PT-2026-100675

Security vulnerability affects the airflow-2 package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101285

Security vulnerability affects the airflow-2 package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-63661

Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63681

Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details...

EUVD-2025-203888

Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context...

PYSEC-2025-87

Edge3 Worker RPC RCE on Airflow 2. This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if you installed and configured it on Airflow 2. The Edge3 provider support in Airflow 2 has been always development-only and not officially released, however if you installed and...

CVE-2025-67895: Incorrect Resource Transfer Between Spheres

Edge3 Worker RPC RCE on Airflow 2. This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if you installed and configured it on Airflow 2. The Edge3 provider support in Airflow 2 has been always development-only and not officially released, however if you installed and...

PYSEC-2025-85

Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a "write-only" model for sensitive values.In Airflow 3.0.3, this model was unintentional...