airflow-calendar (>=0.5.0, <=0.9.1), airflow-provider-great-expectations (1.0.0) +2 more potentially affected by CVE-2026-58076 via apache-airflow (>=3.3.0, <=3.3.1rc2)

apache-airflow PYPI version =3.3.0, =0.5.0, =1.3.0, =1.3.1rc2 Source cves: CVE-2026-58076 Source advisory: GHSA-8PRW-8M6X-8W6F...

airflow-calendar (>=0.5.0, <=0.9.1), airflow-provider-great-expectations (1.0.0) +2 more potentially affected by CVE-2026-65017 via apache-airflow-core (>=3.3.0, <=3.3.1rc2)

apache-airflow-core PYPI version =3.3.0, =0.5.0, =3.3.0, =1.3.0, =1.3.1rc2 Source cves: CVE-2026-65017 Source advisory: SNYK:PYTHON-APACHEAIRFLOWCORE-18748191...

Deserialization of Untrusted Data

Overview apache-airflow-task-sdk is a The Apache Airflow Task SDK includes interfaces for Dag authors and Task execution logic for Python. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialization of the Callback object, which reconstructs the...

airflow-calendar (>=0.5.0, <=0.9.1), airflow-provider-great-expectations (1.0.0) +2 more potentially affected by CVE-2026-67587 via apache-airflow-task-sdk (>=1.3.0, <=1.3.1rc2)

apache-airflow-task-sdk PYPI version =1.3.0, =0.5.0, =3.3.0, =3.3.1rc2 - apache-airflow-core 3.3.0 Source cves: CVE-2026-67587 Source advisory: SNYK:PYTHON-APACHEAIRFLOWTASKSDK-18748192...

Cleartext Storage of Sensitive Information

Overview apache-airflow-task-sdk is a The Apache Airflow Task SDK includes interfaces for Dag authors and Task execution logic for Python. Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information in the Variable deserialization. An attacker can access sensiti...

airflow-balancer (>=0.7.0, <=0.7.6), airflow-calendar (>=0.5.0, <=0.9.1) +45 more potentially affected by CVE-2026-68970 via apache-airflow-task-sdk (>=1.0.0rc4, <=1.3.1rc2)

apache-airflow-task-sdk PYPI version =1.0.0rc4, =0.7.0, =0.5.0, =1.5.0, =0.6.1, =1.10.7, =0.6.0a1, =0.1.0, =1.4.3, =0.3.0, =1.2.10, =3.0.0rc3, =3.0.0rc3, =3.3.0 - apache-airflow-providers-box 2.0.6 and more Source cves: CVE-2026-68970 Source advisory: SNYK:PYTHON-APACHEAIRFLOWTASKSDK-18748200...

Cleartext Storage of Sensitive Information

Overview apache-airflow-task-sdk is a The Apache Airflow Task SDK includes interfaces for Dag authors and Task execution logic for Python. Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information in the Rendered Templates UI when the var.json fails to mask...

airflow-balancer (>=0.7.0, <=0.7.6), airflow-calendar (>=0.5.0, <=0.9.1) +45 more potentially affected by CVE-2026-59244 via apache-airflow-task-sdk (>=1.0.0rc4, <=1.3.1rc2)

apache-airflow-task-sdk PYPI version =1.0.0rc4, =0.7.0, =0.5.0, =1.5.0, =0.6.1, =1.10.7, =0.6.0a1, =0.1.0, =1.4.3, =0.3.0, =1.2.10, =3.0.0rc3, =3.0.0rc3, =3.3.0 - apache-airflow-providers-box 2.0.6 and more Source cves: CVE-2026-59244 Source advisory: SNYK:PYTHON-APACHEAIRFLOWTASKSDK-18748199...

PYSEC-2026-3712

Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level...

airflow-tools (>=0.3.1, <=0.6.3), apache-airflow-providers-common-io (>=1.0.0rc1, <=1.4.2rc1) +1 more potentially affected by CVE-2026-68968 via apache-airflow (2.8.0)

apache-airflow PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-tools =0.3.1, =1.0.0rc1, =1.4.2rc1 - flowpyter-task 1.1.0.post0.dev45 Source cves: CVE-2026-68968 Source advisory:...

airflow-tools (>=0.3.1, <=0.6.3), apache-airflow-providers-common-io (>=1.0.0rc1, <=1.4.2rc1) +1 more potentially affected by CVE-2026-50204 +1 more via apache-airflow (2.8.0)

apache-airflow PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-tools =0.3.1, =1.0.0rc1, =1.4.2rc1 - flowpyter-task 1.1.0.post0.dev45 Source cves: CVE-2026-50204, CVE-2026-68969 Source...

airflow-tools (>=0.3.1, <=0.6.3), apache-airflow-providers-common-io (>=1.0.0rc1, <=1.4.2rc1) +1 more potentially affected by CVE-2026-68971 via apache-airflow (2.8.0)

apache-airflow PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-tools =0.3.1, =1.0.0rc1, =1.4.2rc1 - flowpyter-task 1.1.0.post0.dev45 Source cves: CVE-2026-68971 Source advisory:...

PYSEC-2026-3712

Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level...

CVE-2026-68970

Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level...

PYSEC-2026-3708

Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default alloweddeserializationclasses allow-list, so tightening that...

airflow-calendar (>=0.5.0, <=0.9.1), airflow-provider-great-expectations (1.0.0) +2 more potentially affected by CVE-2026-67587 via apache-airflow (>=3.3.0, <=3.3.1rc2)

apache-airflow PYPI version =3.3.0, =0.5.0, =1.3.0, =1.3.1rc2 Source cves: CVE-2026-67587 Source advisory: OSV:PYSEC-2026-3708...

PYSEC-2026-3708

Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default alloweddeserializationclasses allow-list, so tightening that...

airflow-calendar (>=0.5.0, <=0.9.1), airflow-provider-great-expectations (1.0.0) +2 more potentially affected by CVE-2026-67260 via apache-airflow (>=3.3.0, <=3.3.1rc2)

apache-airflow PYPI version =3.3.0, =0.5.0, =1.3.0, =1.3.1rc2 Source cves: CVE-2026-67260 Source advisory: OSV:PYSEC-2026-3707...

airflow-tools (>=0.3.1, <=0.6.3), apache-airflow-providers-common-io (>=1.0.0rc1, <=1.4.2rc1) +1 more potentially affected by CVE-2026-59242 via apache-airflow (2.8.0)

apache-airflow PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-tools =0.3.1, =1.0.0rc1, =1.4.2rc1 - flowpyter-task 1.1.0.post0.dev45 Source cves: CVE-2026-59242 Source advisory:...

airflow-tools (>=0.3.1, <=0.6.3), apache-airflow-providers-common-io (>=1.0.0rc1, <=1.4.2rc1) +1 more potentially affected by CVE-2026-59244 via apache-airflow (2.8.0)

apache-airflow PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-tools =0.3.1, =1.0.0rc1, =1.4.2rc1 - flowpyter-task 1.1.0.post0.dev45 Source cves: CVE-2026-59244 Source advisory:...