Corrigé dans
CVE affectant 3.3
| CVE | Titre | CVSS | Exploitée | EPSS | Publication |
|---|---|---|---|---|---|
| CVE-2026-58076 | Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerializati... | 8.8 | — | 2026-08-12 | |
| CVE-2026-68968 | Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill i... | 7.5 | — | 2026-08-12 | |
| CVE-2026-68969 | Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext | 6.5 | — | 2026-08-12 | |
| CVE-2026-68971 | Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints | 6.5 | — | 2026-08-12 | |
| CVE-2026-59244 | Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI | 6.5 | — | 2026-08-12 | |
| CVE-2026-68970 | Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI | 6.5 | — | 2026-08-12 | |
| CVE-2026-68076 | Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection | 5.4 | — | 2026-08-12 | |
| CVE-2026-59242 | Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint | 5.4 | — | 2026-08-12 | |
| CVE-2026-75158 | Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter | 4.3 | — | 2026-09-21 | |
| CVE-2026-54183 | Apache Airflow: Airflow Variables were not masked in the UI for authenticated users | 4.3 | — | 2026-08-12 | |
| CVE-2026-82355 | Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixat... | 4.2 | — | 2026-09-21 |
Suivez ces versions sur vos propres serveurs
InfraGuard collecte les versions logicielles installées sur chaque serveur et signale celles qui présentent des vulnérabilités connues. Auto-hébergé : rien ne quitte votre réseau.
Données : CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (voir EPSS sur https://www.first.org/epss), endoflife.date. Liste des logiciels : awesome-selfhosted (CC BY-SA 3.0).