Apache Airflow vulnerabilities

CVE-2020-13927 [CRITICAL] CWE-306 CVE-2020-13927: The previous default setting for Airflow's Experimental API was to allow all API requests without au The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication.

CVE-2020-11978 [HIGH] CWE-78 CVE-2020-11978: An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vul An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples dis

CVE-2022-24288 [HIGH] CWE-78 CVE-2022-24288: In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.

CVE-2022-40127 [HIGH] CWE-94 CVE-2022-40127: A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.

CVE-2021-38540 [CRITICAL] CWE-269 CVE-2021-38540: The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This al The variable import endpoint was not protected by authentication in Airflow >=2.0.0, =2.0.0, <2.1.3.

CVE-2020-11981 [CRITICAL] CWE-78 CVE-2020-11981: An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an at An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.

CVE-2020-17526 [HIGH] CVE-2020-17526: Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default conf Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config.

CVE-2020-11982 [CRITICAL] CWE-502 CVE-2020-11982: An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an at An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious payload directly to the broker which could lead to a deserialization attack (and thus remote code execution) on the Worker.

CVE-2026-33264 [CRITICAL] CWE-502 CVE-2026-33264: A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-contro A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-au

CVE-2023-22884 [CRITICAL] CWE-77 CVE-2023-22884: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL Provider: before 4.0.0.

CVE-2022-40189 [CRITICAL] CWE-78 CVE-2022-40189: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Pig Provider versions prior to 4.0.0. It also impacts any Apache

CVE-2022-38649 [CRITICAL] CWE-78 CVE-2022-38649: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Apache Airflow Pinot Provider versions prior to 4.0.0. It also

CVE-2026-42359 [HIGH] CVE-2026-42359: A bug in Apache Airflow's XCom PATCH endpoint `PATCH /api/v2/xcomEntries/{key}` allowed an authentic A bug in Apache Airflow's XCom PATCH endpoint `PATCH /api/v2/xcomEntries/{key}` allowed an authenticated UI/API user with XCom write permission on a Dag to set XCom entries under reserved key names (e.g. `return_value`) that the matching POST endpoint already validated against `FORBIDDEN_XCOM_KEYS`. The endpoint also accepted serialized payload shapes the tri

CVE-2024-39877 [HIGH] CWE-94 CVE-2024-39877: Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG a Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability.

CVE-2024-45034 [HIGH] CWE-250 CVE-2024-45034: Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local sett Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.

CVE-2026-30898 [HIGH] CWE-77 CVE-2026-30898: An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the w An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker. Users should review if any of their own DAGs have adopted this incorrect advice.

CVE-2022-45402 [MEDIUM] CWE-601 CVE-2022-45402: In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` en In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint.

CVE-2023-39508 [HIGH] CWE-200 CVE-2023-39508: Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the webserver context as well as allows to bypas limitation of acce

CVE-2026-33858 [HIGH] CWE-502 CVE-2026-33858: Dag Authors, who normally should not be able to execute code in the webserver context could craft XC Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low. Users are recommended to upgrade to Apache Airflow 3.2.0, which resolves this issue.

CVE-2026-49298 [HIGH] CVE-2026-49298: A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate a A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate against the Execution API to be passed to the worker container as command-line arguments visible in the pod spec. An authenticated UI/API user with Kubernetes read-only access to the cluster (e.g. `pods/get` in the Airflow namespace) could harvest the JWT from `