GHSA-5j6p-jrrm-6x94 high
Apache Airflow: Execution API JWT leaked via KubernetesExecutor worker command-line args
Affected range
ECOSYSTEM: introduced 0; fixed 3.2.2Fixed versions: 3.2.2
apache-airflow-core
Core packages for Apache Airflow, schedule and API server
PyPI latest 3.3.2 Apache-2.0
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
3.3.2
No matching published advisory returned
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
High
5 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-6ffj-2wg2-w45j high
Apache Airflow allows code execution through crafted XCom payloads
Affected range
ECOSYSTEM: introduced 0; fixed 3.2.0Fixed versions: 3.2.0
GHSA-h97w-pm3w-mwmc high
Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions
Affected range
ECOSYSTEM: introduced 3.0.0; fixed 3.2.0Fixed versions: 3.2.0
GHSA-w7cf-2pmc-5m4c moderate
Apache Airflow exposes SQL stack trace despite "api/expose_stack_traces" set to false
Affected range
ECOSYSTEM: introduced 0; fixed 3.2.0Fixed versions: 3.2.0
Apache Airflow Exposes Secrets in Variables Saved as JSON Dictionaries
Affected range
ECOSYSTEM: introduced 3.0.0; fixed 3.2.0Fixed versions: 3.2.0