GHSA-G6CJ-PR64-35W5 vulnerabilities

Vulnerabilities for packages: authentik, openstack-placement-2025.2, dbt-bigquery, openstack-glance-2025.2, datadog-agent-fips, in-toto, vllm-openai-cuda-13.0, gitlab-cng-fips, kserve, openstack-placement-2025.1, apache-beam-python-3.12-sdk, crossplane-function-pythonic,...

GHSA-V3Q9-HJ7J-63HQ vulnerabilities

Vulnerabilities for packages: airflow-core...

CVE-2026-59881 vulnerabilities

Vulnerabilities for packages: kserve, apache-beam-python-3.12-sdk, dask-kubernetes-fips, lmcache-cuda-12.8, py3.13-scanner-test-libraries-aiohttp, datahub-ingestion-fips, airflow, py3-cassandra-medusa, tritonserver-backend-vllm-cuda-13.0, dask-kubernetes, awx, apache-beam-python-3.13-sdk,...

GHSA-MQ44-7P77-Q5H7 vulnerabilities

Vulnerabilities for packages: kserve, apache-beam-python-3.12-sdk, dask-kubernetes-fips, lmcache-cuda-12.8, py3.13-scanner-test-libraries-aiohttp, datahub-ingestion-fips, airflow, py3-cassandra-medusa, tritonserver-backend-vllm-cuda-13.0, dask-kubernetes, awx, apache-beam-python-3.13-sdk,...

CVE-2026-69247 vulnerabilities

Vulnerabilities for packages: authentik, openstack-placement-2025.2, dbt-bigquery, openstack-glance-2025.2, datadog-agent-fips, in-toto, vllm-openai-cuda-13.0, gitlab-cng-fips, kserve, openstack-placement-2025.1, apache-beam-python-3.12-sdk, crossplane-function-pythonic,...

CVE-2026-53533 vulnerabilities

Vulnerabilities for packages: airflow-core...

CLEANSTART-2026-KS43633 Security fixes in airflow-3 3.0.6-r1

Package airflow-3 version 3.0.6-r1 fixes 29 vulnerabilities: CVE-2026-25604, CVE-2026-42526, CVE-2026-27173, CVE-2026-41018, CVE-2026-46745...

CLEANSTART-2026-MS00856 Security fixes in airflow-3 3.1.8-r3

Package airflow-3 version 3.1.8-r3 fixes 15 vulnerabilities: CVE-2026-48522, CVE-2026-48523, CVE-2026-48524, CVE-2026-48525, CVE-2026-48526...

CLEANSTART-2026-CW50457 Security fixes in airflow-3 3.2.0-r0

Package airflow-3 version 3.2.0-r0 fixes 85 vulnerabilities: CVE-2026-44405, CVE-2026-42561, CVE-2026-8838, CVE-2026-41018, CVE-2026-41016...

CLEANSTART-2026-KV57465 Security fixes in airflow-3 3.2.1-r2

Package airflow-3 version 3.2.1-r2 fixes 5 vulnerabilities: CVE-2026-48522, CVE-2026-48523, CVE-2026-48524, CVE-2026-48525, CVE-2026-48526...

CLEANSTART-2026-BC02149 Security fixes in airflow-3 3.1.8-r6

Package airflow-3 version 3.1.8-r6 fixes 13 vulnerabilities: CVE-2026-53533, CVE-2026-59885, CVE-2026-59886, CVE-2026-59890, CVE-2026-49476...

CLEANSTART-2026-IU24971 Security fixes in airflow-3 3.2.2-r1

Package airflow-3 version 3.2.2-r1 fixes 16 vulnerabilities: CVE-2026-59885, CVE-2026-59886, CVE-2026-59884, CVE-2026-59939, CVE-2026-54590...

CLEANSTART-2026-KA71089 Security fixes in airflow-3 3.1.8-r2

Package airflow-3 version 3.1.8-r2 fixes 5 vulnerabilities: ghsa-r95x-qfjj-fjj2, CVE-2026-44681, CVE-2026-48710, ghsa-29h4-r29x-hchv, CVE-2026-8838...

CLEANSTART-2026-IW40229 Security fixes in airflow-3 3.1.8-r5

Package airflow-3 version 3.1.8-r5 fixes 19 vulnerabilities: CVE-2026-42526, CVE-2026-27173, CVE-2026-41018, CVE-2026-46745, CVE-2026-50203...

CLEANSTART-2026-US20993 Security fixes in airflow-2 2.10.3-r3

Package airflow-2 version 2.10.3-r3 fixes 22 vulnerabilities: ghsa-27jp-wm6q-gp25, ghsa-5rvq-cxj2-64vf, ghsa-82w8-qh3p-5jfq, ghsa-wqp7-x3pw-xc5r, ghsa-3x9g-8vmp-wqvf...

CVE-2026-59243

The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...

CVE-2026-59243 Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)

The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...

Airflow Experimental <1.10.11 - REST API Auth Bypass

Airflow's Experimental API prior 1.10.11 allows all API requests without authentication. id: CVE-2020-13927 info: name: Airflow Experimental 1.10.11 - REST API Auth Bypass author: pdteam severity: critical description: | Airflow's Experimental API prior 1.10.11 allows all API requests without...

Malicious code in airflow-provider-spirit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84edc3b5fdf650aec875a1381b60bf2bb811f0c813ca6841052730fcee025bc3 The package is published as an Airflow provider but ships no provider code. setup.py installs telemetry.pth into site-packages, which auto-imports...

MAL-2026-10754 Malicious code in airflow-provider-spirit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84edc3b5fdf650aec875a1381b60bf2bb811f0c813ca6841052730fcee025bc3 The package is published as an Airflow provider but ships no provider code. setup.py installs telemetry.pth into site-packages, which auto-imports...