Behoben in
CVEs, die 2.0 betreffen
| CVE | Titel | CVSS | Ausgenutzt | EPSS | Veröffentlicht |
|---|---|---|---|---|---|
| CVE-2026-33264 | Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize(... | 9.8 | — | 2026-07-07 | |
| CVE-2021-38540 | Apache Airflow: Variable Import endpoint missed authentication check | 9.8 | — | 2021-09-09 | |
| CVE-2022-40189 | Apache Airlfow Pig Provider RCE | 9.8 | — | 2022-11-22 | |
| CVE-2022-38649 | Apache Airflow Pinot provider allowed Command Injection | 9.8 | — | 2022-11-22 | |
| CVE-2022-40127 | Apache Airflow <2.4.0 has an RCE in a bash example | 8.8 | — | 2022-11-14 | |
| CVE-2026-30898 | Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf | 8.8 | — | 2026-04-18 | |
| CVE-2026-49298 | Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments | 8.8 | — | 2026-06-01 | |
| CVE-2022-24288 | Apache Airflow: RCE in example DAGs | 8.8 | — | 2022-02-25 | |
| CVE-2025-54550 | Apache Airflow: RCE by race condition in example_xcom dag | 8.1 | — | 2026-04-15 | |
| CVE-2022-41672 | Session still functional after user is deactivated | 8.1 | — | 2022-10-07 | |
| CVE-2023-40273 | Session fixation in Apache Airflow web interface | 8.0 | — | 2023-08-23 | |
| CVE-2022-41131 | Apache Airflow Hive Provider vulnerability (command injection via hive_cli connection) | 7.8 | — | 2022-11-22 | |
| CVE-2026-30912 | Apache Airflow: Exposing stack trace in case of constraint error | 7.5 | — | 2026-04-18 | |
| CVE-2022-27949 | Apache Airflow prior to 2.3.1 may include sensitive values in rendered template | 7.5 | — | 2022-11-14 | |
| CVE-2026-68968 | Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill i... | 7.5 | — | 2026-08-12 | |
| CVE-2025-68675 | Apache Airflow: proxy credentials for various providers might leak in task logs | 7.5 | — | 2026-01-16 | |
| CVE-2026-45360 | Apache Airflow: Arbitrary import in custom deadline-reference deserialization | 7.3 | — | 2026-06-01 | |
| CVE-2026-25917 | Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5) | 7.2 | — | 2026-04-18 | |
| CVE-2026-40861 | Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler | 6.5 | — | 2026-06-01 | |
| CVE-2021-26559 | CWE-284 Improper Access Control on Configurations Endpoint for the Stable API | 6.5 | — | 2021-02-17 | |
| CVE-2026-42360 | Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking | 6.5 | — | 2026-06-01 | |
| CVE-2026-25219 | Apache Airflow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users... | 6.5 | — | 2026-04-15 | |
| CVE-2026-48892 | Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options | 6.5 | — | 2026-07-07 | |
| CVE-2026-49487 | Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs | 6.5 | — | 2026-07-07 | |
| CVE-2021-45230 | Apache Airflow: Creating DagRuns didn't respect Dag-level permissions in the Webserver | 6.5 | — | 2022-01-20 | |
| CVE-2026-48828 | Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key | 6.5 | — | 2026-07-07 | |
| CVE-2026-49296 | Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id} | 6.5 | — | 2026-07-07 | |
| CVE-2026-45192 | Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response | 6.5 | — | 2026-06-01 | |
| CVE-2026-68969 | Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext | 6.5 | — | 2026-08-12 | |
| CVE-2026-48726 | Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path | 6.5 | — | 2026-06-01 | |
| CVE-2026-42358 | Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets | 6.5 | — | 2026-06-01 | |
| CVE-2026-68971 | Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints | 6.5 | — | 2026-08-12 | |
| CVE-2026-59244 | Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI | 6.5 | — | 2026-08-12 | |
| CVE-2026-68970 | Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI | 6.5 | — | 2026-08-12 | |
| CVE-2020-17515 | The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This iss... | 6.1 | — | 2020-12-11 | |
| CVE-2022-45402 | Apache Airflow: Open redirect during login | 6.1 | — | 2022-11-15 | |
| CVE-2022-43982 | Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL | 6.1 | — | 2022-11-02 | |
| CVE-2021-45229 | Apache Airflow: Reflected XSS via Origin Query Argument in URL | 6.1 | — | 2022-02-25 | |
| CVE-2022-43985 | Apache Airflow prior to 2.4.2 has an open redirect | 6.1 | — | 2022-11-02 | |
| CVE-2021-28359 | Apache Airflow Reflected XSS via Origin Query Argument in URL | 6.1 | — | 2021-05-02 | |
| CVE-2020-13944 | In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulner... | 6.1 | — | 2020-09-17 | |
| CVE-2026-41016 | Apache Airflow Providers SMTP: No certificate validation on SMTP STARTTLS connections in SMTP provider | 5.9 | — | 2026-04-30 | |
| CVE-2026-49267 | Apache Airflow: No certificate validation on SMTP STARTTLS connections | 5.9 | — | 2026-06-01 | |
| CVE-2022-40954 | Apache Airflow Spark Provider RCE that bypass restrictions to read arbitrary files | 5.5 | — | 2022-11-22 | |
| CVE-2026-68076 | Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection | 5.4 | — | 2026-08-12 | |
| CVE-2026-59242 | Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint | 5.4 | — | 2026-08-12 | |
| CVE-2021-35936 | No Authentication on Logging Server | 5.3 | — | 2021-08-16 | |
| CVE-2021-26697 | Apache Airflow: Lineage API endpoint for Experimental API missed authentication check | 5.3 | — | 2021-02-17 | |
| CVE-2022-38170 | Overly permissive umask for daemons | 4.7 | — | 2022-09-02 | |
| CVE-2026-48891 | Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.sour... | 4.3 | — | 2026-07-07 | |
| CVE-2026-75158 | Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter | 4.3 | — | 2026-09-21 | |
| CVE-2026-38743 | Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities | 4.3 | — | 2026-04-24 | |
| CVE-2026-46764 | Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter | 4.3 | — | 2026-06-01 | |
| CVE-2023-40611 | Apache Airflow Dag Runs Broken Access Control Vulnerability | 4.3 | — | 2023-09-12 | |
| CVE-2026-54183 | Apache Airflow: Airflow Variables were not masked in the UI for authenticated users | 4.3 | — | 2026-08-12 | |
| CVE-2026-40690 | Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated topologies and all DA... | 4.3 | — | 2026-04-24 |
Verfolgen Sie diese Versionen auf Ihren eigenen Servern
InfraGuard erfasst die installierten Softwareversionen auf jedem Server und markiert diejenigen mit bekannten Schwachstellen. Self-Hosted – nichts verlässt Ihr Netzwerk.
Daten: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (siehe EPSS unter https://www.first.org/epss), endoflife.date. Softwareliste: awesome-selfhosted (CC BY-SA 3.0).