Branches de versions concernées
Vulnérabilités connues
| CVE | Titre | Versions concernées | CVSS | Exploitée | EPSS | Publication |
|---|---|---|---|---|---|---|
| CVE-2020-13927 | The previous default setting for Airflow's Experimental API was to allow all API requests without authenticati... | < 1.10.11 | 9.8 | KEV | 99.8% | 2020-11-10 |
| CVE-2020-11978 | An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability... | < 1.10.11 | 8.8 | KEV | 99.2% | 2020-07-17 |
| CVE-2026-76185 | Apache Airflow Task SDK: SecretCache: non-injective team cache key enables cross-team secret disclosure in mul... | * | 6.5 | — | 2026-11-09 | |
| CVE-2026-111422 | Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote ho... | * | 8.8 | — | 2026-10-27 | |
| CVE-2026-86467 | Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account | * | 8.8 | — | 2026-10-20 | |
| CVE-2026-94135 | Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default | * | 4.3 | — | 2026-10-16 | |
| CVE-2026-96806 | Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddlewar... | * | 5.8 | — | 2026-10-16 | |
| CVE-2026-94134 | Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default | * | 9.1 | — | 2026-10-16 | |
| CVE-2026-92228 | Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log rea... | * | 6.5 | — | 2026-10-16 | |
| CVE-2026-86843 | Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag | * | 6.3 | — | 2026-09-29 | |
| CVE-2026-81930 | Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain | * | 6.3 | — | 2026-09-29 | |
| CVE-2026-81862 | Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, tas... | * | 6.5 | — | 2026-09-29 | |
| CVE-2026-81914 | Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names | * | 4.3 | — | 2026-09-29 | |
| CVE-2026-97636 | Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlle... | * | 6.5 | — | 2026-09-25 | |
| CVE-2026-82355 | Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixat... | = 3.3.0 = 3.3.1 | 4.2 | — | 2026-09-21 | |
| CVE-2026-75158 | Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter | < 3.3.2 | 4.3 | — | 2026-09-21 | |
| CVE-2026-86466 | Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated | * | 8.1 | — | 2026-09-16 | |
| CVE-2026-76187 | Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT | * | 9.8 | — | 2026-09-16 | |
| CVE-2026-76186 | Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity | * | 9.1 | — | 2026-09-16 | |
| CVE-2026-82310 | Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access | * | 7.2 | — | 2026-09-16 | |
| CVE-2026-86792 | Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka conne... | * | 8.8 | — | 2026-09-16 | |
| CVE-2026-86462 | Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions | * | 9.1 | — | 2026-09-16 | |
| CVE-2026-82311 | Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is... | * | 9.8 | — | 2026-09-16 | |
| CVE-2026-86465 | Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key | * | 6.5 | — | 2026-09-16 | |
| CVE-2026-75156 | Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authent... | * | 9.1 | — | 2026-09-09 | |
| CVE-2026-68868 | Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every tea... | * | 6.5 | — | 2026-08-12 | |
| CVE-2026-68968 | Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill i... | < 3.3.1 | 7.5 | — | 2026-08-12 | |
| CVE-2026-68969 | Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext | < 3.3.1 | 6.5 | — | 2026-08-12 | |
| CVE-2026-68970 | Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI | < 3.3.1 | 6.5 | — | 2026-08-12 | |
| CVE-2026-68971 | Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints | < 3.3.1 | 6.5 | — | 2026-08-12 | |
| CVE-2026-68076 | Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection | < 3.3.1 | 5.4 | — | 2026-08-12 | |
| CVE-2026-59242 | Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint | < 3.3.1 | 5.4 | — | 2026-08-12 | |
| CVE-2026-59244 | Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI | < 3.3.1 | 6.5 | — | 2026-08-12 | |
| CVE-2026-58076 | Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerializati... | ≥ 3.3.0 < 3.3.1 | 8.8 | — | 2026-08-12 | |
| CVE-2026-54183 | Apache Airflow: Airflow Variables were not masked in the UI for authenticated users | < 3.3.1 | 4.3 | — | 2026-08-12 | |
| CVE-2026-68872 | Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves anothe... | * | 6.5 | — | 2026-08-11 | |
| CVE-2026-68871 | Apache Airflow Yandex provider: yandex Lockbox backend: team-scope guard bypass resolves another team's Connec... | * | 6.5 | — | 2026-08-11 | |
| CVE-2026-68870 | Apache Airflow Microsoft Azure provider: microsoft.azure Key Vault backend: team-scope guard bypass resolves a... | * | 5.3 | — | 2026-08-11 | |
| CVE-2026-59243 | Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAu... | * | 9.8 | — | 2026-07-29 | |
| CVE-2026-59245 | Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (acce... | * | 8.1 | — | 2026-07-14 | |
| CVE-2026-58065 | Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key ve... | * | 8.1 | — | 2026-07-14 | |
| CVE-2026-48828 | Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key | < 3.3.0 | 6.5 | — | 2026-07-07 | |
| CVE-2026-48891 | Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.sour... | < 3.3.0 | 4.3 | — | 2026-07-07 | |
| CVE-2026-48892 | Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options | < 3.3.0 | 6.5 | — | 2026-07-07 | |
| CVE-2026-49296 | Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id} | < 3.3.0 | 6.5 | — | 2026-07-07 | |
| CVE-2026-49487 | Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs | < 3.3.0 | 6.5 | — | 2026-07-07 | |
| CVE-2026-33264 | Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize(... | < 3.3.0 | 9.8 | — | 2026-07-07 | |
| CVE-2026-49297 | Apache Airflow Google provider: Path traversal via GCS object names → local/SFTP filesystem (GCSToSFTPOperator... | * | 8.1 | — | 2026-07-06 | |
| CVE-2026-49486 | Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P) | * | 7.5 | — | 2026-06-26 | |
| CVE-2026-50203 | Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory allows local file write outside th... | * | 9.1 | — | 2026-06-17 | |
| CVE-2026-49818 | Apache Airflow Samba provider: Path traversal in GCSToSambaOperator via GCS object names | * | 6.5 | — | 2026-06-09 | |
| CVE-2026-46764 | Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter | < 3.2.2 | 4.3 | — | 2026-06-01 | |
| CVE-2026-48726 | Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path | < 3.2.2 | 6.5 | — | 2026-06-01 | |
| CVE-2026-49267 | Apache Airflow: No certificate validation on SMTP STARTTLS connections | ≥ 2.0.0 < 3.2.2 | 5.9 | — | 2026-06-01 | |
| CVE-2026-49298 | Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments | < 3.2.2 | 8.8 | — | 2026-06-01 | |
| CVE-2026-42360 | Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking | < 3.2.2 | 6.5 | — | 2026-06-01 | |
| CVE-2026-45360 | Apache Airflow: Arbitrary import in custom deadline-reference deserialization | < 3.2.2 | 7.3 | — | 2026-06-01 | |
| CVE-2026-42358 | Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets | < 3.2.2 | 6.5 | — | 2026-06-01 | |
| CVE-2026-40861 | Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler | < 3.2.2 | 6.5 | — | 2026-06-01 | |
| CVE-2026-45192 | Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response | < 3.2.2 | 6.5 | — | 2026-06-01 |
Suivez ces versions sur vos propres serveurs
InfraGuard collecte les versions logicielles installées sur chaque serveur et signale celles qui présentent des vulnérabilités connues. Auto-hébergé : rien ne quitte votre réseau.
Données : CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (voir EPSS sur https://www.first.org/epss), endoflife.date. Liste des logiciels : awesome-selfhosted (CC BY-SA 3.0).