airflow-clickhouse-plugin (>=0.10.0, <=0.10.1), airflow-provider-ibm-db2 (0.1.2) potentially affected by CVE-2026-48828 via apache-airflow (2.5.3)

apache-airflow PYPI version 2.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.10.0, =0.10.1 - airflow-provider-ibm-db2 0.1.2 Source cves: CVE-2026-48828 Source advisory:...

airflow-clickhouse-plugin (>=0.10.0, <=0.10.1), airflow-provider-ibm-db2 (0.1.2) potentially affected by CVE-2026-68970 via apache-airflow (2.5.3)

apache-airflow PYPI version 2.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.10.0, =0.10.1 - airflow-provider-ibm-db2 0.1.2 Source cves: CVE-2026-68970 Source advisory:...

airflow-clickhouse-plugin (>=0.10.0, <=0.10.1), airflow-provider-ibm-db2 (0.1.2) potentially affected by CVE-2026-59242 via apache-airflow (2.5.3)

apache-airflow PYPI version 2.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.10.0, =0.10.1 - airflow-provider-ibm-db2 0.1.2 Source cves: CVE-2026-59242 Source advisory:...

airflow-clickhouse-plugin (>=0.10.0, <=0.10.1), airflow-provider-ibm-db2 (0.1.2) potentially affected by CVE-2026-68076 via apache-airflow (2.5.3)

apache-airflow PYPI version 2.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.10.0, =0.10.1 - airflow-provider-ibm-db2 0.1.2 Source cves: CVE-2026-68076 Source advisory:...

airflow-calendar (>=0.5.0, <=0.9.1), airflow-provider-great-expectations (1.0.0) +2 more potentially affected by CVE-2026-58076 via apache-airflow (>=3.3.0, <=3.3.1rc2)

apache-airflow PYPI version =3.3.0, =0.5.0, =3.3.0, =1.3.0, =1.3.1rc2 Source cves: CVE-2026-58076 Source advisory: GHSA-8PRW-8M6X-8W6F...

airflow-clickhouse-plugin (>=0.10.0, <=0.10.1), airflow-provider-ibm-db2 (0.1.2) potentially affected by CVE-2026-59244 via apache-airflow (2.5.3)

apache-airflow PYPI version 2.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.10.0, =0.10.1 - airflow-provider-ibm-db2 0.1.2 Source cves: CVE-2026-59244 Source advisory:...

airflow-clickhouse-plugin (>=0.10.0, <=0.10.1), airflow-provider-ibm-db2 (0.1.2) potentially affected by CVE-2026-68968 via apache-airflow (2.5.3)

apache-airflow PYPI version 2.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.10.0, =0.10.1 - airflow-provider-ibm-db2 0.1.2 Source cves: CVE-2026-68968 Source advisory:...

airflow-clickhouse-plugin (>=0.10.0, <=0.10.1), airflow-provider-ibm-db2 (0.1.2) potentially affected by CVE-2026-68076 via apache-airflow (2.5.3)

apache-airflow PYPI version 2.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.10.0, =0.10.1 - airflow-provider-ibm-db2 0.1.2 Source cves: CVE-2026-68076 Source advisory:...

airflow-calendar (>=0.5.0, <=0.9.1), airflow-provider-great-expectations (1.0.0) +2 more potentially affected by CVE-2026-58076 via apache-airflow (>=3.3.0, <=3.3.1rc2)

apache-airflow PYPI version =3.3.0, =0.5.0, =3.3.0, =1.3.0, =1.3.1rc2 Source cves: CVE-2026-58076 Source advisory: OSV:PYSEC-2026-3991...

airflow-clickhouse-plugin (>=0.10.0, <=0.10.1), airflow-provider-ibm-db2 (0.1.2) potentially affected by CVE-2026-54183 via apache-airflow (2.5.3)

apache-airflow PYPI version 2.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.10.0, =0.10.1 - airflow-provider-ibm-db2 0.1.2 Source cves: CVE-2026-54183 Source advisory:...

airflow-provider-appops (>=0.0.3, <=0.0.4), astronomer-providers (1.0.0) +1 more potentially affected by CVE-2026-68868 via apache-airflow-providers-google (6.8.0)

apache-airflow-providers-google PYPI version 6.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - airflow-provider-appops =0.0.3, =0.0.4, =0.1.4 Source cves: CVE-2026-68868 Source advisory:...

Exploit for CVE-2026-59243

CVE-2026-59243 — Apache Airflow FAB Provider OAuth Auth Bypass...

CLSA-2026-1779670115 TuxCare security update for apache-airflow-providers-http (1 CVE)

TuxCare rebuilt apache-airflow-providers-http to address 1 CVE. Fixed in 4.13.3.post1+tuxcare...

Malicious Package

Overview airflow-provider-spirit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious code in airflow-provider-spirit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84edc3b5fdf650aec875a1381b60bf2bb811f0c813ca6841052730fcee025bc3 The package is published as an Airflow provider but ships no provider code. setup.py installs telemetry.pth into site-packages, which auto-imports...

MAL-2026-10754 Malicious code in airflow-provider-spirit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84edc3b5fdf650aec875a1381b60bf2bb811f0c813ca6841052730fcee025bc3 The package is published as an Airflow provider but ships no provider code. setup.py installs telemetry.pth into site-packages, which auto-imports...

airflow-clickhouse-plugin (>=0.10.0, <=0.10.1), airflow-provider-ibm-db2 (0.1.2) potentially affected by CVE-2026-46764 via apache-airflow (2.5.3)

apache-airflow PYPI version 2.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.10.0, =0.10.1 - airflow-provider-ibm-db2 0.1.2 Source cves: CVE-2026-46764 Source advisory:...

airflow-clickhouse-plugin (>=0.10.0, <=0.10.1), airflow-provider-ibm-db2 (0.1.2) potentially affected by CVE-2026-42358 via apache-airflow (2.5.3)

apache-airflow PYPI version 2.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.10.0, =0.10.1 - airflow-provider-ibm-db2 0.1.2 Source cves: CVE-2026-42358 Source advisory:...

CVE-2026-59245 Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision)

In the Apache Airflow FAB auth manager, a DAG whose dagid is DAGs collided with the global all-DAGs permission resource name produced by resourcename, so a user granted per-DAG accesscontrol on that one DAG was silently granted the global all-DAGs permission privilege escalation. The escalation...

airflow-clickhouse-plugin (>=0.10.0, <=0.10.1), airflow-provider-ibm-db2 (0.1.2) potentially affected by CVE-2025-54550 via apache-airflow (2.5.3)

apache-airflow PYPI version 2.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.10.0, =0.10.1 - airflow-provider-ibm-db2 0.1.2 Source cves: CVE-2025-54550 Source advisory:...