Apache Airflow vulnerabilities

CVE-2023-42663 [MEDIUM] CWE-200 CVE-2023-42663: Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has ac Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.

CVE-2023-35005 [MEDIUM] CWE-200 CVE-2023-35005: In Apache Airflow, some potentially sensitive values were being shown to the user in certain situati In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all uncensored values are actually sentitive. This issue affects Apache A

CVE-2023-40712 [MEDIUM] CWE-200 CVE-2023-40712: Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated user Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly advised to upgrade to version 2.7.1 or later which has re

CVE-2022-46651 [MEDIUM] CWE-200 CVE-2022-46651: Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized ac Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version

CVE-2023-42780 [MEDIUM] CWE-200 CVE-2023-42780: Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAGs. It would reveal the dag_ids and the stack-traces of import errors for those DAGs with import errors. Users of Apache Airflow are advised to upgrade

CVE-2023-50944 [MEDIUM] CWE-862 CVE-2023-50944: Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to acc Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue.

CVE-2026-41017 [MEDIUM] CWE-614 CVE-2026-41017: Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure` flag, so deploy Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure` flag, so deployments running the Airflow API server behind an HTTPS-terminating reverse proxy (e.g. nginx / Envoy / a managed load balancer that terminates TLS and forwards plaintext to the API server, the default cloud-native topology) would have the user's session

CVE-2023-36543 [MEDIUM] CWE-1333 CVE-2023-36543: Apache Airflow, versions before 2.6.3, has a vulnerability where an authenticated user can use craft Apache Airflow, versions before 2.6.3, has a vulnerability where an authenticated user can use crafted input to make the current request hang. It is recommended to upgrade to a version that is not affected

CVE-2019-0229 [HIGH] CWE-352 CVE-2019-0229: A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate pr A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks.

CVE-2018-20245 [HIGH] CWE-295 CVE-2018-20245: The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was m The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checking.

CVE-2021-26697 [MEDIUM] CWE-269 CVE-2021-26697: The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airfl The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue

CVE-2023-35908 [MEDIUM] CWE-863 CVE-2023-35908: Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL. It is recommended to upgrade to a version that is not affected

CVE-2021-45230 [MEDIUM] CVE-2021-45230: In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "can_crea In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "can_create" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for.

CVE-2023-22888 [MEDIUM] CWE-20 CVE-2023-22888: Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to cau Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to cause a service disruption by manipulating the run_id parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected

CVE-2023-49920 [MEDIUM] CWE-352 CVE-2023-49920: Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user's consent. Users are advise

CVE-2025-62402 [MEDIUM] CWE-250 CVE-2025-62402: API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.

CVE-2021-35936 [MEDIUM] CWE-200 CVE-2021-35936: If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the c If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG jobs. This issue affects Apache Airflow < 2.1.2.

CVE-2021-29621 [MEDIUM] CWE-203 CVE-2021-29621: Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database aut Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version 3.3.0 or higher to resolve.

CVE-2026-49267 [MEDIUM] CVE-2026-49267: Apache Airflow's EmailOperator and the underlying `airflow.utils.email` helpers established SMTP STA Apache Airflow's EmailOperator and the underlying `airflow.utils.email` helpers established SMTP STARTTLS connections without verifying the remote certificate when the deployment used `[email] smtp_starttls=True` without `[email] smtp_ssl`. An attacker positioned between the worker and the configured SMTP server (network MITM — typical hostile-network attac

CVE-2026-41016 [MEDIUM] CWE-295 CVE-2026-41016: Apache Airflow's SMTP provider `SmtpHook` called Python's `smtplib.SMTP.starttls()` without an SSL c Apache Airflow's SMTP provider `SmtpHook` called Python's `smtplib.SMTP.starttls()` without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS upgrade, and capture the SMTP credentials sent dur