CVE-2026-34538 Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure)

Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security mode...

CVE-2026-34538

Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security mode...

CVE-2026-34538 Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure)

Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security mode...

CVE-2026-34538 Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure)

Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security mode...

CVE-2026-34538

Apache Airflow CVE-2026-34538 affects 3.0.0–3.1.8 where the DagRun wait endpoint exposes XCom payloads to users with only DAG Run read access (e.g., Viewer), bypassing FAB RBAC protections. Root cause: authorization flaw in the DagRun wait path that reveals XCom results to unauthorized users. Imp...

PT-2026-31606

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.0 Description Apache Airflow is affected by an issue where JWT tokens remain valid after a user logs out, potentially allowing unauthorized access if the token is intercepted. The JWT token associated with ...

Apache Airflow 安全漏洞

Apache Airflow is an open-source platform developed by the Apache Foundation in the United States. It allows for the creation, management, and monitoring of workflows. This platform features scalability and dynamic monitoring capabilities. Versions of Apache Airflow from 3.0.0 to 3.1.8 contain...

Apache Airflow 安全漏洞

Apache Airflow is an open-source platform developed by the Apache Foundation in the United States. It allows for the creation, management, and monitoring of workflows. Versions of Apache Airflow prior to 3.2 contained security vulnerabilities; these vulnerabilities stemmed from the failure to...

PT-2026-31598

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 3.0.0 through 3.1.8 Description The DagRun wait endpoint in Apache Airflow allows users with DAG Run read permissions, such as the Viewer role, to access XCom result values. This behavior contradicts the intended securi...

GHSA-53MR-6C8Q-9789 vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-35030 vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-JJHC-V7C2-5HH6 vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-35029 vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-53MR-6C8Q-9789 vulnerabilities

Vulnerabilities for packages: litellm, airflow...

CVE-2026-35029 vulnerabilities

Vulnerabilities for packages: litellm, airflow...

CVE-2026-35030 vulnerabilities

Vulnerabilities for packages: litellm, airflow...

GHSA-JJHC-V7C2-5HH6 vulnerabilities

Vulnerabilities for packages: litellm, airflow...

CVE-2026-32794

Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o...

Improper Certificate Validation

Overview apache-airflow-providers-databricks is a Provider package apache-airflow-providers-databricks for Apache Airflow Affected versions of this package are vulnerable to Improper Certificate Validation due to the lack of certificate validation in the K8s Token Exchange. An attacker can...

EUVD-2026-17219

Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o...