화된 구성 파일 - hardenedairflow.cfg 참조. 기본 설치 보안 강화를 위한 보안 체크리스트 - CHECKLIST.MD...

CVE-2022-40127-Airflow-RCE

Apache Airflow Apache AirflowのExample Dagsの脆弱性により、UIアクセスを持ちDAGをトリガーできる攻撃者が、手動で提供されたrunidパラメータを介して任意のコマンドを実行できます。この問題はApache Airflowのバージョン2.4.0未満に影響します。 このリポジトリは、vsocietyブログで公開されているCVE分析ブログ記事のために作成されました。 https://github.com/jakabakos/CVE-2022-40127/assets/42498816/2094f2ec-f074-41e6-99f4-f9f77dd09d...

GHSA-W6J9-CWV2-H6WQ vulnerabilities

Vulnerabilities for packages: openstack-octavia-2025.2, openstack-nova-2025.1, ggshield, open-webui, openstack-neutron-2026.1, openstack-octavia-2026.1, openstack-horizon-2026.1-fips, openstack-horizon-2025.2, openstack-keystone-2026.1, openstack-glance-2025.2-fips, openstack-designate-2025.2,...

CVE-2026-102274 vulnerabilities

Vulnerabilities for packages: openstack-octavia-2025.2, openstack-nova-2025.1, ggshield, open-webui, openstack-neutron-2026.1, openstack-octavia-2026.1, openstack-horizon-2026.1-fips, openstack-horizon-2025.2, openstack-keystone-2026.1, openstack-glance-2025.2-fips, openstack-designate-2025.2,...

CVE-2026-101917 vulnerabilities

Vulnerabilities for packages: openstack-octavia-2025.2, openstack-nova-2025.1, ggshield, open-webui, openstack-neutron-2026.1, openstack-octavia-2026.1, openstack-horizon-2026.1-fips, openstack-horizon-2025.2, openstack-keystone-2026.1, openstack-glance-2025.2-fips, openstack-designate-2025.2,...

GHSA-9V7F-9G4P-FFGJ vulnerabilities

Vulnerabilities for packages: openstack-octavia-2025.2, openstack-nova-2025.1, ggshield, open-webui, openstack-neutron-2026.1, openstack-octavia-2026.1, openstack-horizon-2026.1-fips, openstack-horizon-2025.2, openstack-keystone-2026.1, openstack-glance-2025.2-fips, openstack-designate-2025.2,...

GHSA-FFC3-869F-JXW9 vulnerabilities

Vulnerabilities for packages: openstack-octavia-2025.2, openstack-nova-2025.1, ggshield, open-webui, openstack-neutron-2026.1, openstack-octavia-2026.1, openstack-horizon-2026.1-fips, openstack-horizon-2025.2, openstack-keystone-2026.1, openstack-glance-2025.2-fips, openstack-designate-2025.2,...

GHSA-P4G4-X82P-Q773 vulnerabilities

Vulnerabilities for packages: openstack-octavia-2025.2, openstack-nova-2025.1, ggshield, open-webui, openstack-neutron-2026.1, openstack-octavia-2026.1, openstack-horizon-2026.1-fips, openstack-horizon-2025.2, openstack-keystone-2026.1, openstack-glance-2025.2-fips, openstack-designate-2025.2,...

GHSA-2GX3-RCP4-G85Q vulnerabilities

Vulnerabilities for packages: openstack-octavia-2025.2, openstack-nova-2025.1, ggshield, open-webui, openstack-neutron-2026.1, openstack-octavia-2026.1, openstack-horizon-2026.1-fips, openstack-horizon-2025.2, openstack-keystone-2026.1, openstack-glance-2025.2-fips, openstack-designate-2025.2,...

CVE-2026-102267 vulnerabilities

Vulnerabilities for packages: openstack-octavia-2025.2, openstack-nova-2025.1, ggshield, open-webui, openstack-neutron-2026.1, openstack-octavia-2026.1, openstack-horizon-2026.1-fips, openstack-horizon-2025.2, openstack-keystone-2026.1, openstack-glance-2025.2-fips, openstack-designate-2025.2,...

CVE-2026-102268 vulnerabilities

Vulnerabilities for packages: openstack-octavia-2025.2, openstack-nova-2025.1, ggshield, open-webui, openstack-neutron-2026.1, openstack-octavia-2026.1, openstack-horizon-2026.1-fips, openstack-horizon-2025.2, openstack-keystone-2026.1, openstack-glance-2025.2-fips, openstack-designate-2025.2,...

CVE-2026-102271 vulnerabilities

Vulnerabilities for packages: openstack-octavia-2025.2, openstack-nova-2025.1, ggshield, open-webui, openstack-neutron-2026.1, openstack-octavia-2026.1, openstack-horizon-2026.1-fips, openstack-horizon-2025.2, openstack-keystone-2026.1, openstack-glance-2025.2-fips, openstack-designate-2025.2,...

CVE-2023-22884-Airflow-SQLi

Apache Airflow SQLインジェクション PoC CVE-2023-22884 CVE-2023-22884 の PoC は、2.4.0 より前のバージョンに影響する Apache Airflow の RCE 脆弱性です。 公式レポートの説明には次のように記載されています: Apache Software Foundation Apache Airflow および Apache Software Foundation Apache Airflow MySQL Provider における、コマンドに使用される特殊要素の不適切な無害化（'Command...

Apache Airflow - Unauthenticated Variable Import

Apache Airflow Airflow =2.0.0 and =2.0.0 and 2.1.3 does not protect the variable import endpoint which allows unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution...

Apache Airflow <1.10.14 - Authentication Bypass

Apache Airflow prior to 1.10.14 contains an authentication bypass vulnerability via incorrect session validation with default configuration. An attacker on site A can access unauthorized Airflow on site B through the site A session. id: CVE-2020-17526 info: name: Apache Airflow 1.10.14 -...

AirFlow < 2.4.0 - Remote Code Execution

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided runid parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0. id: CVE-2022-40127 info: name: AirFlow 2.4.0 -...

Insufficiently Protected Credentials

Overview apache-airflow-providers-snowflake is a Provider package apache-airflow-providers-snowflake for Apache Airflow Affected versions of this package are vulnerable to Insufficiently Protected Credentials via unsanitized interpolation of the account and region connection fields into Snowflake...