Apache Software Foundation Apache Airflow vulnerabilities

CVE-2021-26697 [MEDIUM] CWE-269 CVE-2021-26697: The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airfl The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue

CVE-2023-35908 [MEDIUM] CWE-863 CVE-2023-35908: Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL. It is recommended to upgrade to a version that is not affected

CVE-2021-45230 [MEDIUM] CVE-2021-45230: In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "can_crea In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "can_create" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for.

CVE-2023-22888 [MEDIUM] CWE-20 CVE-2023-22888: Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to cau Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to cause a service disruption by manipulating the run_id parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected

CVE-2023-49920 [MEDIUM] CWE-352 CVE-2023-49920: Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user's consent. Users are advise

CVE-2025-62402 [MEDIUM] CWE-250 CVE-2025-62402: API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.

CVE-2021-35936 [MEDIUM] CWE-200 CVE-2021-35936: If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the c If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG jobs. This issue affects Apache Airflow < 2.1.2.

CVE-2026-41016 [MEDIUM] CWE-295 CVE-2026-41016: Apache Airflow's SMTP provider `SmtpHook` called Python's `smtplib.SMTP.starttls()` without an SSL c Apache Airflow's SMTP provider `SmtpHook` called Python's `smtplib.SMTP.starttls()` without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS upgrade, and capture the SMTP credentials sent dur

CVE-2024-29735 [MEDIUM] CWE-281 CVE-2024-29735: Improper Preservation of Permissions vulnerability in Apache Airflow.This issue affects Apache Airfl Improper Preservation of Permissions vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.8.2 through 2.8.3. Airflow's local file task handler in Airflow incorrectly set permissions for all parent folders of log folder, in default configuration adding write access to Unix group of the folders. In the case Airflow is run with the

CVE-2020-17513 [MEDIUM] CWE-918 CVE-2020-17513: In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack.

CVE-2024-41937 [MEDIUM] CWE-79 CVE-2024-41937: Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a maliciou Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This would require the provider to be installed on the web server and the user to click the provider link. Users should upgrade to 2.10.0 or later, whic

CVE-2023-39441 [MEDIUM] CWE-295 CVE-2023-39441: Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Air Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL Certificate vulnerability. The default SSL context with SSL library did not check a server's X.509 certificate. Instead, the code accepted any certificate, which could result in the disclosu

CVE-2022-40954 [MEDIUM] CWE-78 CVE-2022-40954: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider versions prior to 4.0.0. It also impacts any Apache Airf

CVE-2020-9485 [MEDIUM] CWE-79 CVE-2020-9485: An issue was found in Apache Airflow versions 1.10.10 and below. A stored XSS vulnerability was disc An issue was found in Apache Airflow versions 1.10.10 and below. A stored XSS vulnerability was discovered in the Chart pages of the the "classic" UI.

CVE-2021-45229 [MEDIUM] CWE-79 CVE-2021-45229: It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the ` It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. This issue affects Apache Airflow versions 2.2.3 and below.

CVE-2018-20244 [MEDIUM] CWE-79 CVE-2018-20244: In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airfl In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.

CVE-2024-32077 [MEDIUM] CWE-79 CVE-2024-32077: Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject mal Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs. Users are recommended to upgrade to version 2.9.1, which fixes this issue.

CVE-2020-11983 [MEDIUM] CWE-79 CVE-2020-11983: An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the admin management screens in the new/RBAC UI handled escaping incorrectly, allowing authenticated users with appropriate permissions to create stored XSS attacks.

CVE-2024-27906 [MEDIUM] CWE-862 CVE-2024-27906: Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view D Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI. Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability

CVE-2023-47265 [MEDIUM] CWE-79 CVE-2023-47265: Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG. This Javascript can be executed on the client side of any of the user who looks at the tasks in the browser sandbox. While this issue does not allow to exi