Apache Software Foundation Apache Airflow vulnerabilities

CVE-2023-45348 [MEDIUM] CWE-200 CVE-2023-45348: Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticate Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when the "expose_config" option is set to "non-sensitive-only". The `expose_config` option is False by default. It is recommended to upgrade to a version that is not affected.

CVE-2026-32690 [LOW] CWE-668 CVE-2026-32690: Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked. If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to Apache Airflow 3.2.0 that has the fix implemented

CVE-2026-40963 [LOW] CWE-285 CVE-2026-40963: The structure_data endpoint in the Airflow UI returned external dependency graph nodes for linked Da The structure_data endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking whether the caller had read permission on those linked Dags. An authenticated UI/API user authorized for one Dag could enumerate linked Dag IDs and dependency metadata for other Dags they were not authorized to read. Affects deploymen

CVE-2026-45426 [LOW] CWE-863 CVE-2026-45426: Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued for at least one Dag. Apache Airflow's Log server authorized JWT tokens against Dag IDs by applying Python's `str.lstrip()` to the requested path segment when verifying the JWT's `sub` claim. `str.lstrip()` strips any of a *set* of cha