ROOT-APP-PYPI-CVE-2023-50943 CVE-2023-50943 in rootio-apache-airflow - Patched by Root

Root has patched CVE-2023-50943 in the rootio-apache-airflow package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2023-40712 CVE-2023-40712 in rootio-apache-airflow - Patched by Root

Root has patched CVE-2023-40712 in the rootio-apache-airflow package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-45034 CVE-2024-45034 in rootio-apache-airflow - Patched by Root

Root has patched CVE-2024-45034 in the rootio-apache-airflow package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2022-46651 CVE-2022-46651 in rootio-apache-airflow - Patched by Root

Root has patched CVE-2022-46651 in the rootio-apache-airflow package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2022-38170 CVE-2022-38170 in rootio-apache-airflow - Patched by Root

Root has patched CVE-2022-38170 in the rootio-apache-airflow package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2023-25754 CVE-2023-25754 in rootio-apache-airflow - Patched by Root

Root has patched CVE-2023-25754 in the rootio-apache-airflow package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2023-36543 CVE-2023-36543 in rootio-apache-airflow - Patched by Root

Root has patched CVE-2023-36543 in the rootio-apache-airflow package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2022-38054 CVE-2022-38054 in rootio-apache-airflow - Patched by Root

Root has patched CVE-2022-38054 in the rootio-apache-airflow package for Root:PyPI. Multiple fixed versions available...

Apache Airflow < 3.1.6 Information Disclosure

The version of Apache Airflow installed on the remote host is prior to 3.1.6. It is, therefore, affected by an information disclosure vulnerability: - The proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not...

Command Injection

Apache Airflow is vulnerable to Command Injection. The vulnerability is due to a non-validated parameter in the exampledagdecorator example DAG, which allows an attacker to redirect execution to a malicious server and execute arbitrary code on a worker when example DAGs are enabled...

GHSA-27JP-WM6Q-GP25 vulnerabilities

Vulnerabilities for packages: airflow-core, superset, airflow...

CVE-2026-22922 vulnerabilities

Vulnerabilities for packages: airflow-core, airflow...

GHSA-PM44-X5X7-24C4 vulnerabilities

Vulnerabilities for packages: airflow-core, airflow...

CVE-2026-22922 vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-PM44-X5X7-24C4 vulnerabilities

Vulnerabilities for packages: airflow...

BIT-AIRFLOW-2026-24098 Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors

Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. Users are advised to upgrade to 3.1.7 or later, which resolves this issue...

BIT-AIRFLOW-2026-22922 Apache Airflow: Airflow externalLogUrl Permission Bypass

Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this...

GHSA-CHG9-3C3P-CH23 vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2015-7764 vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-24098

Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. Users are advised to upgrade to 3.1.7 or later, which resolves this issue...