GHSA-G794-3FMP-753H vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-8838 vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-45309 vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-29H4-R29X-HCHV vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-G3JR-4JRM-JVQV vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-X8MH-94WC-33GV vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-X8MH-94WC-33GV vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-G794-3FMP-753H vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-G3JR-4JRM-JVQV vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-8838 vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-45309 vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-29H4-R29X-HCHV vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-41016 vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-41018 vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-42359

A bug in Apache Airflow's XCom PATCH endpoint PATCH /api/v2/xcomEntries/key allowed an authenticated UI/API user with XCom write permission on a Dag to set XCom entries under reserved key names e.g. returnvalue that the matching POST endpoint already validated against FORBIDDENXCOMKEYS. The...

airflow-balancer (>=0.7.0 <=0.7.6), airflow-clickhouse-plug (=1.6.2) +40 more potentially affected by CVE-2026-41084 via apache-airflow-core (>=3.0.0 <=3.2.1rc3)

apache-airflow-core PYPI version =3.0.0, =0.7.0, =1.5.0, =0.6.1, =1.10.7, =0.6.0, =0.1.0, =1.4.3, =0.2.0, =1.2.10, =0.1.1, =3.0.0, =1.6.0, =1.5.3, =1.25.0, =1.28.0rc1 and more Source cves: CVE-2026-41084 Source advisory: SNYK:PYTHON-APACHEAIRFLOWCORE-17137559...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the bulk Task Instances API PATCH/DELETE /api/v2/dags/dagid/dagRuns/dagrunid/taskInstances that evaluates authorization against the dagid resolved from the URL path while operating on...

airflow-balancer (>=0.7.0 <=0.7.6), airflow-clickhouse-plug (=1.6.2) +40 more potentially affected by CVE-2026-41014 via apache-airflow-core (>=3.0.0 <=3.2.1rc3)

apache-airflow-core PYPI version =3.0.0, =0.7.0, =1.5.0, =0.6.1, =1.10.7, =0.6.0, =0.1.0, =1.4.3, =0.2.0, =1.2.10, =0.1.1, =3.0.0, =1.6.0, =1.5.3, =1.25.0, =1.28.0rc1 and more Source cves: CVE-2026-41014 Source advisory: SNYK:PYTHON-APACHEAIRFLOWCORE-17137573...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack where a Dag author could either: a create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process read-path attack — e.g. /etc/passwd or airflow.cfg or b supply a taskid...

airflow-balancer (>=0.7.0 <=0.7.6), airflow-clickhouse-plug (=1.6.2) +40 more potentially affected by CVE-2026-40861 via apache-airflow-core (>=3.0.0 <=3.2.1rc3)

apache-airflow-core PYPI version =3.0.0, =0.7.0, =1.5.0, =0.6.1, =1.10.7, =0.6.0, =0.1.0, =1.4.3, =0.2.0, =1.2.10, =0.1.1, =3.0.0, =1.6.0, =1.5.3, =1.25.0, =1.28.0rc1 and more Source cves: CVE-2026-40861 Source advisory: SNYK:PYTHON-APACHEAIRFLOWCORE-17137558...