CVE que afectan a 1.8
| CVE | Título | CVSS | Explotada | EPSS | Publicación |
|---|---|---|---|---|---|
| CVE-2020-13927 | The previous default setting for Airflow's Experimental API was to allow all API requests without authenticati... | 9.8 | KEV | 99.8% | 2020-11-10 |
| CVE-2020-11978 | An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability... | 8.8 | KEV | 99.2% | 2020-07-17 |
| CVE-2020-11982 | An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can c... | 9.8 | — | 2020-07-17 | |
| CVE-2026-33264 | Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize(... | 9.8 | — | 2026-07-07 | |
| CVE-2020-11981 | An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can... | 9.8 | — | 2020-07-17 | |
| CVE-2022-40189 | Apache Airlfow Pig Provider RCE | 9.8 | — | 2022-11-22 | |
| CVE-2017-17836 | In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well... | 9.8 | — | 2019-01-23 | |
| CVE-2022-38649 | Apache Airflow Pinot provider allowed Command Injection | 9.8 | — | 2022-11-22 | |
| CVE-2022-40127 | Apache Airflow <2.4.0 has an RCE in a bash example | 8.8 | — | 2022-11-14 | |
| CVE-2017-15720 | In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver... | 8.8 | — | 2019-01-23 | |
| CVE-2026-30898 | Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf | 8.8 | — | 2026-04-18 | |
| CVE-2026-49298 | Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments | 8.8 | — | 2026-06-01 | |
| CVE-2022-24288 | Apache Airflow: RCE in example DAGs | 8.8 | — | 2022-02-25 | |
| CVE-2019-0229 | A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection a... | 8.8 | — | 2019-04-10 | |
| CVE-2017-17835 | In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default... | 8.8 | — | 2019-01-23 | |
| CVE-2025-54550 | Apache Airflow: RCE by race condition in example_xcom dag | 8.1 | — | 2026-04-15 | |
| CVE-2022-41672 | Session still functional after user is deactivated | 8.1 | — | 2022-10-07 | |
| CVE-2023-40273 | Session fixation in Apache Airflow web interface | 8.0 | — | 2023-08-23 | |
| CVE-2022-41131 | Apache Airflow Hive Provider vulnerability (command injection via hive_cli connection) | 7.8 | — | 2022-11-22 | |
| CVE-2020-17526 | Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows... | 7.7 | — | 2020-12-21 | |
| CVE-2026-30912 | Apache Airflow: Exposing stack trace in case of constraint error | 7.5 | — | 2026-04-18 | |
| CVE-2018-20245 | The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigur... | 7.5 | — | 2019-01-23 | |
| CVE-2022-27949 | Apache Airflow prior to 2.3.1 may include sensitive values in rendered template | 7.5 | — | 2022-11-14 | |
| CVE-2026-68968 | Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill i... | 7.5 | — | 2026-08-12 | |
| CVE-2025-68675 | Apache Airflow: proxy credentials for various providers might leak in task logs | 7.5 | — | 2026-01-16 | |
| CVE-2026-45360 | Apache Airflow: Arbitrary import in custom deadline-reference deserialization | 7.3 | — | 2026-06-01 | |
| CVE-2026-25917 | Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5) | 7.2 | — | 2026-04-18 | |
| CVE-2026-40861 | Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler | 6.5 | — | 2026-06-01 | |
| CVE-2026-42360 | Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking | 6.5 | — | 2026-06-01 | |
| CVE-2026-25219 | Apache Airflow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users... | 6.5 | — | 2026-04-15 | |
| CVE-2026-48892 | Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options | 6.5 | — | 2026-07-07 | |
| CVE-2026-49487 | Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs | 6.5 | — | 2026-07-07 | |
| CVE-2026-48828 | Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key | 6.5 | — | 2026-07-07 | |
| CVE-2026-49296 | Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id} | 6.5 | — | 2026-07-07 | |
| CVE-2026-45192 | Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response | 6.5 | — | 2026-06-01 | |
| CVE-2026-68969 | Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext | 6.5 | — | 2026-08-12 | |
| CVE-2026-48726 | Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path | 6.5 | — | 2026-06-01 | |
| CVE-2026-42358 | Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets | 6.5 | — | 2026-06-01 | |
| CVE-2026-68971 | Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints | 6.5 | — | 2026-08-12 | |
| CVE-2026-59244 | Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI | 6.5 | — | 2026-08-12 | |
| CVE-2026-68970 | Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI | 6.5 | — | 2026-08-12 | |
| CVE-2020-17511 | In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plai... | 6.5 | — | 2020-12-14 | |
| CVE-2020-17515 | The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This iss... | 6.1 | — | 2020-12-11 | |
| CVE-2022-45402 | Apache Airflow: Open redirect during login | 6.1 | — | 2022-11-15 | |
| CVE-2022-43982 | Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL | 6.1 | — | 2022-11-02 | |
| CVE-2021-45229 | Apache Airflow: Reflected XSS via Origin Query Argument in URL | 6.1 | — | 2022-02-25 | |
| CVE-2022-43985 | Apache Airflow prior to 2.4.2 has an open redirect | 6.1 | — | 2022-11-02 | |
| CVE-2021-28359 | Apache Airflow Reflected XSS via Origin Query Argument in URL | 6.1 | — | 2021-05-02 | |
| CVE-2017-12614 | It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detec... | 6.1 | — | 2018-08-06 | |
| CVE-2020-9485 | An issue was found in Apache Airflow versions 1.10.10 and below. A stored XSS vulnerability was discovered in... | 6.1 | — | 2020-07-17 | |
| CVE-2020-13944 | In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulner... | 6.1 | — | 2020-09-17 | |
| CVE-2018-20244 | In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadat... | 5.5 | — | 2019-02-27 | |
| CVE-2022-40954 | Apache Airflow Spark Provider RCE that bypass restrictions to read arbitrary files | 5.5 | — | 2022-11-22 | |
| CVE-2026-68076 | Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection | 5.4 | — | 2026-08-12 | |
| CVE-2020-11983 | An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the admin mana... | 5.4 | — | 2020-07-17 | |
| CVE-2026-59242 | Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint | 5.4 | — | 2026-08-12 | |
| CVE-2021-35936 | No Authentication on Logging Server | 5.3 | — | 2021-08-16 | |
| CVE-2020-17513 | In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were... | 5.3 | — | 2020-12-14 | |
| CVE-2019-12398 | In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the stat... | 4.8 | — | 2020-01-14 | |
| CVE-2019-12417 | A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary j... | 4.8 | — | 2019-10-30 | |
| CVE-2019-0216 | A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary j... | 4.8 | — | 2019-04-10 | |
| CVE-2022-38170 | Overly permissive umask for daemons | 4.7 | — | 2022-09-02 | |
| CVE-2026-48891 | Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.sour... | 4.3 | — | 2026-07-07 | |
| CVE-2026-75158 | Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter | 4.3 | — | 2026-09-21 | |
| CVE-2026-38743 | Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities | 4.3 | — | 2026-04-24 | |
| CVE-2026-46764 | Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter | 4.3 | — | 2026-06-01 | |
| CVE-2023-40611 | Apache Airflow Dag Runs Broken Access Control Vulnerability | 4.3 | — | 2023-09-12 | |
| CVE-2026-54183 | Apache Airflow: Airflow Variables were not masked in the UI for authenticated users | 4.3 | — | 2026-08-12 | |
| CVE-2026-40690 | Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated topologies and all DA... | 4.3 | — | 2026-04-24 |
Controla estas versiones en tus propios servidores
InfraGuard recopila las versiones de software instaladas en cada servidor y señala las que tienen vulnerabilidades conocidas. Autoalojado: nada sale de tu red.
Datos: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (consulta EPSS en https://www.first.org/epss), endoflife.date. Lista de software: awesome-selfhosted (CC BY-SA 3.0).