Apache Software Foundation Apache Airflow vulnerabilities

CVE-2026-40861 [MEDIUM] CWE-59 CVE-2026-40861: A Dag author could either (a) create a symlink under their task's log directory pointing to an arbit A Dag author could either (a) create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process (read-path attack — e.g. `/etc/passwd` or `airflow.cfg`) or (b) supply a `task_id` containing `..` sequences accepted by the Task SDK's `KEY_REGEX` (write-path attack), and in both cases the FileTaskHandler

CVE-2026-27173 [HIGH] CWE-538 CVE-2026-27173: JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform actions that were only available to running tasks via Task SDK and potentially allow to modify state of Airflow Database for tasks.

CVE-2022-41672 [HIGH] CWE-613 CVE-2022-41672: In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authentic In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

CVE-2022-41131 [HIGH] CWE-78 CVE-2022-41131: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG files. This issue affects Hive Provider versions prior to 4.1.0. It also impacts any Apache Ai

CVE-2023-50943 [HIGH] CWE-502 CVE-2023-50943: Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to pois Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enable_xcom_pickling=False" configuration setting resulting in poisoned data after XCom deserialization. This vulnerability is considered low since it requires a DAG author to exploit it. Users are recomm

CVE-2026-75157 [HIGH] CWE-863 CVE-2026-75157: Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing action gated on a read-only permission. Deployments are

CVE-2024-45784 [HIGH] CWE-1295 CVE-2024-45784: Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configurat Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG authors to unintentionally or intentionally log sensitive configuration variables. Unauthorized users could access these logs, potentially exposing critical data that could be exploited to compr

CVE-2026-32228 [HIGH] CWE-863 CVE-2026-32228: UI / API User with asset materialize permission could trigger dags they had no access to. Users are UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.

CVE-2022-27949 [HIGH] CWE-200 CVE-2022-27949: A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered temp A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example when they were depending on past and previous instances of the task failed). This issue affects Apache Airflow prior to 2.3.1.

CVE-2025-68438 [HIGH] CWE-200 CVE-2025-68438: In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_te In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include user-registered mask_secret() patterns, so secrets

CVE-2026-30912 [HIGH] CWE-668 CVE-2026-30912: In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_ In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.

CVE-2026-40961 [HIGH] CWE-601 CVE-2026-40961: A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that b A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the `is_safe_url` check, enabling redirection from a trusted Airflow domain to an attacker-controlled origin. Users are advised to upgrade to `apache-airflow` 3.2.2 or later. As a defense-in-depth mitigation, deployment operators can place Airfl

CVE-2023-46215 [HIGH] CWE-532 CVE-2023-46215: Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Ap Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow. Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend Note: the vulnerability is about the information exposed in the logs not about accessing the logs. This issue affects Apache Ai

CVE-2026-34538 [MEDIUM] CWE-668 CVE-2026-34538: Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security model documentation that defines the Viewer role as read-on

CVE-2026-48892 [MEDIUM] CWE-200 CVE-2026-48892: The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables l The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID`) as synthetic config options whose option names were not in `sensitive_config_values`, so the masker did not redact them. An authenticated UI/API

CVE-2026-49296 [MEDIUM] CWE-639 CVE-2026-49296: Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Da Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. `GET /api/v2/dagSources/{dag_id}` — and the equivalent Dag-source view in the UI — returned the entire source file without redacting Dags the caller was not authorized to read, bypassing per-DAG read authorizatio

CVE-2020-13944 [MEDIUM] CWE-79 CVE-2020-13944: In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit.

CVE-2026-24098 [MEDIUM] CWE-200 CVE-2026-24098: Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with per Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. Users are advised to upgrade to 3.1.7 or later, which resolves this issue

CVE-2026-26929 [MEDIUM] CWE-732 CVE-2026-26929: Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG au Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). As a result, version metadata of DAGs that the requester is not authorized to access is returned. Users are recommended to upgrade to Apache Airflow 3.1.8

CVE-2025-27018 [MEDIUM] CWE-89 CVE-2025-27018: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow MySQL Provider. When user triggered a DAG with dump_sql or load_sql functions they could pass a table parameter from a UI, that could cause SQL injection by running SQL that was not intended. It could lead to data corruption, modifica