CLEANSTART-2026-KN51802 Security fix for CVE-2026-27448 applied in: airflow-3 3.1.8-r0, airflow-3 3.2.0-r0, az 2.84.0-r0, pritunl 1.30.3431.73-r1

CVE-2026-27448 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JK38146 Security fix for ghsa-jjhc-v7c2-5hh6 applied in: airflow-3 3.1.8-r0, airflow-3 3.2.0-r0

ghsa-jjhc-v7c2-5hh6 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2026-82310

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...

EUVD-2026-80322

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...

CVE-2026-82310 Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...

CLEANSTART-2026-LT04051 Security fixes in airflow-3 3.3.1-r1

Package airflow-3 version 3.3.1-r1 fixes 6 vulnerabilities: CVE-2026-69247, CVE-2026-69248, CVE-2026-69249, CVE-2026-59884, CVE-2026-59885...

CLEANSTART-2026-EX36838 Security fixes in airflow-3 3.3.0-r2

Package airflow-3 version 3.3.0-r2 fixes 7 vulnerabilities: CVE-2026-69244, CVE-2026-59881, CVE-2026-69243, CVE-2026-69247, CVE-2026-69249...

CLEANSTART-2026-IW40229 Security fixes in airflow-3 3.1.8-r5

Package airflow-3 version 3.1.8-r5 fixes 19 vulnerabilities: CVE-2026-42526, CVE-2026-27173, CVE-2026-41018, CVE-2026-46745, CVE-2026-50203...

CLEANSTART-2026-KA71089 Security fixes in airflow-3 3.1.8-r2

Package airflow-3 version 3.1.8-r2 fixes 5 vulnerabilities: ghsa-r95x-qfjj-fjj2, CVE-2026-44681, CVE-2026-48710, ghsa-29h4-r29x-hchv, CVE-2026-8838...

PYSEC-2026-2355 Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate table

DAG Author who already has quite a lot of permissions could manipulate database of Airflow 2 in the way to execute arbitrary code in the web-server context, which they should normally not be able to do, leading to potentially remote code execution in the context of web-server server-side as a...

EUVD-2025-203888

Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context...

PYSEC-2025-87

Edge3 Worker RPC RCE on Airflow 2. This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if you installed and configured it on Airflow 2. The Edge3 provider support in Airflow 2 has been always development-only and not officially released, however if you installed and...