CVE-2020-17526

Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have...

CVE-2024-39863

Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue...

CVE-2024-39877

Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a docmd parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to...

CVE-2025-69224 vulnerabilities

Vulnerabilities for packages: request-1276, open-webui, py3-cassandra-medusa, apache-beam-python-3.11-sdk, py3-vllm-cuda-12.4, py3.13-scanner-test-libraries-aiohttp, checkov, dask-kubernetes, kubeflow-pipelines-visualization-server, airflow, awx, kserve, authentik...

GHSA-MQQC-3GQH-H2X8 vulnerabilities

Vulnerabilities for packages: request-1276, open-webui, py3-cassandra-medusa, apache-beam-python-3.11-sdk, py3-vllm-cuda-12.4, py3.13-scanner-test-libraries-aiohttp, checkov, dask-kubernetes, kubeflow-pipelines-visualization-server, airflow, awx, kserve, authentik...

CVE-2025-69226 vulnerabilities

Vulnerabilities for packages: request-1276, open-webui, py3-cassandra-medusa, apache-beam-python-3.11-sdk, py3-vllm-cuda-12.4, py3.13-scanner-test-libraries-aiohttp, checkov, dask-kubernetes, kubeflow-pipelines-visualization-server, airflow, awx, kserve, authentik...

GHSA-6MQ8-RVHQ-8WGG vulnerabilities

Vulnerabilities for packages: request-1276, open-webui, py3-cassandra-medusa, apache-beam-python-3.11-sdk, py3-vllm-cuda-12.4, py3.13-scanner-test-libraries-aiohttp, checkov, dask-kubernetes, kubeflow-pipelines-visualization-server, airflow, awx, kserve, authentik...

CVE-2025-69229 vulnerabilities

Vulnerabilities for packages: request-1276, open-webui, py3-cassandra-medusa, apache-beam-python-3.11-sdk, py3-vllm-cuda-12.4, py3.13-scanner-test-libraries-aiohttp, checkov, dask-kubernetes, kubeflow-pipelines-visualization-server, airflow, awx, kserve, authentik...

CVE-2025-69223 vulnerabilities

Vulnerabilities for packages: request-1276, open-webui, py3-cassandra-medusa, apache-beam-python-3.11-sdk, py3-vllm-cuda-12.4, py3.13-scanner-test-libraries-aiohttp, checkov, dask-kubernetes, kubeflow-pipelines-visualization-server, airflow, awx, kserve, authentik...

CVE-2025-69227 vulnerabilities

Vulnerabilities for packages: request-1276, open-webui, py3-cassandra-medusa, apache-beam-python-3.11-sdk, py3-vllm-cuda-12.4, py3.13-scanner-test-libraries-aiohttp, checkov, dask-kubernetes, kubeflow-pipelines-visualization-server, airflow, awx, kserve, authentik...

GHSA-69F9-5GXW-WVC2 vulnerabilities

Vulnerabilities for packages: request-1276, open-webui, py3-cassandra-medusa, apache-beam-python-3.11-sdk, py3-vllm-cuda-12.4, py3.13-scanner-test-libraries-aiohttp, checkov, dask-kubernetes, kubeflow-pipelines-visualization-server, airflow, awx, kserve, authentik...

GHSA-6JHG-HG63-JVVF vulnerabilities

Vulnerabilities for packages: request-1276, open-webui, py3-cassandra-medusa, apache-beam-python-3.11-sdk, py3-vllm-cuda-12.4, py3.13-scanner-test-libraries-aiohttp, checkov, dask-kubernetes, kubeflow-pipelines-visualization-server, airflow, awx, kserve, authentik...

CVE-2025-69230 vulnerabilities

Vulnerabilities for packages: request-1276, open-webui, py3-cassandra-medusa, apache-beam-python-3.11-sdk, py3-vllm-cuda-12.4, py3.13-scanner-test-libraries-aiohttp, checkov, dask-kubernetes, kubeflow-pipelines-visualization-server, airflow, awx, kserve, authentik...

GHSA-G84X-MCQJ-X9QQ vulnerabilities

Vulnerabilities for packages: request-1276, open-webui, py3-cassandra-medusa, apache-beam-python-3.11-sdk, py3-vllm-cuda-12.4, py3.13-scanner-test-libraries-aiohttp, checkov, dask-kubernetes, kubeflow-pipelines-visualization-server, airflow, awx, kserve, authentik...

GHSA-JJ3X-WXRX-4X23 vulnerabilities

Vulnerabilities for packages: request-1276, open-webui, py3-cassandra-medusa, apache-beam-python-3.11-sdk, py3-vllm-cuda-12.4, py3.13-scanner-test-libraries-aiohttp, checkov, dask-kubernetes, kubeflow-pipelines-visualization-server, airflow, awx, kserve, authentik...

CVE-2025-69225 vulnerabilities

Vulnerabilities for packages: request-1276, open-webui, py3-cassandra-medusa, apache-beam-python-3.11-sdk, py3-vllm-cuda-12.4, py3.13-scanner-test-libraries-aiohttp, checkov, dask-kubernetes, kubeflow-pipelines-visualization-server, airflow, awx, kserve, authentik...

CVE-2025-69228 vulnerabilities

Vulnerabilities for packages: request-1276, open-webui, py3-cassandra-medusa, apache-beam-python-3.11-sdk, py3-vllm-cuda-12.4, py3.13-scanner-test-libraries-aiohttp, checkov, dask-kubernetes, kubeflow-pipelines-visualization-server, airflow, awx, kserve, authentik...

GHSA-FH55-R93G-J68G vulnerabilities

Vulnerabilities for packages: request-1276, open-webui, py3-cassandra-medusa, apache-beam-python-3.11-sdk, py3-vllm-cuda-12.4, py3.13-scanner-test-libraries-aiohttp, checkov, dask-kubernetes, kubeflow-pipelines-visualization-server, airflow, awx, kserve, authentik...

GHSA-54JQ-C3M8-4M76 vulnerabilities

Vulnerabilities for packages: request-1276, open-webui, py3-cassandra-medusa, apache-beam-python-3.11-sdk, py3-vllm-cuda-12.4, py3.13-scanner-test-libraries-aiohttp, checkov, dask-kubernetes, kubeflow-pipelines-visualization-server, airflow, awx, kserve, authentik...

CVE-2022-27949

A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed for example when they were depending on past and previous instances of the task failed. This issue affects Apache Airflow prior to 2.3.1...