CVE-2026-8838 vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-29H4-R29X-HCHV vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-45309 vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-X8MH-94WC-33GV vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-X8MH-94WC-33GV vulnerabilities

Vulnerabilities for packages: airflow-core, airflow...

GHSA-G794-3FMP-753H vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-G3JR-4JRM-JVQV vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-8838 vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-45309 vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-29H4-R29X-HCHV vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-41018 vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-41016 vulnerabilities

Vulnerabilities for packages: airflow-core, airflow...

CVE-2026-42359

A bug in Apache Airflow's XCom PATCH endpoint PATCH /api/v2/xcomEntries/key allowed an authenticated UI/API user with XCom write permission on a Dag to set XCom entries under reserved key names e.g. returnvalue that the matching POST endpoint already validated against FORBIDDENXCOMKEYS. The...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the bulk Task Instances API PATCH/DELETE /api/v2/dags/dagid/dagRuns/dagrunid/taskInstances that evaluates authorization against the dagid resolved from the URL path while operating on...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack where a Dag author could either: a create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process read-path attack — e.g. /etc/passwd or airflow.cfg or b supply a taskid...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the XCom PATCH endpoint PATCH /api/v2/xcomEntries/key that allows an authenticated UI/API user with XCom write permission on a Dag to set XCom entries under reserved key names e.g. returnvalue that...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the scheduler-side deadline-reference decoder SerializedCustomReference.deserializereference. A DAG author whose code reaches the scheduler — the default on single-host deployments where the DAG...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration in the auth manager logout handling where previously-issued JWT tokens are left valid after the user clicked logout in the UI: the logout flow for FabAuthManager and KeycloakAuthManager did not actually...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the airflow.utils.email process. An attacker can intercept sensitive information, such as SMTP authentication credentials and email contents, by performing a man-in-the-middle attack during the STARTTL...

GHSA-VR7M-C6V4-8CX8 Apache Airflow: Auth manager doesn't invalidate JWT tokens after users click logout

A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for FabAuthManager and KeycloakAuthManager did not actually reach the underlying revoketoken call, so the JWT remained accepted by the API server...