Fixed in
CVEs affecting 3.2
| CVE | Title | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2026-33264 | Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize(... | 9.8 | — | 2026-07-07 | |
| CVE-2026-49298 | Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments | 8.8 | — | 2026-06-01 | |
| CVE-2026-68968 | Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill i... | 7.5 | — | 2026-08-12 | |
| CVE-2026-45360 | Apache Airflow: Arbitrary import in custom deadline-reference deserialization | 7.3 | — | 2026-06-01 | |
| CVE-2026-40861 | Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler | 6.5 | — | 2026-06-01 | |
| CVE-2026-42360 | Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking | 6.5 | — | 2026-06-01 | |
| CVE-2026-48892 | Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options | 6.5 | — | 2026-07-07 | |
| CVE-2026-49487 | Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs | 6.5 | — | 2026-07-07 | |
| CVE-2026-48828 | Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key | 6.5 | — | 2026-07-07 | |
| CVE-2026-49296 | Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id} | 6.5 | — | 2026-07-07 | |
| CVE-2026-45192 | Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response | 6.5 | — | 2026-06-01 | |
| CVE-2026-68969 | Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext | 6.5 | — | 2026-08-12 | |
| CVE-2026-48726 | Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path | 6.5 | — | 2026-06-01 | |
| CVE-2026-42358 | Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets | 6.5 | — | 2026-06-01 | |
| CVE-2026-68971 | Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints | 6.5 | — | 2026-08-12 | |
| CVE-2026-59244 | Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI | 6.5 | — | 2026-08-12 | |
| CVE-2026-68970 | Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI | 6.5 | — | 2026-08-12 | |
| CVE-2026-49267 | Apache Airflow: No certificate validation on SMTP STARTTLS connections | 5.9 | — | 2026-06-01 | |
| CVE-2026-68076 | Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection | 5.4 | — | 2026-08-12 | |
| CVE-2026-59242 | Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint | 5.4 | — | 2026-08-12 | |
| CVE-2026-48891 | Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.sour... | 4.3 | — | 2026-07-07 | |
| CVE-2026-75158 | Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter | 4.3 | — | 2026-09-21 | |
| CVE-2026-38743 | Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities | 4.3 | — | 2026-04-24 | |
| CVE-2026-46764 | Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter | 4.3 | — | 2026-06-01 | |
| CVE-2026-54183 | Apache Airflow: Airflow Variables were not masked in the UI for authenticated users | 4.3 | — | 2026-08-12 | |
| CVE-2026-40690 | Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated topologies and all DA... | 4.3 | — | 2026-04-24 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).