Behoben in
CVEs, die 3.3 betreffen
| CVE | Titel | CVSS | Ausgenutzt | EPSS | Veröffentlicht |
|---|---|---|---|---|---|
| CVE-2026-58076 | Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerializati... | 8.8 | — | 2026-08-12 | |
| CVE-2026-68968 | Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill i... | 7.5 | — | 2026-08-12 | |
| CVE-2026-68969 | Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext | 6.5 | — | 2026-08-12 | |
| CVE-2026-68971 | Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints | 6.5 | — | 2026-08-12 | |
| CVE-2026-59244 | Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI | 6.5 | — | 2026-08-12 | |
| CVE-2026-68970 | Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI | 6.5 | — | 2026-08-12 | |
| CVE-2026-68076 | Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection | 5.4 | — | 2026-08-12 | |
| CVE-2026-59242 | Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint | 5.4 | — | 2026-08-12 | |
| CVE-2026-75158 | Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter | 4.3 | — | 2026-09-21 | |
| CVE-2026-54183 | Apache Airflow: Airflow Variables were not masked in the UI for authenticated users | 4.3 | — | 2026-08-12 | |
| CVE-2026-82355 | Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixat... | 4.2 | — | 2026-09-21 |
Verfolgen Sie diese Versionen auf Ihren eigenen Servern
InfraGuard erfasst die installierten Softwareversionen auf jedem Server und markiert diejenigen mit bekannten Schwachstellen. Self-Hosted – nichts verlässt Ihr Netzwerk.
Daten: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (siehe EPSS unter https://www.first.org/epss), endoflife.date. Softwareliste: awesome-selfhosted (CC BY-SA 3.0).