Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-54183Apache Airflow: Airflow Variables were not masked in the UI for authenticated users
- CVE-2026-67260Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization
- CVE-2026-67587Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget
- CVE-2026-65017Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)
- CVE-2026-68968Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id
- CVE-2026-68969Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext
- CVE-2026-68970Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI
- CVE-2026-68971Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints
- CVE-2026-68076Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection
- CVE-2026-68868Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables
- CVE-2026-71290Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)
- CVE-2026-69223Apache Allura: Server-side request forgery
- CVE-2026-68872Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable
- CVE-2026-68871Apache Airflow Yandex provider: yandex Lockbox backend: team-scope guard bypass resolves another team's Connection or Variable
- CVE-2026-68870Apache Airflow Microsoft Azure provider: microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's Connection or Variable
- CVE-2026-61899Apache Tapestry: Possible classpath file download through URL manipulation
- CVE-2026-28672Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder
- CVE-2026-32227Apache Ranger: SQL Injection vulnerability in lookup functionality
- CVE-2026-40920Apache Ranger: Privilege Escalation via URL Parameter
- CVE-2026-42537Apache Ranger: Remote Code Execution via JDBC URL Injection
- CVE-2026-44416Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation
- CVE-2026-55799Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator
- CVE-2026-55814Apache Ranger: Download APIs expose plugin data without authentication
- CVE-2026-65942Apache Ranger: Clients accept TLS certificates issued for other hostnames
- CVE-2026-65945Apache Ranger: Logs contain replayable JWT bearer tokens
- CVE-2026-65948Apache Ranger: UnixAuth lacks brute-force protection
- CVE-2026-44630Apache IoTDB: RPC service denial of service via unchecked Thrift string length
- CVE-2026-71559Apache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadata
- CVE-2026-71558Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization
- CVE-2026-71560Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path