CVE-2026-68971

Apache Airflow versions prior to 3.3.1 contain a cross-team authorization bypass in two API sites: the asset materialization endpoint (POST /api/v2/assets/{asset_id}/materialize) and the XCom result check on wait_dag_run_until_finished. Unlike all other authorization points, these two sites resol...

CVE-2025-54550

The example examplexcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary execution of code on the worker. Since the UI users are already highly...

CVE-2025-54550

The example examplexcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary execution of code on the worker. Since the UI users are already highly...