35 matches found
CVE-2026-81862
Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. S3ToTeradataOperator and AzureBlobStorageToTeradataOperator interpolate the source bucket's credentials as plain string literals into the CREATE MULTISET TABLE ... LOCATION statement whenever the...
CVE-2026-51153
Stored Cross-Site Scripting XSS in TaskRunHandler.post in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task//run, the handler renders task log content logtmp into the HTML response using Python % string formatting without HTML encoding. logtmp is populated from th...
CVE-2026-18186
A stored format string vulnerability was found in the FTP Backup on the ADM. The vulnerability occurs because user-controlled backup configuration data may be written into a task log and later processed through an unsafe format string operation. An authenticated attacker can exploit this issue to...
CVE-2026-40861
A Dag author could either a create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process read-path attack — e.g. /etc/passwd or airflow.cfg or b supply a taskid containing .. sequences accepted by the Task SDK's KEYREGEX write-path attack, and...
CVE-2026-41018
The Elasticsearch logging provider is vulnerable to credential exposure when a host URL includes embedded credentials (e.g., https://user:[email protected]:9200). The provider writes the full URL, including these credentials, into task logs , allowing any user with task-log read permiss...
CVE-2026-43826
The OpenSearch logging provider in Apache Airflow is vulnerable to credential leakage when the host URL includes embedded credentials (e.g., https://user:[email protected]:9200). The provider writes the full URL, including the embedded credentials , into task logs , allowing any user wi...
CVE-2026-43826 Apache Airflow Providers OpenSearch: OpenSearch task-log handler leaks credentials embedded in the host URL
The OpenSearch logging provider, when configured with a host URL that embeds credentials for example https://user:[email protected]:9200, wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend...
PT-2026-7102
Name of the Vulnerable Software and Affected Versions Apache Airflow versions 3.1.0 through 3.1.6 Description An authorization flaw exists in Apache Airflow that could allow an authenticated user with limited task permissions to view task logs without proper authorization. The issue affects syste...
EUVD-2024-47955
Malicious code in bioql PyPI...
EUVD-2022-6550
Malicious code in bioql PyPI...
CVE-2024-6972
In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in clear-text...
CVE-2022-40365
Cross site scripting XSS vulnerability in ouqiang gocron through 1.5.3, allows attackers to execute arbitrary code via scope.row.hostname in web/vue/src/pages/taskLog/list.vue...
CVE-2020-14320
In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk...
CVE-2024-6972
CVE-2024-6972 affects Octopus Server. Under certain circumstances, sensitive variables can be printed in clear-text in task logs. The CVSS v3.1 base score is 6.5 (MEDIUM) with high impact on confidentiality; exploitation requires no user interaction but does not require network access (attack vec...
CVE-2024-6972
In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in clear-text...
CVE-2024-6972
In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in clear-text...
PT-2024-38011 · Unknown · Octopus Server
Name of the Vulnerable Software and Affected Versions: Octopus Server affected versions not specified Description: The issue allows sensitive variables to be printed in the task log in clear-text under certain circumstances. Recommendations: At the moment, there is no information about a newer...
CVE-2024-6972: Cleartext Transmission of Sensitive Information
In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in clear-text...
