CVE-2026-28802 vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-7WC2-QXGW-G8GG vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-9R5J-7R2X-RV4G vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2025-69219 vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-25604 vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-RV5F-CCPM-XJJ4 vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-28802 vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-25604 vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-RV5F-CCPM-XJJ4 vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-7WC2-QXGW-G8GG vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-9R5J-7R2X-RV4G vulnerabilities

Vulnerabilities for packages: airflow, airflow-core...

CVE-2025-69219 vulnerabilities

Vulnerabilities for packages: airflow, airflow-core...

Exploit for Improper Control of Dynamically-Managed Code Resources in Apache Airflow_Providers_Http

CVE-2025-69219 — Apache Airflow Providers HTTP RCE via Unsafe...

CVE-2025-69219

A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same permissions as Dag Author. Since direct DB access is not usual and recommended for Airflow, the likelihood of it making any damage is low...

Improper Control of Dynamically-Managed Code Resources

Overview apache-airflow-providers-http is a Provider package apache-airflow-providers-http for Apache Airflow Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources via the HttpTrigger’s pickle-based serialization in the deferred HTTP task...

Origin Validation Error

Overview apache-airflow-providers-amazon is a Provider for Apache Airflow. Implements apache-airflow-providers-amazon package Affected versions of this package are vulnerable to Origin Validation Error in the SAML authentication process due to improper verification of the origin provided by the...

EUVD-2025-208401

A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same permissions as Dag Author. Since direct DB access is not usual and recommended for Airflow, the likelihood of it making any damage is low...

GHSA-9R5J-7R2X-RV4G Apache Airflow Providers Http has Unsafe Pickle Deserializatio leading to RCE via HttpOperator

A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same permissions as Dag Author. Since direct DB access is not usual and recommended for Airflow, the likelihood of it making any damage is low...

Apache Airflow Providers Http has Unsafe Pickle Deserializatio leading to RCE via HttpOperator

A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same permissions as Dag Author. Since direct DB access is not usual and recommended for Airflow, the likelihood of it making any damage is low...

GHSA-RV5F-CCPM-XJJ4 Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...