CVE-2026-94135

The Apache Airflow SFTP provider's deferrable code paths SFTPTrigger, SFTPHookAsync, SFTPClientPool disable SSH host-key verification by default unless the connection explicitly sets nohostkeycheck to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attack...

CVE-2026-92228

The Apache Airflow Keycloak provider's multi-team provisioning attachteampermissions granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team...

CVE-2026-94135 Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default

The Apache Airflow SFTP provider's deferrable code paths SFTPTrigger, SFTPHookAsync, SFTPClientPool disable SSH host-key verification by default unless the connection explicitly sets nohostkeycheck to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attack...

CVE-2026-94135

The Apache Airflow SFTP provider contains a vulnerability where the deferrable code paths (SFTPTrigger , SFTPHookAsync , and SFTPClientPool ) disable SSH host-key verification by default. This occurs unless the connection explicitly sets no_host_key_check to false. Affected deployments running SF...

CVE-2026-94135 Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default

The Apache Airflow SFTP provider's deferrable code paths SFTPTrigger, SFTPHookAsync, SFTPClientPool disable SSH host-key verification by default unless the connection explicitly sets nohostkeycheck to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attack...

CVE-2026-94135 Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default

The Apache Airflow SFTP provider's deferrable code paths SFTPTrigger, SFTPHookAsync, SFTPClientPool disable SSH host-key verification by default unless the connection explicitly sets nohostkeycheck to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attack...

CVE-2026-96806 Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token

The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but KeycloakJWTMiddleware then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: afte...

CVE-2026-96806

The Apache Airflow Keycloak auth manager is vulnerable to a session management flaw where the logout route fails to terminate the user session. Although the logout route revokes the presented token, the KeycloakJWTMiddleware component issues a new, unrevoked token within the same response, effect...

CVE-2026-96806 Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token

The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but KeycloakJWTMiddleware then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: afte...

CVE-2026-94134

The Apache Airflow SSH provider hook contains a vulnerability where it disables SSH host-key verification by default. Unless a host_key is configured or no_host_key_check is explicitly set to false, the hook accepts any server key. This affects both SSH and SFTP connections and allows an attacker...

CVE-2026-94134 Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless hostkey is configured or nohostkeycheck is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position...

CVE-2026-94134 Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless hostkey is configured or nohostkeycheck is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position...

CVE-2026-92228 Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read

The Apache Airflow Keycloak provider's multi-team provisioning attachteampermissions granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team...

CVE-2026-92228

The apache-airflow-providers-keycloak component is vulnerable due to an issue in the multi-team provisioning function (_attach_team_permissions). This flaw incorrectly grants every team role global read access to audit logs. Affected deployments are those that enable multi-team mode with the Keyc...

CVE-2026-92228 Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read

The Apache Airflow Keycloak provider's multi-team provisioning attachteampermissions granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team...

CVE-2026-92228 Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read

The Apache Airflow Keycloak provider's multi-team provisioning attachteampermissions granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team...

CVE-2026-25604-PoC

CVE-2026-25604 PoC Host Header Injection leading to SAML authentication bypass in Apache Airflow's AWS Auth Manager An attacker can inject a malicious Host header into the SAML login flow, causing the Assertion Consumer Service ACS URL to point to an attacker-controlled server. This allows the...

Dubbo-deserialization

Dubbo-deserialization CVE-2020-1948 Apache Dubbo Provider default deserialization cause RCE Dubbo Study Dubbo-exp Dubbo-poc Dubbo复现环境...

CVE-2021-27905

CVE-2021-27905 Sr No| Title ---|--- 1| Overview 2| Root Cause 3| Proof Of Concept 4| Mitigation 8.8.2+ 5| Reference For educational and research purposes only. Do not use this code on systems you do not own or have explicit permission to test. I am not responsible for any misuse. Overview This is...

CVE-2025-66249-POC

CVE-2025-66249 — Apache Livy Path Traversal Whitelist Bypass For educational and security research purposes only. Do not use against systems you do not own or have explicit written permission to test. →Full Disclaimer Overview Field| Detail ---|--- CVE ID| CVE-2025-66249 Severity| Important CVSS...