CLEANSTART-2026-OU64383 Security fix for CVE-2025-69223 applied in: airflow-2 2.10.3-r2, kserve-storage-controller 0.19.0-r0

CVE-2025-69223 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GI63491 Security fix for ghsa-gm62-xv2j-4w53 applied in: airflow-2 2.10.3-r2

Security vulnerability affects the airflow-2 package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-WJ72873 Security fix for ghsa-gmj6-6f8f-6699 applied in: airflow-2 2.10.3-r2

Security vulnerability affects the airflow-2 package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-OH68688 Security fix for CVE-2026-33936 applied in: airflow-2 2.11.2-r1

Security vulnerability affects the airflow-2 package. This issue is resolved in later releases. See references for vulnerability details...

EUVD-2025-203888

Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context...

PYSEC-2025-87

Edge3 Worker RPC RCE on Airflow 2. This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if you installed and configured it on Airflow 2. The Edge3 provider support in Airflow 2 has been always development-only and not officially released, however if you installed and...

PYSEC-2025-85

Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a "write-only" model for sensitive values.In Airflow 3.0.3, this model was unintentional...