PYSEC-2026-3705

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was show...

CVE-2026-54183

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was show...

CVE-2026-54183 Apache Airflow: Airflow Variables were not masked in the UI for authenticated users

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was show...

PT-2026-71138

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description The secrets masker in the UI fails to hide values stored under sensitive key names when they are nested inside a list, tuple, or set beyond the recursion-depth limit. This results in Airflow...

armada-airflow (0.5.4), jefferson-street-composer (>=1.3.0, <=1.7.1) potentially affected by CVE-2026-42358 via apache-airflow (2.7.1)

apache-airflow PYPI version 2.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - armada-airflow 0.5.4 - jefferson-street-composer =1.3.0, =1.7.1 Source cves: CVE-2026-42358 Source advisory: OSV:PYSEC-2026-2343...

airflow-balancer (>=0.7.0, <=0.7.6), airflow-clickhouse-plug (1.6.2) +38 more potentially affected by CVE-2026-42358 via apache-airflow (>=3.0.0rc4, <=3.2.2rc3)

apache-airflow PYPI version =3.0.0rc4, =0.7.0, =1.5.0, =0.6.1, =1.10.7, =0.6.0a1, =0.1.0, =1.4.3, =0.3.0, =1.2.10, =3.0.0, =1.1.3rc1, =1.6.0rc1, =1.5.3rc1, =1.25.0rc1, =1.28.0 and more Source cves: CVE-2026-42358 Source advisory: OSV:PYSEC-2026-2343...

airflow-clickhouse-plugin (1.3.0), airflow-toolkit (0.13.3) +12 more potentially affected by CVE-2026-42358 via apache-airflow (2.9.3)

apache-airflow PYPI version 2.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin 1.3.0 - airflow-toolkit 0.13.3 - airflow-tools =0.1.1, =1.0.0rc1, =0.0.8, =1.7.3, =0.4.3, =0.0.44,...

airflow-clickhouse-plugin (0.6.0), dataverk-airflow (>=0.3.18, <=0.3.23) +1 more potentially affected by CVE-2026-42358 via apache-airflow (2.0.2)

apache-airflow PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin 0.6.0 - dataverk-airflow =0.3.18, =11.8.0, =13.7.0 Source cves: CVE-2026-42358 Source advisory:...

acryl-datahub-airflow-plugin (>=0.8.44.4rc1, <=0.9.2.1), airflow-add-ons (0.2.9b2) +8 more potentially affected by CVE-2026-42358 via apache-airflow (2.2.5)

apache-airflow PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - acryl-datahub-airflow-plugin =0.8.44.4rc1, =0.8.0, =0.2.0, =0.0.3, =0.0.6, =0.0.1, =0.5.2, =0.8.3a1, =0.2.35, =0.2.37 Source cves:...

airflow-tools (>=0.3.1, <=0.6.3), apache-airflow-providers-common-io (>=1.0.0rc1, <=1.4.2rc1) +1 more potentially affected by CVE-2026-42358 via apache-airflow (2.8.0)

apache-airflow PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-tools =0.3.1, =1.0.0rc1, =1.4.2rc1 - flowpyter-task 1.1.0.post0.dev45 Source cves: CVE-2026-42358 Source advisory:...

gps-building-blocks (>=1.2.3, <=1.25.0) potentially affected by CVE-2026-42358 via apache-airflow (1.10.14)

apache-airflow PYPI version 1.10.14 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - gps-building-blocks =1.2.3, =1.25.0 Source cves: CVE-2026-42358 Source advisory: OSV:PYSEC-2026-2343...

neuro-airflow-plugin (0.0.1) potentially affected by CVE-2026-42358 via apache-airflow (2.0.0rc3)

apache-airflow PYPI version 2.0.0rc3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - neuro-airflow-plugin 0.0.1 Source cves: CVE-2026-42358 Source advisory: OSV:PYSEC-2026-2343...

airflow-aggua-plugin (>=1.0.7, <=1.0.8), airflow-clickhouse-plugin (>=0.5.6, <=0.5.7.post1) +81 more potentially affected by CVE-2026-42358 via apache-airflow (1.10.15)

apache-airflow PYPI version 1.10.15 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-aggua-plugin =1.0.7, =0.5.6, =0.1.0, =0.0.7, =0.0.1, =0.1.6, =0.0.2, =1.0.0, =2020.5.20rc1, =2021.2.5rc1, =2020.5.20rc1,...

apache-liminal (>=0.0.4rc1, <=0.0.5), apache-liminal-zion (>=0.0.0, <=2.0.0) +1 more potentially affected by CVE-2026-42358 via apache-airflow (2.1.2)

apache-airflow PYPI version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - apache-liminal =0.0.4rc1, =0.0.0, =14.4.7, =14.7.0 Source cves: CVE-2026-42358 Source advisory: OSV:PYSEC-2026-2343...

acryl-datahub-airflow-plugin (>=0.10.5.2rc3, <=0.11.0), airflow-clickhouse-plugin (>=0.11.0, <=1.0.0.post0) potentially affected by CVE-2026-42358 via apache-airflow (2.6.3)

apache-airflow PYPI version 2.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - acryl-datahub-airflow-plugin =0.10.5.2rc3, =0.11.0, =1.0.0.post0 Source cves: CVE-2026-42358 Source advisory: OSV:PYSEC-2026-2343...

airflow-parse-bench (>=0.0.1, <=1.0.1), dkist-processing-common (>=10.5.6rc1, <=10.5.14) +7 more potentially affected by CVE-2026-42358 via apache-airflow (2.10.4)

apache-airflow PYPI version 2.10.4 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-parse-bench =0.0.1, =10.5.6rc1, =4.3.0, =1.4.10, =0.20.1, =1.6.27, =1.23.7rc1, =1.18.7, =2.20.9, =2.20.19 Source cves:...

airflow-imaging-plugins (>=2.4.2, <=2.4.3), data-tracking (1.7.2) +1 more potentially affected by CVE-2026-42358 via apache-airflow (1.8.2)

apache-airflow PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-imaging-plugins =2.4.2, =0.0.5, =0.0.6 Source cves: CVE-2026-42358 Source advisory: OSV:PYSEC-2026-2343...

airflow-dagfactory (0.19.1), airflow-tools (>=0.9.2, <=0.12.0) +3 more potentially affected by CVE-2026-42358 via apache-airflow (2.9.1)

apache-airflow PYPI version 2.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-dagfactory 0.19.1 - airflow-tools =0.9.2, =0.1.0, =0.1.0, =0.1.3 Source cves: CVE-2026-42358 Source advisory:...

airflow-docker (>=0.1.1, <=0.5.0), airflow-indexima (>=1.0.1, <=2.2.1) +5 more potentially affected by CVE-2026-42358 via apache-airflow (1.10.2)

apache-airflow PYPI version 1.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-docker =0.1.1, =1.0.1, =0.4.0rc2, =0.1.0, =3.0.0, =0.0.12, =1.0.1 Source cves: CVE-2026-42358 Source advisory:...

apache-liminal (>=0.0.1.post1, <=0.0.3.post1), apache-liminal-test-spark (0.0.0) +4 more potentially affected by CVE-2026-42358 via apache-airflow (1.10.12)

apache-airflow PYPI version 1.10.12 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - apache-liminal =0.0.1.post1, =0.0.1, =6.0.0, =0.1.0, =0.5.0a9, =0.6.0a15 Source cves: CVE-2026-42358 Source advisory:...