Corregido en
CVE que afectan a 2.4
| CVE | Título | CVSS | Explotada | EPSS | Publicación |
|---|---|---|---|---|---|
| CVE-2026-33264 | Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize(... | 9.8 | — | 2026-07-07 | |
| CVE-2026-30898 | Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf | 8.8 | — | 2026-04-18 | |
| CVE-2026-49298 | Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments | 8.8 | — | 2026-06-01 | |
| CVE-2025-54550 | Apache Airflow: RCE by race condition in example_xcom dag | 8.1 | — | 2026-04-15 | |
| CVE-2022-41672 | Session still functional after user is deactivated | 8.1 | — | 2022-10-07 | |
| CVE-2023-40273 | Session fixation in Apache Airflow web interface | 8.0 | — | 2023-08-23 | |
| CVE-2026-30912 | Apache Airflow: Exposing stack trace in case of constraint error | 7.5 | — | 2026-04-18 | |
| CVE-2026-68968 | Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill i... | 7.5 | — | 2026-08-12 | |
| CVE-2025-68675 | Apache Airflow: proxy credentials for various providers might leak in task logs | 7.5 | — | 2026-01-16 | |
| CVE-2026-45360 | Apache Airflow: Arbitrary import in custom deadline-reference deserialization | 7.3 | — | 2026-06-01 | |
| CVE-2026-25917 | Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5) | 7.2 | — | 2026-04-18 | |
| CVE-2026-40861 | Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler | 6.5 | — | 2026-06-01 | |
| CVE-2026-42360 | Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking | 6.5 | — | 2026-06-01 | |
| CVE-2026-25219 | Apache Airflow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users... | 6.5 | — | 2026-04-15 | |
| CVE-2026-48892 | Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options | 6.5 | — | 2026-07-07 | |
| CVE-2026-49487 | Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs | 6.5 | — | 2026-07-07 | |
| CVE-2026-48828 | Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key | 6.5 | — | 2026-07-07 | |
| CVE-2026-49296 | Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id} | 6.5 | — | 2026-07-07 | |
| CVE-2026-45192 | Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response | 6.5 | — | 2026-06-01 | |
| CVE-2026-68969 | Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext | 6.5 | — | 2026-08-12 | |
| CVE-2026-48726 | Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path | 6.5 | — | 2026-06-01 | |
| CVE-2026-42358 | Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets | 6.5 | — | 2026-06-01 | |
| CVE-2026-68971 | Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints | 6.5 | — | 2026-08-12 | |
| CVE-2026-59244 | Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI | 6.5 | — | 2026-08-12 | |
| CVE-2026-68970 | Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI | 6.5 | — | 2026-08-12 | |
| CVE-2022-45402 | Apache Airflow: Open redirect during login | 6.1 | — | 2022-11-15 | |
| CVE-2022-43982 | Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL | 6.1 | — | 2022-11-02 | |
| CVE-2022-43985 | Apache Airflow prior to 2.4.2 has an open redirect | 6.1 | — | 2022-11-02 | |
| CVE-2026-41016 | Apache Airflow Providers SMTP: No certificate validation on SMTP STARTTLS connections in SMTP provider | 5.9 | — | 2026-04-30 | |
| CVE-2026-49267 | Apache Airflow: No certificate validation on SMTP STARTTLS connections | 5.9 | — | 2026-06-01 | |
| CVE-2026-68076 | Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection | 5.4 | — | 2026-08-12 | |
| CVE-2026-59242 | Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint | 5.4 | — | 2026-08-12 | |
| CVE-2026-48891 | Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.sour... | 4.3 | — | 2026-07-07 | |
| CVE-2026-75158 | Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter | 4.3 | — | 2026-09-21 | |
| CVE-2026-38743 | Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities | 4.3 | — | 2026-04-24 | |
| CVE-2026-46764 | Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter | 4.3 | — | 2026-06-01 | |
| CVE-2023-40611 | Apache Airflow Dag Runs Broken Access Control Vulnerability | 4.3 | — | 2023-09-12 | |
| CVE-2026-54183 | Apache Airflow: Airflow Variables were not masked in the UI for authenticated users | 4.3 | — | 2026-08-12 | |
| CVE-2026-40690 | Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated topologies and all DA... | 4.3 | — | 2026-04-24 |
Controla estas versiones en tus propios servidores
InfraGuard recopila las versiones de software instaladas en cada servidor y señala las que tienen vulnerabilidades conocidas. Autoalojado: nada sale de tu red.
Datos: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (consulta EPSS en https://www.first.org/epss), endoflife.date. Lista de software: awesome-selfhosted (CC BY-SA 3.0).