airflow-balancer (>=0.7.0, <=0.7.6), airflow-clickhouse-plug (1.6.2) +43 more potentially affected by CVE-2026-28563 +1 more via apache-airflow-core (>=3.0.0rc2, <=3.2.2)

apache-airflow-core PYPI version =3.0.0rc2, =0.7.0, =1.5.0, =0.6.1, =1.10.7, =0.6.0a1, =0.1.0, =1.4.3, =0.3.0, =1.2.10, =3.0.0rc3, =1.1.3rc1, =1.6.0rc1, =1.5.3rc1, =1.6.2 and more Source cves: CVE-2026-28563, CVE-2026-48891 Source advisory: SNYK:PYTHON-APACHEAIRFLOWCORE-17878939...

airflow-clickhouse-plugin (1.4.0), dataflow-airflow (>=2.10.5, <=2.10.10) +15 more potentially affected by CVE-2026-48891 via apache-airflow (2.10.5)

apache-airflow PYPI version 2.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin 1.4.0 - dataflow-airflow =2.10.5, =1.7.15, =1.8.0rc2, =5.1.0, =1.4.23, =0.21.6, =1.6.35, =1.23.18, =1.19....

apache-airflow-providers-smtp (>=1.0.0rc1, <=1.8.1rc1) potentially affected by CVE-2026-48891 via apache-airflow (2.8.2)

apache-airflow PYPI version 2.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - apache-airflow-providers-smtp =1.0.0rc1, =1.8.1rc1 Source cves: CVE-2026-48891 Source advisory: OSV:GHSA-3322-MJXH-9MP5...

acceldata-o2a (1.0.0), airflow-provider-tm1 (0.6.0) +14 more potentially affected by CVE-2026-48891 via apache-airflow (2.11.0)

apache-airflow PYPI version 2.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - acceldata-o2a 1.0.0 - airflow-provider-tm1 0.6.0 - apache-airflow-providers-common-compat =1.0.0, =0.2.0, =0.2.0, =1.8.0, =11.4.0rc...

contra-rotor (0.1.0), etl-server (>=0.0.6, <=0.0.7) potentially affected by CVE-2026-48891 via apache-airflow (1.10.13)

apache-airflow PYPI version 1.10.13 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - contra-rotor 0.1.0 - etl-server =0.0.6, =0.0.7 Source cves: CVE-2026-48891 Source advisory: OSV:GHSA-3322-MJXH-9MP5...

airtel-airflow-plugins (1.5.0), openmetadata-airflow-managed-apis (>=0.1.0, <=0.10.0.1) potentially affected by CVE-2026-48891 via apache-airflow (2.3.2)

apache-airflow PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airtel-airflow-plugins 1.5.0 - openmetadata-airflow-managed-apis =0.1.0, =0.10.0.1 Source cves: CVE-2026-48891 Source advisory:...

airflow-util-dv (>=1.2.1, <=1.6.2) potentially affected by CVE-2026-48891 via apache-airflow (1.10.1)

apache-airflow PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-util-dv =1.2.1, =1.6.2 Source cves: CVE-2026-48891 Source advisory: OSV:GHSA-3322-MJXH-9MP5...

airflow-clickhouse-plugin (1.3.0), airflow-toolkit (0.13.3) +12 more potentially affected by CVE-2026-48891 via apache-airflow (2.9.3)

apache-airflow PYPI version 2.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin 1.3.0 - airflow-toolkit 0.13.3 - airflow-tools =0.1.1, =1.0.0rc1, =0.0.8, =1.7.3, =0.4.3, =0.0.44,...

airflow-add-ons (0.2.9b1), airflow-clickhouse-plugin (0.8.2) +1 more potentially affected by CVE-2026-48891 via apache-airflow (2.3.4)

apache-airflow PYPI version 2.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-add-ons 0.2.9b1 - airflow-clickhouse-plugin 0.8.2 - armada-airflow =0.1.0, =0.2.0 Source cves: CVE-2026-48891 Source advisor...

dbnd-airflow (>=0.24.14, <=0.25.15), dbnd-airflow-versioned-dag (>=0.24.14, <=0.25.15) +2 more potentially affected by CVE-2026-48891 via apache-airflow (1.10.7)

apache-airflow PYPI version 1.10.7 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dbnd-airflow =0.24.14, =0.24.14, =0.24.14, =0.24.14, =0.25.7 Source cves: CVE-2026-48891 Source advisory: OSV:GHSA-3322-MJXH-9MP5...

airflow-dagfactory (0.19.1), airflow-tools (>=0.9.2, <=0.12.0) +3 more potentially affected by CVE-2026-48891 via apache-airflow (2.9.1)

apache-airflow PYPI version 2.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-dagfactory 0.19.1 - airflow-tools =0.9.2, =0.1.0, =0.1.0, =0.1.3 Source cves: CVE-2026-48891 Source advisory:...

airflow-aggua-plugin (>=1.0.7, <=1.0.8), airflow-clickhouse-plugin (>=0.5.6, <=0.5.7.post1) +83 more potentially affected by CVE-2026-48891 via apache-airflow (1.10.15)

apache-airflow PYPI version 1.10.15 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-aggua-plugin =1.0.7, =0.5.6, =0.1.0, =0.0.7, =0.0.1, =0.1.6, =0.0.2, =1.0.0, =2020.5.20rc1, =2021.2.5rc1, =2020.5.20rc1,...

acryl-datahub-airflow-plugin (>=0.8.44.4rc1, <=0.9.2.1), airflow-add-ons (0.2.9b2) +8 more potentially affected by CVE-2026-48891 via apache-airflow (2.2.5)

apache-airflow PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - acryl-datahub-airflow-plugin =0.8.44.4rc1, =0.8.0, =0.2.0, =0.0.3, =0.0.6, =0.0.1, =0.5.2, =0.8.3a1, =0.2.35, =0.2.37 Source cves:...

data-tracking (1.7.3) potentially affected by CVE-2026-48891 via apache-airflow (1.9.0)

apache-airflow PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - data-tracking 1.7.3 Source cves: CVE-2026-48891 Source advisory: OSV:GHSA-3322-MJXH-9MP5...

apache-liminal (>=0.0.1.post1, <=0.0.3.post1), apache-liminal-test-spark (0.0.0) +4 more potentially affected by CVE-2026-48891 via apache-airflow (1.10.12)

apache-airflow PYPI version 1.10.12 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - apache-liminal =0.0.1.post1, =0.0.1, =6.0.0, =0.1.0, =0.5.0a9, =0.6.0a15 Source cves: CVE-2026-48891 Source advisory:...

airflow-clickhouse-plugin (>=0.10.0, <=0.10.1), airflow-provider-ibm-db2 (0.1.2) potentially affected by CVE-2026-48891 via apache-airflow (2.5.3)

apache-airflow PYPI version 2.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.10.0, =0.10.1 - airflow-provider-ibm-db2 0.1.2 Source cves: CVE-2026-48891 Source advisory:...

airflow-docker (>=0.1.1, <=0.5.0), airflow-indexima (>=1.0.1, <=2.2.1) +5 more potentially affected by CVE-2026-48891 via apache-airflow (1.10.2)

apache-airflow PYPI version 1.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-docker =0.1.1, =1.0.1, =0.4.0rc2, =0.1.0, =3.0.0, =0.0.12, =1.0.1 Source cves: CVE-2026-48891 Source advisory:...

gps-building-blocks (>=1.2.3, <=1.25.0) potentially affected by CVE-2026-48891 via apache-airflow (1.10.14)

apache-airflow PYPI version 1.10.14 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - gps-building-blocks =1.2.3, =1.25.0 Source cves: CVE-2026-48891 Source advisory: OSV:GHSA-3322-MJXH-9MP5...

viewflow (0.1.0) potentially affected by CVE-2026-48891 via apache-airflow (2.1.1)

apache-airflow PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - viewflow 0.1.0 Source cves: CVE-2026-48891 Source advisory: OSV:GHSA-3322-MJXH-9MP5...

CVE-2026-48891

A bug in Apache Airflow's /ui/dependencies scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the dep.source and dep.target fields of trigger / sensor dependency entries. An authenticated UI user with...