CVE-2026-67587 Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget

Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default alloweddeserializationclasses allow-list, so tightening that...

CVE-2026-67587

Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default alloweddeserializationclasses allow-list, so tightening that...

CVE-2026-67587 Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget

Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default alloweddeserializationclasses allow-list, so tightening that...

CVE-2026-65017

CVE-2026-65017 describes a masking bypass in Apache Airflow’s Config API in multi-team deployments. A Viewer with only configuration-read access could read a team-scoped Celery broker URL and its embedded credentials in cleartext, even though the global option is masked. The issue arises because ...

CVE-2026-65017 Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

EUVD-2026-57272

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

CVE-2026-65017

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

CVE-2026-65017 Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

CVE-2026-68968

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

CVE-2026-68968 Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

CVE-2026-68968 Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

EUVD-2026-57271

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

CVE-2026-68968

The CVE affects Apache Airflow (Backfill API). A mismatch between dependency parsing and endpoint validation for backfill_id (int() vs NonNegativeInt) allows an authenticated user with edit rights on one Dag to read, pause, and cancel backfills for other Dags. FastAPI resolves dependencies before...

CVE-2026-68968 Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

EUVD-2026-57270

Apache Airflow wrote Variable values and Connection extra contents to the audit log in cleartext when they were submitted through the bulk endpoints PATCH /api/v2/variables and PATCH /api/v2/connections. The audit-log masking recognised only top-level request fields, and a bulk request nests its...

CVE-2026-68969

Summary: CVE-2026-68969 affects Apache Airflow where bulk endpoints for variables and connections log secrets in audit logs in cleartext due to improper masking. The endpoints affected are PATCH /api/v2/variables and PATCH /api/v2/connections; bulk requests nest entities two levels deep, bypassin...

CVE-2026-68969 Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext

Apache Airflow wrote Variable values and Connection extra contents to the audit log in cleartext when they were submitted through the bulk endpoints PATCH /api/v2/variables and PATCH /api/v2/connections. The audit-log masking recognised only top-level request fields, and a bulk request nests its...

CVE-2026-68969 Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext

Apache Airflow wrote Variable values and Connection extra contents to the audit log in cleartext when they were submitted through the bulk endpoints PATCH /api/v2/variables and PATCH /api/v2/connections. The audit-log masking recognised only top-level request fields, and a bulk request nests its...

CVE-2026-68969

Apache Airflow wrote Variable values and Connection extra contents to the audit log in cleartext when they were submitted through the bulk endpoints PATCH /api/v2/variables and PATCH /api/v2/connections. The audit-log masking recognised only top-level request fields, and a bulk request nests its...

CVE-2026-68969 Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext

Apache Airflow wrote Variable values and Connection extra contents to the audit log in cleartext when they were submitted through the bulk endpoints PATCH /api/v2/variables and PATCH /api/v2/connections. The audit-log masking recognised only top-level request fields, and a bulk request nests its...