Skip to content
RequestGuard Vulnerabilities
Pricing
Vulnerability intelligence PyPI

apache-airflow

Programmatically author, schedule and monitor data pipelines

PyPI latest 3.3.2 Apache-2.0

Evidence path

Version, exploitation, severity

RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.

1

Latest version

3.3.2

No matching published advisory returned

2

Known exploitation

No KEV match

Checked by exact CVE identifier

3

Highest advisory severity

Critical

151 active advisories

Check an exact version

The registry confirms the version, then OSV checks advisories for that exact value.

Published records

Advisories

151
PYSEC-2024-265 critical

Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.   * FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected) * FAB provider 1.2.0 affected all versions of Airflow. Users who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue. Users who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue. Also upgrading Apache Airflow to latest version available is recommended. Note: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images.  Users are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints.

Affected range

ECOSYSTEM: introduced 0; last affected 1.2.1; last affected 1.2.0
CVE-2024-42447 Source ↗Source ↗
PYSEC-2025-87 critical

Edge3 Worker RPC RCE on Airflow 2. This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if you installed and configured it on Airflow 2. The Edge3 provider support in Airflow 2 has been always development-only and not officially released, however if you installed and configured Edge3 provider in Airflow 2, it implicitly enabled non-public (normally) API which was used to test Edge Provider in Airflow 2 during the development. This API allowed Dag author to perform Remote Code Execution in the webserver context, which Dag Author was not supposed to be able to do. If you installed and configured Edge3 provider for Airflow 2, you should uninstall it and migrate to Airflow 3. The new Edge3 provider versions (>=2.0.0) has minimum version of Airflow set to 3 and the RCE-prone Airflow 2 code is removed, so it should no longer be possible to use the Edge3 provider 2.0.0+ on Airflow 2. If you used Edge Provider in Airflow 3, you are not affected.

Affected range

ECOSYSTEM: introduced 0; fixed 2.0.0

Fixed versions: 2.0.0

CVE-2025-67895 Source ↗Source ↗
PYSEC-2023-314 critical

Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider. This issue affects Apache Airflow Sqoop Provider versions before 3.1.1.

Affected range

ECOSYSTEM: introduced 0; fixed 3.1.1

Fixed versions: 3.1.1

CVE-2023-25693 Source ↗Source ↗
GHSA-9g2w-5f3v-mfmm critical

Insecure default config of Celery worker in Apache Airflow

Affected range

ECOSYSTEM: introduced 0; fixed 1.10.11ECOSYSTEM: introduced 0; fixed 1.10.11rc1

Fixed versions: 1.10.11, 1.10.11rc1

CVE-2020-11982 Source ↗Source ↗
GHSA-7c2f-r6gc-h92h high

Apache Airflow proxy credentials for various providers might leak in task logs

Affected range

ECOSYSTEM: introduced 3.0.0b1; fixed 3.1.6ECOSYSTEM: introduced 0; fixed 2.11.1ECOSYSTEM: introduced 0; fixed 3.1.6

Fixed versions: 3.1.6, 2.11.1

CVE-2025-68675 Source ↗Source ↗
GHSA-c392-whpc-vfpr high

Apache Airflow vulnerable to Improper Encoding or Escaping of Output

Affected range

ECOSYSTEM: introduced 2.10.0; fixed 2.10.1ECOSYSTEM: introduced 0; last affected 2.10.0-NA

Fixed versions: 2.10.1

CVE-2024-45498 Source ↗Source ↗
Show 75 more advisories
PYSEC-2026-3707 Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job. No non-default configuration is required: the sweep runs unconditionally every 15 seconds, and the default `allowed_deserialization_classes` setting does not cover this code path. Versions before 3.3.0 are not affected, because human-in-the-loop tasks deferred onto the triggerer instead. This is a different code path from CVE-2026-58076, which covers the same unguarded exception-node deserialization reached elsewhere — deployments that applied that fix must upgrade for this issue as well. Users are advised to upgrade to apache-airflow 3.3.1 or later.
PYSEC-2026-3710 Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse. The authorization dependency parsed it with `int()` while the route handler parsed it as pydantic's `NonNegativeInt`, which accepts values `int()` rejects (`1.0` coerces to `1`); FastAPI resolves dependencies before endpoint validation, so the two acted on different Dags. An authenticated user holding edit permission on any single Dag could therefore read, pause and cancel backfills belonging to any other Dag, including moving another Dag's queued runs to `failed`. No non-default configuration is required and backfill ids are sequential, so finding a target is trivial. Users are advised to upgrade to apache-airflow 3.3.1 or later, which parses the backfill id with the same type the routes declare.
PYSEC-2026-3708 Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncCallback` is itself an Airflow class it passes the default `allowed_deserialization_classes` allow-list, so tightening that setting does not help. A Dag author — who controls a task instance's `next_kwargs` through the task execution API — can therefore cause an arbitrary module to be imported inside the scheduler process, when the scheduler's `awaiting_input` timeout sweep deserializes that value. No non-default configuration is required; the sweep runs unconditionally. Versions before 3.3.0 are not affected: the class existed, but the scheduler sweep that reaches it did not. This is a separate code path from CVE-2026-58076 and CVE-2026-67260, which cover different gadgets reaching deserialization — applying either of those fixes does not address this one. Users are advised to upgrade to apache-airflow 3.3.1 or later.
PYSEC-2026-13 Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.
GHSA-q2hg-643c-gw8h Apache Airflow: RCE by race condition in example_xcom dag
GHSA-666g-rfc5-c9jv Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerability
GHSA-phv5-vq5p-qhp7 Apache Airflow: JWT token appearing in logs
GHSA-6hcw-qqr8-pjj8 Apache Airflow: Authenticated users can bypass the `is_safe_url` check
PYSEC-2026-18 In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.
GHSA-wr76-29cr-67w8 Apache Airflow has a Deserialization of Untrusted Data vulnerability
GHSA-mxq5-f9c5-w4p5 Apache Airflow Vulnerable to Authorization Bypass Through User-Controlled Key
GHSA-mc4f-r875-v87w Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API
GHSA-8x34-9q3v-h7g8 Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization
GHSA-4m3h-wp5w-5hqh Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata
GHSA-4fhm-p86v-hwpx Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications
GHSA-fvw2-2pf7-77vw Apache Airflow subject to Exposure of Sensitive Information
GHSA-6pw3-8h9w-32gc Apache Airflow vulnerable to OS Command Injection via example DAGs
GHSA-c3c6-f2ww-xfr2 Apache Airflow: pickle deserialization vulnerability in XComs
GHSA-vm5m-qmrx-fw8w Apache Airflow: Bypass permission verification to read code of other dags
GHSA-269x-pg5c-5xgm Apache Airflow Execution with Unnecessary Privileges
GHSA-x2mh-8fmc-rqgh Apache Airflow denial of service vulnerability
GHSA-xvw9-3mhm-xjqq Apache Airflow information disclosure vulnerability
GHSA-2h84-3crq-vgfj Apache Airflow Incorrect Authorization vulnerability
GHSA-5946-8p38-vffp Apache Airflow Improper Input Validation vulnerability
GHSA-3h4m-m55v-gx4m Apache Airflow Improper Input Validation vulnerability
GHSA-ggwr-4vr8-g7wv Apache Airflow Path Traversal vulnerability
GHSA-r7x6-xfcm-3mxv Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
GHSA-mjff-wv85-hmcj Apache Airflow vulnerable to exposure of sensitive information
GHSA-mjqh-v5f2-g2mw Apache Airflow information exposure vulnerability
GHSA-ffw3-6mp6-jmvj Improper Access Control in Apache Airflow
GHSA-w6j4-3gh2-9f5j Apache Airflow vulnerable to CSRF Attacks
GHSA-3v7g-4pg3-7r6j OS Command injection in Apache Airflow
GHSA-7mx5-x372-xh87 Incorrect Session Validation in Apache Airflow
GHSA-68wv-rjrm-576p Cross-Site Request Forgery (CSRF) in Apache Airflow
GHSA-pm87-24wq-r8w9 Apache Airflow Session Fixation vulnerability
GHSA-5rp4-749p-vx26 Apache Airflow vulnerable to Use of Externally-Controlled Format String
GHSA-3q8r-f3pj-3gc4 Apache Airflow may allow authenticated users who have been deactivated to continue using the UI or API
GHSA-8fg4-j562-mjrc Improper Input Validation in Apache Airflow resulting in Remote Code Execution
GHSA-77rc-x84q-pv4f Improper Certificate Validation in Apache Airflow
GHSA-563f-2439-rmq4 Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API
GHSA-r7vr-m4jw-r794 Apache Airflow has an authorization bypass in DagRun wait endpoint
GHSA-w7cp-g8v7-r54m Apache Airflow Cross-site Scripting Vulnerability
GHSA-pm44-x5x7-24c4 Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access
GHSA-gfw7-2v73-69wg Apache Airflow error reporting may expose full kwargs
GHSA-8r55-rv5w-6pfm Apache Airflow exposes sensitive information in its log files
GHSA-5g2w-9f8g-g5q7 Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated Users
GHSA-j857-2pwm-jjmm Apache Airflow vulnerable to Insertion of Sensitive Information Into Sent Data
GHSA-j482-47xf-p25c Apache Airflow Potential Cross-site Scripting Vulnerability
GHSA-9xpj-62mm-24h2 Apache Airflow does not return the "Cache-Control" header for dynamic content
GHSA-22hf-vx2v-gjff Apache Airflow exposes deferred trigger kwargs in task-instance API responses
GHSA-3322-mjxh-9mp5 Apache Airflow exposes unreadable DAG identifiers in the scheduling dependencies graph
GHSA-9933-5rrp-mfwx Apache Airflow exposes secrets backend credentials through the Config API
PYSEC-2026-3705 Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was shown unmasked in the Variables UI. The exposure is limited to the UI: any authenticated user who can see the Variable in the UI can already read its full value through the Variables REST API, so this does not disclose data the user could not otherwise obtain — the masking is a shoulder-surfing defense for the UI, not an access-control boundary. This is an incomplete-fix follow-up to CVE-2026-42358, whose fix made only the dictionary walk unbounded; lists, tuples, and sets beyond the depth limit remained unmasked in the UI. Deployments that applied the CVE-2026-42358 fix should also upgrade to address this residual case. Upgrade to apache-airflow 3.3.1 or later.
PYSEC-2026-3711 Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`). The audit-log masking recognised only top-level request fields, and a bulk request nests its entities two levels below, so no masking was applied to them. Any authenticated user with audit-log read access -- who need not hold Variables or Connections read at all -- could recover those secrets verbatim, and the Connection `extra` copy is stored unencrypted in the log while the connection table encrypts it. The Airflow UI's *Import Variables* action posts to this endpoint, so an ordinary operator import wrote every secret in the file to the log. This is a different code path from CVE-2026-50204: that fix shipped in 3.3.0 and covers the single-entity endpoints only, so deployments that upgraded in response to that advisory remain affected and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later.
PYSEC-2026-3706 Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.
PYSEC-2026-3712 Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level matched neither and was returned unmasked. Any authenticated user able to read the logs or rendered templates of a task that references such a Variable could recover the values, with no special configuration required. This is the list-shaped counterpart of CVE-2026-59244, whose fix covered the dict case only, so deployments that upgraded in response to that advisory remain affected and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later.
PYSEC-2026-3709 Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are allowed to contain. When the guard did not apply, the lookup fell through to an unconditional global read that resolved the stored `AIRFLOW_CONN__<TEAM>___<ID>` variable regardless of which team asked. In multi-team mode an authenticated user of one team could therefore have `POST /api/v2/connections/test` resolve another team's Connection and authenticate outward with that team's credentials; the endpoint uses the credentials rather than returning them. Exploitation requires `[core] multi_team` enabled, `[core] test_connection` set to `Enabled` (it ships `Disabled`), team-scoped secrets provisioned as environment variables in the API-server process, and knowledge of the encoded identifier. Redirecting the test at an attacker-controlled host is separately blocked. Users are advised to upgrade to apache-airflow 3.3.1 or later.
GHSA-4fh7-7jx4-8f6c apache-airflow DAG source authorization bypass exposes co-located DAG source
GHSA-799x-qp47-8qwq Apache Airflow has no certificate validation on SMTP STARTTLS connections
GHSA-4g48-54q2-fg7q Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access
GHSA-mg2x-mggj-6955 Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service
GHSA-wrpj-755p-x363 Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange
GHSA-5f35-pq34-c87q Apache Airflow missing Certificate Validation
GHSA-w7rc-q6cm-f5gm Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions
GHSA-qphr-3mvq-v466 Apache Airflow has an Authorization Bypass Through User-Controlled Key
GHSA-p3v3-229h-mc63 Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance record
GHSA-33g2-gx67-c2h3 Apache Airflow Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
GHSA-cg3x-89rc-x9mw Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
GHSA-x2x7-p37c-43cr Apache Airflow has a Missing Authorization issue
GHSA-95v7-h9j5-gvjr Apache Airflow has a Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
GHSA-89cj-xrpx-j79m Apache Airflow has a Link Following issue
GHSA-vr7m-c6v4-8cx8 Apache Airflow: Auth manager doesn't invalidate JWT tokens after users click logout
GHSA-2883-wwh7-x57v Apache Airflow: Incomplete redaction allowlist exposes secrets in Connection `extra`  to read-permitted users
GHSA-gp5f-cx7h-8q6f Apache Airflow's create action can upsert existing Pools/Connections/Variables
GHSA-cff3-5qrp-hqx7 Apache Airflow Improper Preservation of Permissions vulnerability