3410 matches found
PT-2026-25891
Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag id set to "" wildcard for all DAGs. As a result, version metadata of DAGs that the requester is not authorized to access is returned. Users a...
PT-2026-25887
Apache Airflow versions 3.1.0 through 3.1.7 session token token in cookies is set to path=/ regardless of the configured webserver base url or api base url. This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full...
PT-2026-25893
Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop HITL endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance. Users are recommended to upgrade to...
Apache Airflow 安全漏洞
Apache Airflow is the United States Apache Apache Foundation's set of open source platform with the creation, management and monitoring of workflow functions. The platform is scalable and dynamic monitoring and other features. Apache Airflow suffers from a security bypass vulnerability that stems...
PT-2026-25892
Name of the Vulnerable Software and Affected Versions Apache Airflow versions 3.1.0 through 3.1.7 Description The /ui/dependencies endpoint in Apache Airflow returns the complete DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG...
Apache Airflow 安全漏洞
Apache Airflow is the United States Apache Apache Foundation's set of open source platform with the creation, management and monitoring of workflow functions. The platform is scalable and dynamic monitoring and other features. Apache Airflow suffers from an information disclosure vulnerability th...
Apache Airflow 安全漏洞
Apache Airflow is the United States Apache Apache Foundation's set of open source platform with the creation, management and monitoring of workflow functions. The platform is scalable and dynamic monitoring and other features. Apache Airflow has an information disclosure vulnerability that stems...
Malicious code in conductor-managed-airflow-environment (npm)
The package exfiltrates system data to remote server. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5f29800aadc2ebe943dd6adcc062837b02d670ffa617e03508fa7d6c7366494 The package conductor-managed-airflow-environment was found to contain malicious code. Source:...
MAL-2026-1385 Malicious code in conductor-managed-airflow-environment (npm)
The package exfiltrates system data to remote server. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5f29800aadc2ebe943dd6adcc062837b02d670ffa617e03508fa7d6c7366494 The package conductor-managed-airflow-environment was found to contain malicious code. Source:...
GHSA-78CV-MQJ4-43F7 vulnerabilities
Vulnerabilities for packages: dask-kubernetes, kubeflow-pipelines-visualization-server, airflow, mitmproxy...
GHSA-78CV-MQJ4-43F7 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-visualization-server, litellm, tensorflow-gpu-jupyter, dask-kubernetes, mitmproxy, tensorflow-cpu-jupyter, airflow...
CVE-2026-28802 vulnerabilities
Vulnerabilities for packages: airflow...
GHSA-9R5J-7R2X-RV4G vulnerabilities
Vulnerabilities for packages: airflow...
GHSA-7WC2-QXGW-G8GG vulnerabilities
Vulnerabilities for packages: airflow...
CVE-2026-25604 vulnerabilities
Vulnerabilities for packages: airflow...
GHSA-RV5F-CCPM-XJJ4 vulnerabilities
Vulnerabilities for packages: airflow...
CVE-2025-69219 vulnerabilities
Vulnerabilities for packages: airflow...
CVE-2026-28802 vulnerabilities
Vulnerabilities for packages: airflow...