CVE-2026-41084

A bug in Apache Airflow's bulk Task Instances API "PATCH/DELETE /api/v2/dags/dagid/dagRuns/dagrunid/taskInstances" evaluated authorization against the "dagid" resolved from the URL path while operating on the "dagid" / "dagrunid" extracted from request-body entity fields. An authenticated UI/API...

WS-2017-0258

Navigating to a page with dagid param specified as a html tag leads to that tag being rendered due to using Markup tag which makes html be labeled as safe. XSS issues with unsanitized user input being displayed...

PYSEC-2026-14

Apache Airflow versions 3.0.0 through 3.1.7FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dagid set to "" wildcard for all DAGs. As a result, version metadata of DAGs that the requester is not authorized to access is returned.Users are...