8733 matches found
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the bulk Task Instances API PATCH/DELETE /api/v2/dags/dagid/dagRuns/dagrunid/taskInstances that evaluates authorization against the dagid resolved from the URL path while operating on...
airflow-tools (>=0.3.1, <=0.6.3), apache-airflow-providers-common-io (>=1.0.0rc1, <=1.4.2rc1) +1 more potentially affected by CVE-2026-46764 via apache-airflow (2.8.0)
apache-airflow PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-tools =0.3.1, =1.0.0rc1, =1.4.2rc1 - flowpyter-task 1.1.0.post0.dev45 Source cves: CVE-2026-46764 Source advisory:...
GHSA-MXQ5-F9C5-W4P5 Apache Airflow Vulnerable to Authorization Bypass Through User-Controlled Key
A bug in Apache Airflow's bulk Task Instances API PATCH/DELETE /api/v2/dags/dagid/dagRuns/dagrunid/taskInstances evaluated authorization against the dagid resolved from the URL path while operating on the dagid / dagrunid extracted from request-body entity fields. An authenticated UI/API user wit...
Apache Airflow Vulnerable to Authorization Bypass Through User-Controlled Key
A bug in Apache Airflow's bulk Task Instances API PATCH/DELETE /api/v2/dags/dagid/dagRuns/dagrunid/taskInstances evaluated authorization against the dagid resolved from the URL path while operating on the dagid / dagrunid extracted from request-body entity fields. An authenticated UI/API user wit...
airflow-tools (>=0.3.1, <=0.6.3), apache-airflow-providers-common-io (>=1.0.0rc1, <=1.4.2rc1) +1 more potentially affected by CVE-2026-42358 via apache-airflow (2.8.0)
apache-airflow PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-tools =0.3.1, =1.0.0rc1, =1.4.2rc1 - flowpyter-task 1.1.0.post0.dev45 Source cves: CVE-2026-42358 Source advisory:...
GHSA-89CJ-XRPX-J79M Apache Airflow has a Link Following issue
A Dag author could either a create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process read-path attack — e.g. /etc/passwd or airflow.cfg or b supply a taskid containing .. sequences accepted by the Task SDK's KEYREGEX write-path attack, and...
Apache Airflow has a Link Following issue
A Dag author could either a create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process read-path attack — e.g. /etc/passwd or airflow.cfg or b supply a taskid containing .. sequences accepted by the Task SDK's KEYREGEX write-path attack, and...
aind-airflow-jobs (>=0.2.1, <=0.2.6), apache-airflow-providers-snowflake (>=1.0.0b2, <=1.0.0) +2 more potentially affected by CVE-2026-40861 via apache-airflow (2.8.1)
apache-airflow PYPI version 2.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - aind-airflow-jobs =0.2.1, =1.0.0b2, =1.1.1.post0.dev6, =1.1.3.post0.dev5 Source cves: CVE-2026-40861 Source advisory:...
Insertion of Sensitive Information Into Sent Data
Overview apache-airflow-task-sdk is a The Apache Airflow Task SDK includes interfaces for Dag authors and Task execution logic for Python. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the handling of rendered template fields when the...
airflow-balancer (>=0.7.0, <=0.7.6), airflow-clickhouse-plug (1.6.2) +38 more potentially affected by CVE-2026-42360 via apache-airflow-task-sdk (>=1.0.0rc4, <=1.2.1)
apache-airflow-task-sdk PYPI version =1.0.0rc4, =0.7.0, =1.5.0, =0.6.1, =1.10.7, =0.6.0a1, =0.1.0, =1.4.3, =0.3.0, =1.2.10, =3.0.0rc3, =3.0.0rc3, =1.1.3rc1, =1.6.0rc1, =1.5.3rc1, =1.6.2 and more Source cves: CVE-2026-42360 Source advisory: SNYK:PYTHON-APACHEAIRFLOWTASKSDK-17131176...
aind-airflow-jobs (>=0.2.1, <=0.2.6), apache-airflow-providers-snowflake (>=1.0.0b2, <=1.0.0) +2 more potentially affected by CVE-2026-42360 via apache-airflow (2.8.1)
apache-airflow PYPI version 2.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - aind-airflow-jobs =0.2.1, =1.0.0b2, =1.1.1.post0.dev6, =1.1.3.post0.dev5 Source cves: CVE-2026-42360 Source advisory:...
CVE-2026-41084
A bug in Apache Airflow's bulk Task Instances API PATCH/DELETE /api/v2/dags/dagid/dagRuns/dagrunid/taskInstances evaluated authorization against the dagid resolved from the URL path while operating on the dagid / dagrunid extracted from request-body entity fields. An authenticated UI/API user wit...
PYSEC-2026-183
A bug in Apache Airflow's bulk Task Instances API PATCH/DELETE /api/v2/dags/dagid/dagRuns/dagrunid/taskInstances evaluated authorization against the dagid resolved from the URL path while operating on the dagid / dagrunid extracted from request-body entity fields. An authenticated UI/API user wit...
PYSEC-2026-183
A bug in Apache Airflow's bulk Task Instances API PATCH/DELETE /api/v2/dags/dagid/dagRuns/dagrunid/taskInstances evaluated authorization against the dagid resolved from the URL path while operating on the dagid / dagrunid extracted from request-body entity fields. An authenticated UI/API user wit...
PYSEC-0000-CVE-2026-41084
A bug in Apache Airflow's bulk Task Instances API PATCH/DELETE /api/v2/dags/dagid/dagRuns/dagrunid/taskInstances evaluated authorization against the dagid resolved from the URL path while operating on the dagid / dagrunid extracted from request-body entity fields. An authenticated UI/API user wit...
CVE-2026-40861
A Dag author could either a create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process read-path attack — e.g. /etc/passwd or airflow.cfg or b supply a taskid containing .. sequences accepted by the Task SDK's KEYREGEX write-path attack, and...
PYSEC-2026-181
A Dag author could either a create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process read-path attack — e.g. /etc/passwd or airflow.cfg or b supply a taskid containing .. sequences accepted by the Task SDK's KEYREGEX write-path attack, and...
PYSEC-2026-181
A Dag author could either a create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process read-path attack — e.g. /etc/passwd or airflow.cfg or b supply a taskid containing .. sequences accepted by the Task SDK's KEYREGEX write-path attack, and...
Insertion of Sensitive Information Into Sent Data
Overview apache-airflow-task-sdk is a The Apache Airflow Task SDK includes interfaces for Dag authors and Task execution logic for Python. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the /api/v2/connections/connectionid REST API...
airflow-balancer (>=0.7.0, <=0.7.6), airflow-clickhouse-plug (1.6.2) +38 more potentially affected by CVE-2026-45192 via apache-airflow-task-sdk (>=1.0.0rc4, <=1.2.1)
apache-airflow-task-sdk PYPI version =1.0.0rc4, =0.7.0, =1.5.0, =0.6.1, =1.10.7, =0.6.0a1, =0.1.0, =1.4.3, =0.3.0, =1.2.10, =3.0.0rc3, =3.0.0rc3, =1.1.3rc1, =1.6.0rc1, =1.5.3rc1, =1.6.2 and more Source cves: CVE-2026-45192 Source advisory: SNYK:PYTHON-APACHEAIRFLOWTASKSDK-17132596...