CVE-2026-53537 vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-4XGF-CPJX-PC3J vulnerabilities

Vulnerabilities for packages: open-webui, semgrep, airflow...

GHSA-4XPC-PV4P-PM3W vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-PW6J-QG29-8W7F vulnerabilities

Vulnerabilities for packages: airflow, mitmproxy...

GHSA-VFFW-93WF-4J4Q vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-WPFP-GWWC-VWQ6 vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-5RVQ-CXJ2-64VF vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-XQMJ-J6MV-4862 vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-QRC4-49GV-MV9M vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-4XPC-PV4P-PM3W vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-4XGF-CPJX-PC3J vulnerabilities

Vulnerabilities for packages: vllm-openai-cuda-13.0, tritonserver-backend-vllm-cuda-12.9, semgrep, airflow-postgres-fips, airflow-core, airflow, lmcache-cuda-12.8, vllm-cuda-13.2, mcp-atlassian, prefect-fips, litellm, tritonserver-backend-vllm-cuda-13.0, azureml-inference-server-http,...

CVE-2026-49468 vulnerabilities

Vulnerabilities for packages: airflow...

EUVD-2026-37520

A path traversal in the SFTP provider SFTPHook.retrievedirectory / SFTPOperatoroperation=get let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is a...

GHSA-QF38-JQ28-3CCQ Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory

A path traversal in the SFTP provider SFTPHook.retrievedirectory / SFTPOperatoroperation=get let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is a...

PYSEC-0000-CVE-2026-50203

A path traversal in the SFTP provider SFTPHook.retrievedirectory / SFTPOperatoroperation=get let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is a...

Relative Path Traversal

Overview apache-airflow-providers-sftp is a Provider package apache-airflow-providers-sftp for Apache Airflow Affected versions of this package are vulnerable to Relative Path Traversal via the SFTPHook.retrievedirectory and SFTPHook.retrievedirectoryconcurrently functions. An attacker can cause...

CVE-2026-50203 Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory allows local file write outside the destination directory via malicious server-supplied directory-entry names

A path traversal in the SFTP provider SFTPHook.retrievedirectory / SFTPOperatoroperation=get let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is a...

CVE-2026-50203 Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory allows local file write outside the destination directory via malicious server-supplied directory-entry names

A path traversal in the SFTP provider SFTPHook.retrievedirectory / SFTPOperatoroperation=get let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is a...

CLEANSTART-2026-NM83456 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python

Multiple security vulnerabilities affect the airflow-2 package. AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. See references for individual vulnerability details...

CVE-2026-49818

The Apache Airflow Samba provider's GCSToSambaOperator joined GCS object names to the SMB destination path without a containment check, so an object named with ../ segments resolved a write path outside the configured destinationpath. An attacker able to write objects into the source GCS bucket —...