CVE-2026-41490

CVE-2026-41490 — SQL Injection in Dagster database I/O managers via dynamic partition keys Severity : High CVSS 8.3 CWE : CWE-89 — SQL Injection Affected : Dagster core = 1.13.0 and integration packages = 0.29.0 Fixed in : Dagster core 1.13.1 and integration packages 0.29.1 Advisory :...

dagster-mlflow (>=0.18.0, <=0.18.3), dbx (0.5.0) +13 more potentially affected by CVE-2026-53995 via mlflow (1.26.1)

mlflow PYPI version 1.26.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.18.0, =0.2.5, =0.0.1, =0.3.3, =0.2.0.dev3, =0.2.0.dev2, =0.40.2.dev25, =0.40.2.dev18, =0.39.1rc2, =3.2.7, =0.0.1, =0.1.2, =0.2.1...

dagster-mlflow (>=0.14.18rc5, <=0.17.21), sparkpipelineframework (1.0.18) potentially affected by CVE-2026-53995 via mlflow (1.26.0)

mlflow PYPI version 1.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.14.18rc5, =0.17.21 - sparkpipelineframework 1.0.18 Source cves: CVE-2026-53995 Source advisory: OSV:GHSA-WQMH-QCCW-PQWF...

dagster-snowflake (>=0.4.0rc2, <=0.6.1) potentially affected by CVE-2026-86597 via snowflake-connector-python (1.7.11)

snowflake-connector-python PYPI version 1.7.11 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dagster-snowflake =0.4.0rc2, =0.6.1 Source cves: CVE-2026-86597 Source advisory: OSV:PYSEC-2026-4301...

dagster-snowflake (>=0.21.8, <=0.22.3), dagster-snowflake-pandas (>=0.21.8, <=0.22.3) +2 more potentially affected by CVE-2026-86597 via snowflake-connector-python (3.4.1)

snowflake-connector-python PYPI version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dagster-snowflake =0.21.8, =0.21.8, =0.21.8, =0.22.3 - quacker 0.6.2 Source cves: CVE-2026-86597 Source...

ablog (>=0.10.3, <=0.10.7), acumos (>=0.9.3, <=0.9.4) +13 more potentially affected by CVE-2026-102598 via werkzeug (1.0.0rc1)

werkzeug PYPI version 1.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - ablog =0.10.3, =0.9.3, =0.7.0rc0, =0.26.0, =0.26.0, =5.0.19, =0.2.11, =0.51.0, =0.51.6, =0.52.0, =0.52.0, =0.53.0, =0.53.4 Source cves:...

dagster-snowflake (>=0.4.0rc2, <=0.6.1) potentially affected by CVE-2026-86597 via snowflake-connector-python (1.7.11)

snowflake-connector-python PYPI version 1.7.11 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dagster-snowflake =0.4.0rc2, =0.6.1 Source cves: CVE-2026-86597 Source advisory: OSV:GHSA-QQJ6-54Q6-CXV6...

dagster-snowflake (>=0.21.8, <=0.22.3), dagster-snowflake-pandas (>=0.21.8, <=0.22.3) +2 more potentially affected by CVE-2026-86597 via snowflake-connector-python (3.4.1)

snowflake-connector-python PYPI version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dagster-snowflake =0.21.8, =0.21.8, =0.21.8, =0.22.3 - quacker 0.6.2 Source cves: CVE-2026-86597 Source...

dag-manager (>=0.1.3a0, <=0.1.5a0), dagster-airflow (>=0.5.4rc0, <=0.5.4) +2 more potentially affected by CVE-2026-82355 via apache-airflow (1.10.3)

apache-airflow PYPI version 1.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dag-manager =0.1.3a0, =0.5.4rc0, =0.1.0, =3.0.2, =3.0.3 Source cves: CVE-2026-82355 Source advisory: OSV:PYSEC-2026-3989...

dagster-snowflake (>=0.4.0rc2, <=0.6.1) potentially affected by CVE-2026-15925 via snowflake-connector-python (1.7.11)

snowflake-connector-python PYPI version 1.7.11 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dagster-snowflake =0.4.0rc2, =0.6.1 Source cves: CVE-2026-15925 Source advisory: OSV:PYSEC-2026-3920...

dagster-mlflow (>=0.14.18rc5, <=0.17.21), sparkpipelineframework (1.0.18) potentially affected by CVE-2026-64849 via mlflow (1.26.0)

mlflow PYPI version 1.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.14.18rc5, =0.17.21 - sparkpipelineframework 1.0.18 Source cves: CVE-2026-64849 Source advisory: OSV:PYSEC-2026-3687...

dag-manager (>=0.1.3a0, <=0.1.5a0), dagster-airflow (>=0.5.4rc0, <=0.5.4) +2 more potentially affected by CVE-2026-68971 via apache-airflow (1.10.3)

apache-airflow PYPI version 1.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dag-manager =0.1.3a0, =0.5.4rc0, =0.1.0, =3.0.2, =3.0.3 Source cves: CVE-2026-68971 Source advisory: OSV:GHSA-5247-M8W9-2V4M...

dag-manager (>=0.1.3a0, <=0.1.5a0), dagster-airflow (>=0.5.4rc0, <=0.5.4) +2 more potentially affected by CVE-2026-68970 via apache-airflow (1.10.3)

apache-airflow PYPI version 1.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dag-manager =0.1.3a0, =0.5.4rc0, =0.1.0, =3.0.2, =3.0.3 Source cves: CVE-2026-68970 Source advisory: OSV:GHSA-F3C2-J7G8-VPP8...

dag-manager (>=0.1.3a0, <=0.1.5a0), dagster-airflow (>=0.5.4rc0, <=0.5.4) +2 more potentially affected by CVE-2026-68969 via apache-airflow (1.10.3)

apache-airflow PYPI version 1.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dag-manager =0.1.3a0, =0.5.4rc0, =0.1.0, =3.0.2, =3.0.3 Source cves: CVE-2026-68969 Source advisory: OSV:GHSA-CJV4-7HP2-2X9H...

dag-manager (>=0.1.3a0, <=0.1.5a0), dagster-airflow (>=0.5.4rc0, <=0.5.4) +2 more potentially affected by CVE-2026-59242 via apache-airflow (1.10.3)

apache-airflow PYPI version 1.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dag-manager =0.1.3a0, =0.5.4rc0, =0.1.0, =3.0.2, =3.0.3 Source cves: CVE-2026-59242 Source advisory: OSV:GHSA-FCMM-42R9-MMMM...

dag-manager (>=0.1.3a0, <=0.1.5a0), dagster-airflow (>=0.5.4rc0, <=0.5.4) +2 more potentially affected by CVE-2026-54183 via apache-airflow (1.10.3)

apache-airflow PYPI version 1.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dag-manager =0.1.3a0, =0.5.4rc0, =0.1.0, =3.0.2, =3.0.3 Source cves: CVE-2026-54183 Source advisory: OSV:GHSA-G4QJ-5VXV-WGGF...

dag-manager (>=0.1.3a0, <=0.1.5a0), dagster-airflow (>=0.5.4rc0, <=0.5.4) +2 more potentially affected by CVE-2026-68968 via apache-airflow (1.10.3)

apache-airflow PYPI version 1.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dag-manager =0.1.3a0, =0.5.4rc0, =0.1.0, =3.0.2, =3.0.3 Source cves: CVE-2026-68968 Source advisory: OSV:GHSA-J4JC-CQ9H-XRHR...

dag-manager (>=0.1.3a0, <=0.1.5a0), dagster-airflow (>=0.5.4rc0, <=0.5.4) +2 more potentially affected by CVE-2026-68971 via apache-airflow (1.10.3)

apache-airflow PYPI version 1.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dag-manager =0.1.3a0, =0.5.4rc0, =0.1.0, =3.0.2, =3.0.3 Source cves: CVE-2026-68971 Source advisory: OSV:PYSEC-2026-3994...

airflow-docker (>=0.1.1, <=0.5.0), airflow-indexima (>=1.0.1, <=2.2.1) +5 more potentially affected by CVE-2026-68968 via apache-airflow (1.10.2)

apache-airflow PYPI version 1.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-docker =0.1.1, =1.0.1, =0.4.0rc2, =0.1.0, =3.0.0, =0.0.12, =1.0.1 Source cves: CVE-2026-68968 Source advisory:...

dag-manager (>=0.1.3a0, <=0.1.5a0), dagster-airflow (>=0.5.4rc0, <=0.5.4) +2 more potentially affected by CVE-2026-68968 via apache-airflow (1.10.3)

apache-airflow PYPI version 1.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dag-manager =0.1.3a0, =0.5.4rc0, =0.1.0, =3.0.2, =3.0.3 Source cves: CVE-2026-68968 Source advisory: OSV:PYSEC-2026-3710...