CVE-2023-22884-Airflow-SQLi

PoC de inyección SQL en Apache Airflow CVE-2023-22884 PoC para CVE-2023-22884 es una vulnerabilidad RCE de Apache Airflow que afecta a versiones anteriores a 2.4.0. La descripción del informe oficial dice: Vulnerabilidad de Neutralización Incorrecta de Elementos Especiales utilizados en un Comand...

CVE-2026-25604-PoC

CVE-2026-25604 PoC Host Header Injection leading to SAML authentication bypass in Apache Airflow's AWS Auth Manager An attacker can inject a malicious Host header into the SAML login flow, causing the Assertion Consumer Service ACS URL to point to an attacker-controlled server. This allows the...

CVE-2026-59243_exploit

CVE-2026-59243 — Apache Airflow FAB Provider OAuth Auth Bypass → DAG RCE Authentication bypass in Apache Airflow's FAB auth-manager provider apache-airflow-providers-fab, leading to remote code execution via a triggered DAG. The provider decodes the Azure OAuthidtoken with signature verification...

CVE-2026-32794

CVE-2026-32794: TLS Certificate Verification Bypass in Apache Airflow Databricks Provider Keywords: TLS, certificate verification, MITM, Kubernetes, Databricks, OAuth, CWE-295, Apache Airflow Table of Contents Overview Vulnerability Details Technical Analysis Attack Chain Impact Remediation...

airflowscan

airflowscan Checklist and tools for increasing security of Apache Airflow. DISCLAIMER This project NOT AFFILIATED with the Apache Foundation and the Airflow project, and is not endorsed by them. Contents The purpose of this project is provide tools to increase security of Apache Airflow...

airflowscan

airflowscan Lista de verificación y herramientas para aumentar la seguridad de Apache Airflow. AVISO Este proyecto NO ESTÁ AFILIADO con la Apache Foundation ni con el proyecto Airflow, y no cuenta con su respaldo. Contenido El propósito de este proyecto es proporcionar herramientas para aumentar ...

CVE-2022-40127-Airflow-RCE

Apache Airflow Una vulnerabilidad en los DAGs de ejemplo de Apache Airflow permite que un atacante con acceso a la interfaz de usuario que pueda activar DAGs, ejecute comandos arbitrarios a través del parámetro runid proporcionado manualmente. Este problema afecta a Apache Airflow versiones...

GHSA-W6J9-CWV2-H6WQ vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, authentik-fips, openstack-glance-2025.2-fips, openstack-placement-2026.1-fips, openstack-manila-2026.1, superset, openstack-octavia-2025.2, openstack-placement-2025.1, datadog-agent-fips, openstack-heat-2025.2, datadog-agent, open-webui...

CVE-2026-101917 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, authentik-fips, openstack-glance-2025.2-fips, openstack-placement-2026.1-fips, openstack-manila-2026.1, superset, openstack-octavia-2025.2, openstack-placement-2025.1, datadog-agent-fips, openstack-heat-2025.2, datadog-agent, open-webui...

CVE-2026-102274 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, authentik-fips, openstack-glance-2025.2-fips, openstack-placement-2026.1-fips, openstack-manila-2026.1, superset, openstack-octavia-2025.2, openstack-placement-2025.1, datadog-agent-fips, openstack-heat-2025.2, datadog-agent, open-webui...

GHSA-P4G4-X82P-Q773 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, authentik-fips, openstack-glance-2025.2-fips, openstack-placement-2026.1-fips, openstack-manila-2026.1, superset, openstack-octavia-2025.2, openstack-placement-2025.1, datadog-agent-fips, openstack-heat-2025.2, datadog-agent, open-webui...

GHSA-9V7F-9G4P-FFGJ vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, authentik-fips, openstack-glance-2025.2-fips, openstack-placement-2026.1-fips, openstack-manila-2026.1, superset, openstack-octavia-2025.2, openstack-placement-2025.1, datadog-agent-fips, openstack-heat-2025.2, datadog-agent, open-webui...

GHSA-FFC3-869F-JXW9 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, authentik-fips, openstack-glance-2025.2-fips, openstack-placement-2026.1-fips, openstack-manila-2026.1, superset, openstack-octavia-2025.2, openstack-placement-2025.1, datadog-agent-fips, openstack-heat-2025.2, datadog-agent, open-webui...

CVE-2026-102268 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, authentik-fips, openstack-glance-2025.2-fips, openstack-placement-2026.1-fips, openstack-manila-2026.1, superset, openstack-octavia-2025.2, openstack-placement-2025.1, datadog-agent-fips, openstack-heat-2025.2, datadog-agent, open-webui...

CVE-2026-102267 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, authentik-fips, openstack-glance-2025.2-fips, openstack-placement-2026.1-fips, openstack-manila-2026.1, superset, openstack-octavia-2025.2, openstack-placement-2025.1, datadog-agent-fips, openstack-heat-2025.2, datadog-agent, open-webui...

GHSA-2GX3-RCP4-G85Q vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, authentik-fips, openstack-glance-2025.2-fips, openstack-placement-2026.1-fips, openstack-manila-2026.1, superset, openstack-octavia-2025.2, openstack-placement-2025.1, datadog-agent-fips, openstack-heat-2025.2, datadog-agent, open-webui...

CVE-2026-102271 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, authentik-fips, openstack-glance-2025.2-fips, openstack-placement-2026.1-fips, openstack-manila-2026.1, superset, openstack-octavia-2025.2, openstack-placement-2025.1, datadog-agent-fips, openstack-heat-2025.2, datadog-agent, open-webui...

Apache Airflow - Unauthenticated Variable Import

Apache Airflow Airflow =2.0.0 and =2.0.0 and 2.1.3 does not protect the variable import endpoint which allows unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution...

Apache Airflow <1.10.14 - Authentication Bypass

Apache Airflow prior to 1.10.14 contains an authentication bypass vulnerability via incorrect session validation with default configuration. An attacker on site A can access unauthorized Airflow on site B through the site A session. id: CVE-2020-17526 info: name: Apache Airflow 1.10.14 -...

AirFlow < 2.4.0 - Remote Code Execution

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided runid parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0. id: CVE-2022-40127 info: name: AirFlow 2.4.0 -...