CVE-2026-67260

Apache Airflow 3.3.0 introduced a vulnerability in the scheduler's awaiting_input task-state sweep, which deserializes a task instance's next_kwargs without an allow-list. A user with DAG-author permissions can control that value via the task execution API, causing an arbitrary module import and ...

CVE-2026-68968

Apache Airflow's Backfill API contained an authorization bypass caused by inconsistent parsing of the backfill_id path segment. The authorization dependency parsed the value with int(), while the route handler used pydantic's NonNegativeInt, which coerces values like 1.0 to 1 that int() would rej...

CVE-2026-48892

Apache Airflow 's Config API exposed per-key secrets-backend environment overrides (e.g., AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID) as synthetic config options whose names were absent from sensitive_config_values, causing the secrets masker to fail to redact them. An authenticated UI/API user w...

CVE-2026-68076

Apache Airflow's environment-variable secrets backend contained a team-scope guard bypass in the connections-test API. The guard that prevented cross-team resolution only activated when no team scope was supplied, and its pattern failed to match team names containing underscores. When the guard d...

CVE-2026-68969

Apache Airflow's bulk endpoints (PATCH /api/v2/variables and PATCH /api/v2/connections) wrote Variable values and Connection extra contents to the audit log in cleartext . The root cause is that audit-log masking recognized only top-level request fields, while bulk requests nest entities two leve...

CVE-2026-48828

Apache Airflow 's Bulk Variables API contained a redaction bypass: the redactor was invoked without passing the variable's key, preventing the key-based should_hide_value_for_key check (which triggers on secret-suffixed names like *_password, *_token, *_secret) from firing for JSON-decodable vari...

CVE-2026-49296

Apache Airflow before version 3.3.0 is vulnerable to an authorization bypass in the DAG source retrieval endpoint. The GET /api/v2/dagSources/{dag_id} API (and its equivalent UI view) returned the entire source file without redacting DAGs the caller was not authorized to read, effectively bypassi...

CVE-2026-48891

Apache Airflow 's /ui/dependencies scheduling graph endpoint contained a residual authorization flaw: the caller's readable-Dag filter was applied to the top-level serialized Dag key but not propagated into the dep.source and dep.target fields of trigger and sensor dependency entries. An authenti...

CVE-2026-49487

Apache Airflow versions before 3.3.0 expose secrets through the REST API task-instance detail and list endpoints. When a deferred operator passes a secret (e.g., a provider API key) into its trigger, the trigger kwargs are returned without masking . Any authenticated user holding DAG-scoped task-...

CVE-2026-68971

Apache Airflow versions prior to 3.3.1 contain a cross-team authorization bypass in two API sites: the asset materialization endpoint (POST /api/v2/assets/{asset_id}/materialize) and the XCom result check on wait_dag_run_until_finished. Unlike all other authorization points, these two sites resol...

CVE-2026-59242

Apache Airflow prior to 3.3.1 is vulnerable to deserialization of untrusted data (CWE-502) in its XCom GET /api/v2/{...}/xcomEntries/{key}?deserialize=true endpoint. The endpoint passed a string-literal payload through BaseXCom.deserialize_value without the _check_forbidden_xcom_keys guard, allow...

CVE-2026-65017

Apache Airflow's Config API failed to mask team-scoped sensitive configuration values in multi-team deployments. The secrets masker matched only base section and option names without normalizing team-prefixed sections before the sensitivity check (CWE-200 ). As a result, an authenticated Viewer w...

CVE-2026-54183

Apache Airflow's secrets masker failed to hide sensitive values in the Variables UI when they were nested inside a list, tuple, or set beyond the masker's recursion-depth limit. The prior fix for CVE-2026-42358 made only the dictionary traversal unbounded, leaving these collection types unmasked....

CVE-2026-67587

Apache Airflow (Task SDK, versions 3.3.0+ ) is vulnerable to a deserialization of untrusted data (CWE-502) in the Callback object reconstruction. When deserializing, the SDK re-runs the SyncCallback constructor, which imports the module named by the stored callback path. Because SyncCallback is a...

CVE-2026-68970

Apache Airflow's Task SDK failed to mask Variable contents when the deserialized JSON value was a top-level list , exposing secrets in cleartext in task logs and the Rendered Templates UI. Masking was only applied for string and dict values. Any authenticated user able to read a task's logs or re...