Lucene search
+L

3393 matches found

Cvelist
Cvelist
added 2026/01/16 10:06 a.m.54 views

CVE-2025-68438 Apache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated

In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed core maxtemplatedfieldlength, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include...

0.00655EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/01/16 10:06 a.m.10 views

CVE-2025-68438 Apache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated

In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed core maxtemplatedfieldlength, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include...

6.3AI score0.00655EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/01/16 10:06 a.m.9 views

CVE-2025-68438

In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed core maxtemplatedfieldlength, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include...

7.5CVSS5.3AI score0.00655EPSS
SaveExploits0References2Affected Software1
CVE
CVE
added 2026/01/16 10:06 a.m.83 views

CVE-2025-68438

Apache Airflow prior to 3.1.6 is affected. When rendering template fields in a Dag that exceed max_templated_field_length, sensitive values could be exposed in cleartext in the Rendered Templates UI because the secrets masker did not include user-registered mask_secret() patterns, leading to inco...

7.5CVSS6.3AI score0.00655EPSS
SaveExploits0References2Affected Software1
OSV
OSV
added 2026/01/16 10:06 a.m.13 views

CVE-2025-68438 Apache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated

In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed core maxtemplatedfieldlength, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include...

7.5CVSS7.1AI score
SaveExploits0References5
CNNVD
CNNVD
added 2026/01/16 12:00 a.m.15 views

Apache Airflow security vulnerabilities

Apache Airflow is an open-source platform developed by the Apache Foundation in the United States. It allows for the creation, management, and monitoring of workflows. This platform features scalability and dynamic monitoring capabilities. Prior to Apache Airflow 3.1.6, there were security...

7.5CVSS6AI score0.01999EPSS
SaveExploits0References4
CNNVD
CNNVD
added 2026/01/16 12:00 a.m.18 views

Apache Airflow security vulnerabilities

Apache Airflow is an open-source platform developed by the Apache Foundation in the United States. It allows for the creation, management, and monitoring of workflows. Versions of Apache Airflow prior to 3.1.6 contained security vulnerabilities. These vulnerabilities stemmed from the lack of...

7.5CVSS5.8AI score0.00655EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/01/15 12:00 a.m.15 views

PT-2026-3231

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.1.6 Description When rendered template fields in a Dag exceed max templated field length, sensitive values could be exposed in cleartext in the Rendered Templates UI. This is due to the serialization of these...

7.8CVSS5.2AI score0.00655EPSS
SaveExploits0References14
Positive Technologies
Positive Technologies
added 2026/01/15 12:00 a.m.11 views

PT-2026-3232

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.1.6 Description Apache Airflow versions before 3.1.6 did not properly handle sensitive information within proxy URLs in Connection objects. Specifically, proxy credentials embedded in the proxies and proxy...

7.8CVSS6.4AI score0.01999EPSS
SaveExploits0References18
RedhatCVE
RedhatCVE
added 2026/01/09 12:41 p.m.13 views

CVE-2023-25696

Improper Input Validation vulnerability in the Apache Airflow Hive Provider. This issue affects Apache Airflow Hive Provider versions before 5.1.3...

9.8CVSS6.9AI score0.01982EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/01/09 12:41 p.m.16 views

CVE-2023-25691

Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0...

9.8CVSS6.8AI score0.01597EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/01/09 12:41 p.m.16 views

CVE-2023-25754

Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.6.0...

9.8CVSS6.7AI score0.0228EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/01/09 12:41 p.m.15 views

CVE-2023-25695

Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.5.2...

5.3CVSS6.8AI score0.01382EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/01/09 12:41 p.m.14 views

CVE-2023-25956

Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider. This issue affects Apache Airflow AWS Provider versions before 7.2.1...

7.5CVSS7.4AI score0.01499EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/01/09 12:38 p.m.17 views

CVE-2023-50944

Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version...

6.5CVSS6.5AI score0.00979EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/01/09 12:37 p.m.14 views

CVE-2023-50783

Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable. This flaw compromises the integrity of variable management, potentially leading to unauthorized data modification. Users are...

6.5CVSS6.4AI score0.0139EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/01/09 12:29 p.m.15 views

CVE-2023-40272

Apache Airflow Spark Provider, versions before 4.1.3, is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection giving an opportunity to read files on the Airflow server. It is recommended to upgrade to a version that is not affected...

7.5CVSS6.4AI score0.02144EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/01/09 12:29 p.m.9 views

CVE-2023-40195

Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Software Foundation Apache Airflow Spark Provider. When the Apache Spark provider is installed on an Airflow deployment, an Airflow user that is authorized to configure Spark hooks...

8.8CVSS7.4AI score0.01858EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/01/09 10:57 a.m.9 views

CVE-2022-38170

In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the --daemon flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via th...

4.7CVSS6.6AI score0.00617EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/01/09 10:56 a.m.8 views

CVE-2022-38054

In Apache Airflow versions 2.2.4 through 2.3.3, the database webserver session backend was susceptible to session fixation...

9.8CVSS6.9AI score0.02129EPSS
SaveExploits0References1
Rows per page
Query Builder