CVE-2025-50213 Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperator

Failure to Sanitize Special Elements into a Different Plane Special Element Injection vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added...

CVE-2025-50213

CVE-2025-50213 concerns Apache Airflow Providers Snowflake. The issue is a Special Element Injection caused by failure to sanitize special elements, affecting the CopyFromExternalStageToSnowflakeOperator and allowing SQL injection. Affected product: Apache Airflow Providers Snowflake prior to ver...

CVE-2025-50213 Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperator

Failure to Sanitize Special Elements into a Different Plane Special Element Injection vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added...

Apache Airflow 安全漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An SQL injection vulnerability exists in Apache Airflow versions prior to 6.4.0 tha...

PT-2025-26707

Name of the Vulnerable Software and Affected Versions: Apache Airflow Providers Snowflake versions prior to 6.4.0 Description: The issue is related to a Failure to Sanitize Special Elements into a Different Plane, also known as Special Element Injection vulnerability. This vulnerability affects t...

CVE-2024-47081 vulnerabilities

Vulnerabilities for packages: confluent-docker-utils, airflow, jupyter-base-notebook, kubeflow-pipelines-visualization-server, pypy-3.11, py3-requests, k8s-sidecar, jwt-tool, mlflow, pypy-3.10, reflex, kubeflow-jupyter-web-app, superset, dask-gateway, az, kubeflow-katib, emissary, py3-pipenv,...

GHSA-9HJG-9R4M-MVJ7 vulnerabilities

Vulnerabilities for packages: confluent-docker-utils, airflow, jupyter-base-notebook, kubeflow-pipelines-visualization-server, pypy-3.11, py3-requests, k8s-sidecar, jwt-tool, mlflow, pypy-3.10, reflex, kubeflow-jupyter-web-app, superset, dask-gateway, az, kubeflow-katib, emissary, py3-pipenv,...

CVE-2024-47081 vulnerabilities

Vulnerabilities for packages: superset, py3-requests, reflex, az, nvidia-nsight-compute-13.3, kubeflow-katib, nvidia-nsight-compute-13.1, k8s-sidecar, jwt-tool, kubeflow-jupyter-web-app, apache-beam-python-3.11-sdk, confluent-docker-utils, graalvm, emissary, airflow, nvidia-nsight-compute-13.2,...

GHSA-9HJG-9R4M-MVJ7 vulnerabilities

Vulnerabilities for packages: superset, py3-requests, reflex, az, nvidia-nsight-compute-13.3, kubeflow-katib, nvidia-nsight-compute-13.1, k8s-sidecar, jwt-tool, kubeflow-jupyter-web-app, apache-beam-python-3.11-sdk, confluent-docker-utils, graalvm, emissary, airflow, nvidia-nsight-compute-13.2,...

CVE-2025-5279 vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-R244-WG5G-6W2R vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-R244-WG5G-6W2R vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2025-5279 vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2024-31869

Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.exposeconfig" configuration The celery provider is the only community provider...

CVE-2024-28423

Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafeload function at cli.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted YML file...

CVE-2024-25142

Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. Airflow did not return "Cache-Control" header for dynamic content, which in case of some browsers could result in potentially storing sensitive data in local cache of the browser. This issue affects Apache...

CVE-2024-45033

Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged...

CVE-2024-45498

Example DAG: exampleinleteventextra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the...

CVE-2024-45784

Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG authors to unintentionally or intentionally log sensitive configuration variables. Unauthorized users could access these logs, potentially...

CVE-2024-45034

Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. Users are advised to upgrade to version 2.10.1 or later...