# apache-airflow-core (PyPI) vulnerabilities

66 known vulnerabilities (4 critical, 22 high, 37 medium, 3 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 3.4.0 (Nov 6, 2026): no advisory affects it
- Newest unaffected release: 3.4.0 (Nov 6, 2026), the latest release
- Weekly downloads: 649.3K
- Dependents: 475
- Releases: 86 since 3.0.0 (Apr 22, 2025)
- Registry: https://pypi.org/project/apache-airflow-core/
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-86473: 3.0.0 to 3.3.2rc1 (3.3.2 is outside it)
- CVE-2026-75158: 3.0.0 to 3.3.2rc1 (3.3.2 is outside it)
- CVE-2026-82355: 3.3.0 to 3.3.2rc1 (3.3.2 is outside it)
- CVE-2026-75157: 3.0.0 to 3.3.2rc1 (3.3.2 is outside it)
- CVE-2026-59244: 3.0.0 to 3.3.1rc2 (3.3.1 is outside it)
- CVE-2026-58076: 3.0.0 to 3.3.1rc2 (3.3.1 is outside it)
- CVE-2026-59242: 3.0.0 to 3.3.1rc2 (3.3.1 is outside it)
- CVE-2026-54183: 3.0.0 to 3.3.1rc2 (3.3.1 is outside it)
- CVE-2026-67260: 3.3.0 to 3.3.1rc2 (3.3.1 is outside it)
- CVE-2026-67587: 3.3.0 to 3.3.1rc2 (3.3.1 is outside it)
- CVE-2026-65017: 3.3.0 to 3.3.1rc2 (3.3.1 is outside it)
- CVE-2026-68968: 3.0.0 to 3.3.1rc2 (3.3.1 is outside it)
- CVE-2026-68969: 3.0.0 to 3.3.1rc2 (3.3.1 is outside it)
- CVE-2026-68970: 3.0.0 to 3.3.1rc2 (3.3.1 is outside it)
- CVE-2026-68971: 3.0.0 to 3.3.1rc2 (3.3.1 is outside it)
- CVE-2026-68076: 3.0.0 to 3.3.1rc2 (3.3.1 is outside it)
- CVE-2026-33264: 3.0.0 to 3.3.0rc2 (3.3.0 is outside it)
- CVE-2026-49487: 3.0.0 to 3.3.0rc2 (3.3.0 is outside it)
- CVE-2026-48828: 3.0.0 to 3.3.0rc2 (3.3.0 is outside it)
- CVE-2026-49296: 3.0.0 to 3.3.0rc2 (3.3.0 is outside it)
- CVE-2026-48891: 3.0.0 to 3.3.0rc2 (3.3.0 is outside it)
- CVE-2026-48892: 3.0.0 to 3.3.0rc2 (3.3.0 is outside it)
- CVE-2026-40861: 3.0.0 to 3.2.2rc3 (3.2.2 is outside it)
- CVE-2026-40961: 3.0.0 to 3.2.2rc3 (3.2.2 is outside it)
- CVE-2026-40963: 3.0.0 to 3.2.2rc3 (3.2.2 is outside it)
- CVE-2026-41014: 3.2.0 to 3.2.2rc3 (3.2.2 is outside it)
- CVE-2026-49267: 3.0.0 to 3.2.2rc3 (3.2.2 is outside it)
- CVE-2026-41017: 3.0.0 to 3.2.2rc3 (3.2.2 is outside it)
- CVE-2026-41084: 3.2.0 to 3.2.2rc3 (3.2.2 is outside it)
- CVE-2026-42252: 3.0.0 to 3.2.2rc3 (3.2.2 is outside it)
- CVE-2026-42360: 3.0.0 to 3.2.2rc3 (3.2.2 is outside it)
- CVE-2026-42358: 3.0.0 to 3.2.2rc3 (3.2.2 is outside it)
- CVE-2026-42359: 3.2.0 to 3.2.2rc3 (3.2.2 is outside it)
- CVE-2026-45360: 3.0.0 to 3.2.2rc3 (3.2.2 is outside it)
- CVE-2026-45426: 3.0.0 to 3.2.2rc3 (3.2.2 is outside it)
- CVE-2026-46764: 3.0.0 to 3.2.2rc3 (3.2.2 is outside it)
- CVE-2026-48726: 3.0.0 to 3.2.2rc3 (3.2.2 is outside it)
- CVE-2026-49298: 3.0.0rc1 to 3.2.2rc3 (3.2.2 is outside it)
- CVE-2026-45192: 3.0.0 to 3.2.2rc3 (3.2.2 is outside it)
- CVE-2026-38743: 3.0.0 to 3.2.1rc3 (3.2.1 is outside it)
- CVE-2026-40690: 3.0.0 to 3.2.1rc3 (3.2.1 is outside it)
- CVE-2026-32690: 3.0.0 to 3.2.0rc2 (3.2.0 is outside it)
- CVE-2026-30898: 3.0.0 to 3.2.0rc2 (3.2.0 is outside it)
- CVE-2026-30912: 3.0.0rc1 to 3.2.0rc2 (3.2.0 is outside it)
- CVE-2026-25917: 3.0.0rc1 to 3.2.0rc2 (3.2.0 is outside it)
- CVE-2026-32228: 3.0.0 to 3.2.0rc2 (3.2.0 is outside it)
- CVE-2026-31987: 3.0.0 to 3.2.0rc2 (3.2.0 is outside it)
- CVE-2026-25219: 3.0.0 to 3.1.8rc2 (3.1.8 is outside it)
- CVE-2025-54550: 3.0.0 to 3.2.0rc2 (3.2.0 is outside it)
- CVE-2026-33858: 3.1.8 to 3.2.0rc2 (3.2.0 is outside it)
- CVE-2025-66236: 3.0.0 to 3.2.0rc2 (3.2.0 is outside it)
- CVE-2025-57735: 3.0.0 to 3.2.0rc2 (3.2.0 is outside it)
- CVE-2026-34538: 3.0.0 to 3.2.0rc2 (3.2.0 is outside it)
- CVE-2026-28563: 3.0.0 to 3.1.8rc2 (3.1.8 is outside it)
- CVE-2026-26929: 3.0.0 to 3.1.8rc2 (3.1.8 is outside it)
- CVE-2026-30911: 3.1.0 to 3.1.8rc2 (3.1.8 is outside it)
- CVE-2026-28779: 3.0.0 to 3.1.8rc2 (3.1.8 is outside it)
- CVE-2025-65995: 3.0.0 to 3.1.4rc2 (3.1.4 is outside it)
- CVE-2026-22922: 3.1.0 to 3.1.7rc2 (3.1.7 is outside it)
- CVE-2026-24098: 3.0.0 to 3.1.7rc2 (3.1.7 is outside it)
- CVE-2025-68675: 3.0.0 to 3.1.6rc1 (3.1.6 is outside it)
- CVE-2025-68438: 3.1.0 to 3.1.6rc1 (3.1.6 is outside it)
- CVE-2025-66388: 3.1.0 to 3.1.4rc2 (3.1.4 is outside it)
- CVE-2025-54941: 3.0.0 to 3.0.5rc3 (3.0.5 is outside it)
- CVE-2025-62402: 3.0.0 to 3.1.1rc2 (3.1.1 is outside it)
- CVE-2025-54831: 3.0.3 (3.0.4rc1 is outside it)

## Advisories (66)

### [CVE-2026-86473](https://cve.now/CVE-2026-86473): Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

- Severity: Critical 9.1
- Published: Sep 21, 2026
- Affected: from 3.0.0, fixed in 3.3.2.
- Fixed in 3.3.2 (released Sep 17, 2026, 4 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-75158](https://cve.now/CVE-2026-75158): Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter

- Severity: Medium 4.3
- Published: Sep 21, 2026
- Affected: from 3.0.0, fixed in 3.3.2.
- Fixed in 3.3.2 (released Sep 17, 2026, 4 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-82355](https://cve.now/CVE-2026-82355): Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

- Severity: Medium 4.2
- Published: Sep 21, 2026
- Affected: from 3.3.0, fixed in 3.3.2.
- Fixed in 3.3.2 (released Sep 17, 2026, 4 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-75157](https://cve.now/CVE-2026-75157): Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

- Severity: High 7.5
- Published: Sep 18, 2026
- Affected: from 3.0.0, fixed in 3.3.2.
- Fixed in 3.3.2 (released Sep 17, 2026, 1 day before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-59244](https://cve.now/CVE-2026-59244): Apache Airflow: Secrets masker: \`var.json\` Variable values not masked in the Rendered Templates UI

- Severity: Medium 6.5
- Published: Aug 12, 2026
- Affected: from 3.0.0, fixed in 3.3.1.
- Fixed in 3.3.1 (released Aug 12, 2026, the day of disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-58076](https://cve.now/CVE-2026-58076): Apache Airflow: Unguarded import\_string() of airflow\_exc\_ser / base\_exc\_ser exception nodes in BaseSerialization.deserialize enables…

- Severity: High 8.8
- Published: Aug 12, 2026
- Affected: from 3.0.0, fixed in 3.3.1.
- Fixed in 3.3.1 (released Aug 12, 2026, the day of disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-59242](https://cve.now/CVE-2026-59242): Apache Airflow: Arbitrary airflow. class instantiation on the API server via the XCom deserialize endpoint

- Severity: Medium 5.4
- Published: Aug 12, 2026
- Affected: from 3.0.0, fixed in 3.3.1.
- Fixed in 3.3.1 (released Aug 12, 2026, the day of disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-54183](https://cve.now/CVE-2026-54183): Apache Airflow: Airflow Variables were not masked in the UI for authenticated users

- Severity: Medium 4.3
- Published: Aug 12, 2026
- Affected: from 3.0.0, fixed in 3.3.1.
- Fixed in 3.3.1 (released Aug 12, 2026, the day of disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-67260](https://cve.now/CVE-2026-67260): Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting\_input next\_kwargs deserialization

- Severity: High 7.3
- Published: Aug 12, 2026
- Affected: from 3.3.0, fixed in 3.3.1.
- Fixed in 3.3.1 (released Aug 12, 2026, the day of disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-67587](https://cve.now/CVE-2026-67587): Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde \`Callback\` deserialization gadget

- Severity: High 8.8
- Published: Aug 12, 2026
- Affected: from 3.3.0, fixed in 3.3.1.
- Fixed in 3.3.1 (released Aug 12, 2026, the day of disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-65017](https://cve.now/CVE-2026-65017): Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)

- Severity: Medium 6.5
- Published: Aug 12, 2026
- Affected: from 3.3.0, fixed in 3.3.1.
- Fixed in 3.3.1 (released Aug 12, 2026, the day of disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-68968](https://cve.now/CVE-2026-68968): Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

- Severity: High 7.5
- Published: Aug 12, 2026
- Affected: from 3.0.0, fixed in 3.3.1.
- Fixed in 3.3.1 (released Aug 12, 2026, the day of disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-68969](https://cve.now/CVE-2026-68969): Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext

- Severity: Medium 6.5
- Published: Aug 12, 2026
- Affected: from 3.0.0, fixed in 3.3.1.
- Fixed in 3.3.1 (released Aug 12, 2026, the day of disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-68970](https://cve.now/CVE-2026-68970): Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI

- Severity: Medium 6.5
- Published: Aug 12, 2026
- Affected: from 3.0.0, fixed in 3.3.1.
- Fixed in 3.3.1 (released Aug 12, 2026, the day of disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-68971](https://cve.now/CVE-2026-68971): Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints

- Severity: Medium 6.5
- Published: Aug 12, 2026
- Affected: from 3.0.0, fixed in 3.3.1.
- Fixed in 3.3.1 (released Aug 12, 2026, the day of disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-68076](https://cve.now/CVE-2026-68076): Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection

- Severity: Medium 5.4
- Published: Aug 12, 2026
- Affected: from 3.0.0, fixed in 3.3.1.
- Fixed in 3.3.1 (released Aug 12, 2026, the day of disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-33264](https://cve.now/CVE-2026-33264): Apache Airflow: DAG author RCE on webserver via unrestricted import\_string() in BaseSerialization.deserialize()

- Severity: Critical 9.8
- Published: Jul 7, 2026
- Affected: from 3.0.0, fixed in 3.3.0.
- Fixed in 3.3.0 (released Jul 6, 2026, 1 day before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-49487](https://cve.now/CVE-2026-49487): Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs

- Severity: Medium 6.5
- Published: Jul 7, 2026
- Affected: from 3.0.0, fixed in 3.3.0.
- Fixed in 3.3.0 (released Jul 6, 2026, 1 day before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-48828](https://cve.now/CVE-2026-48828): Apache Airflow: Bulk JSON Variables bypass should\_hide\_value\_for\_key - redact() called without the key

- Severity: Medium 6.5
- Published: Jul 7, 2026
- Affected: from 3.0.0, fixed in 3.3.0.
- Fixed in 3.3.0 (released Jul 6, 2026, 1 day before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-49296](https://cve.now/CVE-2026-49296): Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag\_id}

- Severity: Medium 6.5
- Published: Jul 7, 2026
- Affected: from 3.0.0, fixed in 3.3.0.
- Fixed in 3.3.0 (released Jul 6, 2026, 1 day before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-48891](https://cve.now/CVE-2026-48891): Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target

- Severity: Medium 4.3
- Published: Jul 7, 2026
- Affected: from 3.0.0, fixed in 3.3.0.
- Fixed in 3.3.0 (released Jul 6, 2026, 1 day before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-48892](https://cve.now/CVE-2026-48892): Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options

- Severity: Medium 6.5
- Published: Jul 7, 2026
- Affected: from 3.0.0, fixed in 3.3.0.
- Fixed in 3.3.0 (released Jul 6, 2026, 1 day before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-40861](https://cve.now/CVE-2026-40861): Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler

- Severity: Medium 6.5
- Published: Jun 1, 2026
- Affected: from 3.0.0, fixed in 3.2.2.
- Fixed in 3.2.2 (released May 29, 2026, 3 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-40961](https://cve.now/CVE-2026-40961): Apache Airflow: Open Redirect Bypass Vulnerability

- Severity: High 7.2
- Published: Jun 1, 2026
- Affected: from 3.0.0, fixed in 3.2.2.
- Fixed in 3.2.2 (released May 29, 2026, 3 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-40963](https://cve.now/CVE-2026-40963): Apache Airflow: DAG authorization bypass on /ui/structure/structure\_data

- Severity: Low 3.1
- Published: Jun 1, 2026
- Affected: from 3.0.0, fixed in 3.2.2.
- Fixed in 3.2.2 (released May 29, 2026, 3 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-41014](https://cve.now/CVE-2026-41014): Apache Airflow: per-DAG RBAC bypass on /ui/partitioned\_dag\_runs endpoints

- Severity: Medium 4.3
- Published: Jun 1, 2026
- Affected: from 3.2.0, fixed in 3.2.2.
- Fixed in 3.2.2 (released May 29, 2026, 3 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-49267](https://cve.now/CVE-2026-49267): Apache Airflow: No certificate validation on SMTP STARTTLS connections

- Severity: Medium 5.9
- Published: Jun 1, 2026
- Affected: from 3.0.0, fixed in 3.2.2.
- Fixed in 3.2.2 (released May 29, 2026, 3 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-41017](https://cve.now/CVE-2026-41017): Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy

- Severity: Medium 5.9
- Published: Jun 1, 2026
- Affected: from 3.0.0, fixed in 3.2.2.
- Fixed in 3.2.2 (released May 29, 2026, 3 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-41084](https://cve.now/CVE-2026-41084): Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation

- Severity: High 7.5
- Published: Jun 1, 2026
- Affected: from 3.2.0, fixed in 3.2.2.
- Fixed in 3.2.2 (released May 29, 2026, 3 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-42252](https://cve.now/CVE-2026-42252): Apache Airflow: BashOperator Jinja2 injection via dag\_run.conf — low-privilege user pattern

- Severity: Critical 9.1
- Published: Jun 1, 2026
- Affected: from 3.0.0, fixed in 3.2.2.
- Fixed in 3.2.2 (released May 29, 2026, 3 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-42360](https://cve.now/CVE-2026-42360): Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking

- Severity: Medium 6.5
- Published: Jun 1, 2026
- Affected: from 3.0.0, fixed in 3.2.2.
- Fixed in 3.2.2 (released May 29, 2026, 3 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-42358](https://cve.now/CVE-2026-42358): Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets

- Severity: Medium 6.5
- Published: Jun 1, 2026
- Affected: from 3.0.0, fixed in 3.2.2.
- Fixed in 3.2.2 (released May 29, 2026, 3 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-42359](https://cve.now/CVE-2026-42359): Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN\_XCOM\_KEYS validator

- Severity: High 8.8
- Published: Jun 1, 2026
- Affected: from 3.2.0, fixed in 3.2.2.
- Fixed in 3.2.2 (released May 29, 2026, 3 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-45360](https://cve.now/CVE-2026-45360): Apache Airflow: Arbitrary import in custom deadline-reference deserialization

- Severity: High 7.3
- Published: Jun 1, 2026
- Affected: from 3.0.0, fixed in 3.2.2.
- Fixed in 3.2.2 (released May 29, 2026, 3 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-45426](https://cve.now/CVE-2026-45426): Apache Airflow: Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access

- Severity: Low 3.1
- Published: Jun 1, 2026
- Affected: from 3.0.0, fixed in 3.2.2.
- Fixed in 3.2.2 (released May 29, 2026, 3 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-46764](https://cve.now/CVE-2026-46764): Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter

- Severity: Medium 4.3
- Published: Jun 1, 2026
- Affected: from 3.0.0, fixed in 3.2.2.
- Fixed in 3.2.2 (released May 29, 2026, 3 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-48726](https://cve.now/CVE-2026-48726): Apache Airflow: revoke\_token() unreachable in FabAuthManager / KeycloakAuthManager logout path

- Severity: Medium 6.5
- Published: Jun 1, 2026
- Affected: from 3.0.0, fixed in 3.2.2.
- Fixed in 3.2.2 (released May 29, 2026, 3 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-49298](https://cve.now/CVE-2026-49298): Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments

- Severity: High 8.8
- Published: Jun 1, 2026
- Affected: from 3.0.0, fixed in 3.2.2; fixed in 3.2.2.
- Fixed in 3.2.2 (released May 29, 2026, 3 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-45192](https://cve.now/CVE-2026-45192): Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response

- Severity: Medium 6.5
- Published: Jun 1, 2026
- Affected: from 3.0.0, fixed in 3.2.2.
- Fixed in 3.2.2 (released May 29, 2026, 3 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-38743](https://cve.now/CVE-2026-38743): Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities

- Severity: Medium 4.3
- Published: Apr 24, 2026
- Affected: from 3.0.0, fixed in 3.2.1.
- Fixed in 3.2.1 (released Apr 22, 2026, 2 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-40690](https://cve.now/CVE-2026-40690): Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated topologies and all DAGs names to unauthorized users

- Severity: Medium 4.3
- Published: Apr 24, 2026
- Affected: from 3.0.0, fixed in 3.2.1.
- Fixed in 3.2.1 (released Apr 22, 2026, 2 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-32690](https://cve.now/CVE-2026-32690): Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max\_depth=1

- Severity: Low 3.7
- Published: Apr 18, 2026
- Affected: from 3.0.0, fixed in 3.2.0; from 3.0.0, fixed in 3.2.0.
- Fixed in 3.2.0 (released Apr 7, 2026, 11 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-30898](https://cve.now/CVE-2026-30898): Apache Airflow: Bad example of BashOperator shell injection via dag\_run.conf

- Severity: High 8.8
- Published: Apr 18, 2026
- Affected: from 3.0.0, fixed in 3.2.0.
- Fixed in 3.2.0 (released Apr 7, 2026, 11 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-30912](https://cve.now/CVE-2026-30912): Apache Airflow: Exposing stack trace in case of constraint error

- Severity: High 7.5
- Published: Apr 18, 2026
- Affected: from 3.0.0, fixed in 3.2.0; fixed in 3.2.0.
- Fixed in 3.2.0 (released Apr 7, 2026, 11 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-25917](https://cve.now/CVE-2026-25917): Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)

- Severity: High 7.2
- Published: Apr 18, 2026
- Affected: from 3.0.0, fixed in 3.2.0; fixed in 3.2.0.
- Fixed in 3.2.0 (released Apr 7, 2026, 11 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-32228](https://cve.now/CVE-2026-32228): Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to

- Severity: High 7.5
- Published: Apr 18, 2026
- Affected: from 3.0.0, fixed in 3.2.0; from 3.0.0, fixed in 3.2.0.
- Fixed in 3.2.0 (released Apr 7, 2026, 11 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-31987](https://cve.now/CVE-2026-31987): Apache Airflow: JWT token appearing in logs

- Severity: High 7.5
- Published: Apr 16, 2026
- Affected: from 3.0.0, fixed in 3.2.0.
- Fixed in 3.2.0 (released Apr 7, 2026, 9 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-25219](https://cve.now/CVE-2026-25219): Apache Airflow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access

- Severity: Medium 6.5
- Published: Apr 15, 2026
- Affected: from 3.0.0, fixed in 3.1.8.
- Fixed in 3.1.8 (released Mar 11, 2026, 35 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2025-54550](https://cve.now/CVE-2025-54550): Apache Airflow: RCE by race condition in example\_xcom dag

- Severity: High 8.1
- Published: Apr 15, 2026
- Affected: from 3.0.0, fixed in 3.2.0.
- Fixed in 3.2.0 (released Apr 7, 2026, 8 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-33858](https://cve.now/CVE-2026-33858): Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (type/var) Bypass in XCom API

- Severity: High 8.8
- Published: Apr 13, 2026
- Affected: from 3.1.8, fixed in 3.2.0.
- Fixed in 3.2.0 (released Apr 7, 2026, 6 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2025-66236](https://cve.now/CVE-2025-66236): Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI

- Severity: High 7.5
- Published: Apr 13, 2026
- Affected: from 3.0.0, fixed in 3.2.0.
- Fixed in 3.2.0 (released Apr 7, 2026, 6 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2025-57735](https://cve.now/CVE-2025-57735): Apache Airflow: Airflow Logout Not Invalidating JWT

- Severity: Critical 9.1
- Published: Apr 9, 2026
- Affected: from 3.0.0, fixed in 3.2.0.
- Fixed in 3.2.0 (released Apr 7, 2026, 2 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-34538](https://cve.now/CVE-2026-34538): Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure)

- Severity: Medium 6.5
- Published: Apr 9, 2026
- Affected: from 3.0.0, fixed in 3.2.0.
- Fixed in 3.2.0 (released Apr 7, 2026, 2 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-28563](https://cve.now/CVE-2026-28563): Apache Airflow: DAG authorization bypass

- Severity: Medium 4.3
- Published: Mar 17, 2026
- Affected: from 3.0.0, fixed in 3.1.8.
- Fixed in 3.1.8 (released Mar 11, 2026, 6 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-26929](https://cve.now/CVE-2026-26929): Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata

- Severity: Medium 6.5
- Published: Mar 17, 2026
- Affected: from 3.0.0, fixed in 3.1.8.
- Fixed in 3.1.8 (released Mar 11, 2026, 6 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-30911](https://cve.now/CVE-2026-30911): Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization

- Severity: High 8.1
- Published: Mar 17, 2026
- Affected: from 3.1.0, fixed in 3.1.8.
- Fixed in 3.1.8 (released Mar 11, 2026, 6 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-28779](https://cve.now/CVE-2026-28779): Apache Airflow: Path of session token in cookie does not consider base\_url - session hijacking via co-hosted applications

- Severity: High 7.5
- Published: Mar 17, 2026
- Affected: from 3.0.0, fixed in 3.1.8.
- Fixed in 3.1.8 (released Mar 11, 2026, 6 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2025-65995](https://cve.now/CVE-2025-65995): Apache Airflow: Disclosure of secrets to UI via kwargs

- Severity: Medium 6.5
- Published: Feb 21, 2026
- Affected: from 3.0.0, fixed in 3.1.4.
- Fixed in 3.1.4 (released Dec 10, 2025, 73 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-22922](https://cve.now/CVE-2026-22922): Apache Airflow: Airflow externalLogUrl Permission Bypass

- Severity: Medium 6.5
- Published: Feb 9, 2026
- Affected: from 3.1.0, fixed in 3.1.7.
- Fixed in 3.1.7 (released Feb 4, 2026, 5 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2026-24098](https://cve.now/CVE-2026-24098): Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors

- Severity: Medium 6.5
- Published: Feb 9, 2026
- Affected: from 3.0.0, fixed in 3.1.7.
- Fixed in 3.1.7 (released Feb 4, 2026, 5 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2025-68675](https://cve.now/CVE-2025-68675): Apache Airflow: proxy credentials for various providers might leak in task logs

- Severity: High 7.5
- Published: Jan 16, 2026
- Affected: from 3.0.0, fixed in 3.1.6.
- Fixed in 3.1.6 (released Jan 13, 2026, 3 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2025-68438](https://cve.now/CVE-2025-68438): Apache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated

- Severity: High 7.5
- Published: Jan 16, 2026
- Affected: from 3.1.0, fixed in 3.1.6.
- Fixed in 3.1.6 (released Jan 13, 2026, 3 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2025-66388](https://cve.now/CVE-2025-66388): Apache Airflow: Secrets in rendered templates not redacted properly and exposed in the UI

- Severity: Medium 4.3
- Published: Dec 15, 2025
- Affected: from 3.1.0, fixed in 3.1.4.
- Fixed in 3.1.4 (released Dec 10, 2025, 5 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2025-54941](https://cve.now/CVE-2025-54941): Apache Airflow: Command injection in "example\_dag\_decorator"

- Severity: Medium 4.6
- Published: Oct 30, 2025
- Affected: from 3.0.0, fixed in 3.0.5.
- Fixed in 3.0.5 (released Aug 20, 2025, 71 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2025-62402](https://cve.now/CVE-2025-62402): Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API

- Severity: Medium 5.4
- Published: Oct 30, 2025
- Affected: from 3.0.0, fixed in 3.1.1.
- Fixed in 3.1.1 (released Oct 27, 2025, 3 days before disclosure).
- The latest release, 3.4.0, is not affected.

### [CVE-2025-54831](https://cve.now/CVE-2025-54831): Apache Airflow: Connection sensitive details exposed to users with READ permissions

- Severity: Medium 6.5
- Published: Sep 26, 2025
- Affected: versions 3.0.3.
- Fixed in 3.0.4 (released Aug 8, 2025, 49 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 3.4.0, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/apache-airflow-core
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.