Apache Airflow vulnerabilities

CVE-2018-20244 [MEDIUM] CWE-79 CVE-2018-20244: In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airfl In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.

CVE-2022-43982 [MEDIUM] CWE-79 CVE-2022-43982: In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to X In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument.

CVE-2020-11983 [MEDIUM] CWE-79 CVE-2020-11983: An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the admin management screens in the new/RBAC UI handled escaping incorrectly, allowing authenticated users with appropriate permissions to create stored XSS attacks.

CVE-2024-27906 [MEDIUM] CWE-862 CVE-2024-27906: Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view D Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI. Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability

CVE-2023-47265 [MEDIUM] CWE-79 CVE-2023-47265: Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG. This Javascript can be executed on the client side of any of the user who looks at the tasks in the browser sandbox. While this issue does not allow to exi

CVE-2024-50378 [MEDIUM] CWE-201 CVE-2024-50378: Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log a Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive variables were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow database. While this risk is limit

CVE-2022-43985 [MEDIUM] CWE-601 CVE-2022-43985: In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's `/confirm` In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's `/confirm` endpoint.

CVE-2023-29247 [MEDIUM] CWE-79 CVE-2023-29247: Task instance details page in the UI is vulnerable to a stored XSS.This issue affects Apache Airflow Task instance details page in the UI is vulnerable to a stored XSS.This issue affects Apache Airflow: before 2.6.0.

CVE-2024-39863 [MEDIUM] CWE-79 CVE-2024-39863: Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to i Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue.

CVE-2026-75158 [MEDIUM] CWE-200 CVE-2026-75158: Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events — including the source Dag ID, task ID, run ID and event timestamps — for Dags they have no

CVE-2022-40754 [MEDIUM] CWE-601 CVE-2022-40754: In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's `/confirm` endp In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's `/confirm` endpoint.

CVE-2019-12398 [MEDIUM] CWE-79 CVE-2019-12398: In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edi In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected.

CVE-2024-25142 [MEDIUM] CWE-525 CVE-2024-25142: Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. Airflow Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. Airflow did not return "Cache-Control" header for dynamic content, which in case of some browsers could result in potentially storing sensitive data in local cache of the browser. This issue affects Apache Airflow: before 2.9.2. Users are recommended to upgra

CVE-2024-26280 [MEDIUM] CWE-276 CVE-2024-26280: Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by default, they need to be explicitly granted permissions to

CVE-2023-48291 [MEDIUM] CVE-2023-48291: Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authent Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn't. This is a missing fix for CVE-2023-

CVE-2025-54941 [MEDIUM] CWE-78 CVE-2025-54941: An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redir An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on worker. This however required that the example dags are enabled in production (not default) or the example dag code copied to build your own similar dag. If you used the `example_dag_decorator`

CVE-2017-12614 [MEDIUM] CWE-79 CVE-2017-12614: It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to Apache Airflow 1.9.0 or above.

CVE-2026-82355 [MEDIUM] CWE-384 CVE-2026-82355: When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the audit log -- as the cookie's principal rather than t

CVE-2026-41014 [MEDIUM] CWE-862 CVE-2026-41014: The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not p The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization. An authenticated UI/API user with global Asset:read permission could enumerate partition run state, schedule configuration, and asset wiring for Dags they were not authorized to read. Affects deployments that rely on per-Dag read

CVE-2023-25695 [MEDIUM] CWE-209 CVE-2023-25695: Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Founda Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.5.2.