Apache Airflow vulnerabilities

CVE-2026-58076 [HIGH] CWE-502 CVE-2026-58076: Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's `executor_config` reaches that branch, so a Dag author could place a value there that causes

CVE-2026-49298 [HIGH] CVE-2026-49298: A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate a A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate against the Execution API to be passed to the worker container as command-line arguments visible in the pod spec. An authenticated UI/API user with Kubernetes read-only access to the cluster (e.g. `pods/get` in the Airflow namespace) could harvest the JWT from `

CVE-2024-45498 [HIGH] CWE-116 CVE-2024-45498: Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerabi Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the dangerous example; see https://github.com/apache/airf

CVE-2026-42252 [CRITICAL] CVE-2026-42252: Apache Airflow's official documentation at `core-concepts/dag-run.html` ("Passing Parameters when tr Apache Airflow's official documentation at `core-concepts/dag-run.html` ("Passing Parameters when triggering Dags") showed a verbatim `BashOperator(bash_command="echo value: {{ dag_run.conf['conf1'] }}")` example without any quoting / sanitization warning. Dag authors who copied the pattern verbatim into deployments where users had `Dag.can_trigger` permi

CVE-2025-54550 [HIGH] CWE-94 CVE-2025-54550: The example example_xcom that was included in airflow documentation implemented unsafe pattern of re The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary execution of code on the worker. Since the UI users are already highly trusted, this is a Low severity vulnerability. It does n

CVE-2023-25754 [CRITICAL] CWE-270 CVE-2023-25754: Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.This is Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.6.0.

CVE-2025-57735 [CRITICAL] CWE-613 CVE-2025-57735: When user logged out, the JWT token the user had authtenticated with was not invalidated, which coul When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should

CVE-2017-17836 [CRITICAL] CWE-255 CVE-2017-17836: In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, whether it be via XSS or by leaving a machine unlocked can exfiltrate all credentials from the system.

CVE-2017-15720 [HIGH] CWE-20 CVE-2017-15720: In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object.

CVE-2023-37379 [HIGH] CWE-200 CVE-2023-37379: Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connection feature by sending many requests, leading to a denial of service (DoS) condition on the se

CVE-2024-56373 [HIGH] CWE-94 CVE-2024-56373: DAG Author (who already has quite a lot of permissions) could manipulate database of Airflow 2 in th DAG Author (who already has quite a lot of permissions) could manipulate database of Airflow 2 in the way to execute arbitrary code in the web-server context, which they should normally not be able to do, leading to potentially remote code execution in the context of web-server (server-side) as a result of a user viewing historical task information. T

CVE-2025-68675 [HIGH] CWE-532 CVE-2025-68675: In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result, when such connections are rendered or printed to logs,

CVE-2026-30911 [HIGH] CWE-862 CVE-2026-30911: Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this i

CVE-2024-28746 [HIGH] CWE-281 CVE-2024-28746: Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access. Users of Apache Airflow are recommended to upgrade to version 2.8.3 or newer to mitigate the risk associated with t

CVE-2022-38054 [CRITICAL] CWE-384 CVE-2022-38054: In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was suscept In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation.

CVE-2026-67260 [HIGH] CWE-502 CVE-2026-67260: Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an arbitrary module import and object instantiation insi

CVE-2026-45360 [HIGH] CWE-502 CVE-2026-45360: Apache Airflow's scheduler-side deadline-reference decoder (`SerializedCustomReference.deserialize_r Apache Airflow's scheduler-side deadline-reference decoder (`SerializedCustomReference.deserialize_reference`) imported and dispatched arbitrary class paths drawn from DAG-author-controlled serialized state without an allowlist or plugin-registry gate. A DAG author whose code reaches the scheduler — the default on single-host deployments where the DAG

CVE-2026-28779 [HIGH] CWE-668 CVE-2026-28779: Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regar Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url. This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itsel

CVE-2026-41084 [HIGH] CWE-639 CVE-2026-41084: A bug in Apache Airflow's bulk Task Instances API (`PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_ A bug in Apache Airflow's bulk Task Instances API (`PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances`) evaluated authorization against the `dag_id` resolved from the URL path while operating on the `dag_id` / `dag_run_id` extracted from request-body entity fields. An authenticated UI/API user with edit permission on one Dag could

CVE-2025-66236 [HIGH] CWE-532 CVE-2025-66236: Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay attention to security details and security model of Airflow. Some assumptions the Deployment Manager could make were not clear or explicit enough, even though Airflow's intentions and security model of Airflow did not