Skip to content
cve.newCreate a CVE report

apache-airflow-core

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

high8.2
CVE-2026-40913

Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcement

Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the ImportError.can_read permission when the failing file has no registered DAG. This happens when a file fails to parse before any DAG is defined, or when all of its previously registered DAGs are removed but the parse error remains. Users who should not see that file's details can read stack traces that may expose file paths and code.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow
medium6.5
CVE-2026-50204

Apache Airflow: Audit-log secrets masker redacts by key name only, persisting connection and Variable secrets in cleartext

Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the Log.extra column because the secrets masker matched only on configured sensitive key names. An authenticated low-privilege user with read access to the event-log / audit API — with no prior access to the affected connection or variable — could read those rows and recover the credentials verbatim. Users should upgrade to apache-airflow 3.4.0 or later, which masks these values and restricts the affected audit rows to authorized users. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow / Apache Software Foundation · Apache Airflow
critical9.8
CVE-2026-68982

Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation

Apache Airflow's CeleryExecutor ran callback workloads (ExecuteCallback, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker, without Airflow credentials. Deployments using the CeleryExecutor are affected.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow
high8.8
CVE-2026-86829

Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation

Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies. A Dag author, who controls what a task writes to XCom, therefore controls data that is deserialized inside the scheduler process - a context the Airflow security model reserves for code installed by the Deployment Manager, above the worker-scoped execution capability a Dag author is documented to have. Deployments that treat Dag authors as less trusted than Deployment Managers are affected, and the scheduler must be evaluating a task dependency that reads a task-written XCom value. Users of apache-airflow are recommended to upgrade to version 3.4.0 or later, which restricts dependency evaluation to primitive XCom values.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow
high7.3
CVE-2026-82337

Apache Airflow: DeadlineAlert fields bypass plugin-registration gate for scheduler-side deserialization

Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag, in the scheduler and API server. A Dag author could cause classes within Airflow's deserialization allow list to be constructed in those processes with arguments they control. Deployments whose Dags use deadline alerts are affected.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow
medium6.5
CVE-2026-86468

Apache Airflow: CLI argv masking misses Variable values and --conn-extra, persisting secrets in audit logs

Apache Airflow's CLI records its arguments in the audit log but masks secrets by argument position, so some supported command shapes leave secrets in cleartext, for example a trailing --description on Variable commands, --conn-extra, and the inline --password of airflow keycloak-auth-manager commands. A user who can read audit events but is denied Variable and Connection access can retrieve those values through the event-log API.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow / Apache Software Foundation · Apache Airflow
high8.8
CVE-2026-96285

Apache Airflow: Scheduler: next_kwargs deserialized before the dict check, so resume data still invokes constructors

Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded next_kwargs value is a dictionary, but performs that check only after deserializing the whole stored payload. Deserialization reconstructs nested objects of classes permitted by the deserialization allow-list — which by default includes Airflow's own classes — and runs their constructors inside the scheduler process before the check can reject the value. A Dag author, who controls a task's next_kwargs through the task execution API, can therefore still trigger constructor execution in the scheduler when the awaiting_input timeout sweep processes the task, and in the API server when the task instance is served to a worker using an older Execution API version; no non-default configuration is required. Versions before 3.3.0 are not affected. This is an incomplete fix for CVE-2026-67260: deployments that upgraded to 3.3.1 for that issue must also upgrade to apache-airflow 3.4.0 or later.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow
high7.5
CVE-2026-113508

Apache Airflow: Logout token revocation fails open; errors silently swallowed

Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL (for example the FAB or Keycloak auth managers), server-side revocation is the only thing that invalidates the Airflow token; it failed on database errors and, reliably, for tokens from an external issuer accepted via [api_auth] trusted_jwks_url whose token identifier is longer than 32 characters. Anyone holding a copy of a user's token from before logout could keep using it against the Airflow API until it expired. Users are advised to upgrade to apache-airflow 3.4.0 or later.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow
critical9.1
CVE-2026-101031

Apache Airflow: Shell command injection in the example_dag_decorator example Dag via an IPv6 zone identifier

The example_dag_decorator example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Python's ipaddress module and then placed it into a shell command. ipaddress accepts IPv6 zone identifiers containing arbitrary characters, so when example Dags are loaded (load_examples enabled), a user who can trigger that Dag with a custom url parameter could point it at a server whose response injects shell commands run on the worker. This is an incomplete fix for CVE-2025-54941; users who upgraded for CVE-2025-54941 should upgrade again. Users are advised to upgrade to apache-airflow 3.4.0 or later, or to disable example Dags (load_examples = False), which is recommended for production.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow
medium6.5
CVE-2026-113504

Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext

Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs and rendered template fields. A user who can read task logs or rendered templates, but is not meant to see those secrets, could read them. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow / Apache Software Foundation · Apache Airflow
medium6.5
CVE-2026-107474

Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext

The Apache Airflow connections API did not mask the apprise provider's config connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext, although Airflow 3 treats connection credentials as write-only.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow / Apache Software Foundation · Apache Airflow
high8.2
CVE-2026-111395

Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline callbacks

Apache Airflow did not reject reserved serialization keys inside a Dag run's conf. A user allowed to trigger a Dag that uses a deadline alert with an asynchronous callback could pass a conf that, once the deadline was missed, either crashed the scheduler repeatedly or was rebuilt into objects inside the Triggerer. Users are advised to upgrade to apache-airflow 3.4.0 or later.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow
high8.8
CVE-2026-111421

Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow.* classes on the API server

Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied elsewhere, so a Dag author's task could write an XCom that, when a user later viewed it through the API with deserialization enabled, made the API server instantiate classes from the airflow.* namespace with arguments the Dag author chose. This is an incomplete fix for CVE-2026-59242: users who applied that fix in apache-airflow 3.3.1 remain affected through this route and should upgrade to apache-airflow 3.4.0 or later.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow
medium6.5
CVE-2026-111452

Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhookUrl) not matched against the sensitive-field list

Apache Airflow's secrets masker matched sensitive key names only in their snake_case form, so values stored under camelCase keys such as privateKey, connectionString, webhookUrl or accessKey — for example in a Connection's extra or a Variable — were not redacted in task logs, rendered template fields or API responses. A user who can read task logs or rendered templates, but is not meant to see those credentials, could read them in cleartext. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow / Apache Software Foundation · Apache Airflow
medium4.3
CVE-2026-111453

Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag_id query value but deletes rows for every readable Dag

Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the dag_id query parameter, but deleted the queued events of every Dag the caller could read. An authenticated user with edit permission on one Dag and read access to others could suppress asset-triggered runs of Dags they cannot edit. This is an incomplete fix for CVE-2026-75157: users who upgraded to apache-airflow 3.3.2 for that fix are still affected and should upgrade to apache-airflow 3.4.0 or later.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow
medium6.5
CVE-2026-111454

Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read

Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset without checking whether the caller may read those Dags. An authenticated user with asset read access could learn the IDs of Dags they are not authorized to see. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow / Apache Software Foundation · Apache Airflow
medium6.5
CVE-2026-111455

Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit

Apache Airflow's asynchronous connection test checked permissions when the test was queued — only create permission when the connection ID did not exist yet — but, when the test completed with commit_on_success, wrote the tested connection under that ID. A user allowed to create but not edit connections could overwrite a connection someone else had created in the meantime. Only deployments that enable the non-default [core] test_connection setting are affected. Users are advised to upgrade to apache-airflow 3.4.0 or later.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow
critical9.1
CVE-2026-86473

Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid until it expires. An attacker who already holds a copy of that token keeps the victim's access after the victim has logged out and believes the session ended; the default token lifetime is 24 hours and is configurable.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow
medium4.3
CVE-2026-75158

Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter

Apache Airflow's /assets/events API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events — including the source Dag ID, task ID, run ID and event timestamps — for Dags they have no permission to see. Because the filter was also absent from the count query, total_entries and pagination disclosed the existence of hidden Dags even without inspecting individual rows. Deployments are affected whenever per-Dag access control is used to separate teams or tenants; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Apache Software Foundation · Apache Airflow / Apache Software Foundation · Apache Airflow
medium4.2
CVE-2026-82355

Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the audit log -- as the cookie's principal rather than the identity the client explicitly presented.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow
high7.5
CVE-2026-75157

Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with READ instead of EDIT. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing action gated on a read-only permission. Deployments are affected whenever asset-triggered scheduling is in use and Dag read access is granted more widely than Dag edit access, which is the normal RBAC arrangement; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Apache Software Foundation · Apache Airflow / Apache Software Foundation · Apache Airflow
medium6.5
CVE-2026-59244

Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI

Apache Airflow's secrets masker did not mask var.json Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an isinstance(str) guard — so a secret stored as a JSON Variable and referenced in a template via var.json was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow / Apache Software Foundation · Apache Airflow
high8.8
CVE-2026-58076

Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server

Apache Airflow's serialization layer reconstructed exception nodes by calling import_string() on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's executor_config reaches that branch, so a Dag author could place a value there that causes an arbitrary callable to be imported and invoked -- for example subprocess.check_output, or builtins.eval on the builtins-prefixed variant. The code runs in the Scheduler, which reconstructs serialized Dags in its normal loop with no request involved, and in the API server, on any authenticated read of the Dag such as GET /api/v2/dags/{dag_id}/details. Both are components the Airflow security model states must never execute Dag-author code, and both hold the metadata database credentials and the JWT signing secret. No non-default configuration is required. This is a different sink from CVE-2026-33264, which covered only the trigger branch of the same deserializer: deployments that upgraded in response to that advisory are still affected through the exception branch and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later, which restricts the imported class to a subclass of BaseException.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow
medium5.4
CVE-2026-59242

Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint

Apache Airflow's XCom GET /api/v2/{...}/xcomEntries/{key}?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserialize_value without the _check_forbidden_xcom_keys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow.* classes on the API server (CWE-502). An authenticated user who can write an XCom value and then read it back with deserialize=true triggers the unsafe instantiation. Users are advised to upgrade to apache-airflow 3.3.1 or later, which rejects reserved XCom serialization keys submitted as JSON string literals.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow / Apache Software Foundation · Apache Airflow
medium4.3
CVE-2026-54183

Apache Airflow: Airflow Variables were not masked in the UI for authenticated users

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was shown unmasked in the Variables UI. The exposure is limited to the UI: any authenticated user who can see the Variable in the UI can already read its full value through the Variables REST API, so this does not disclose data the user could not otherwise obtain — the masking is a shoulder-surfing defense for the UI, not an access-control boundary.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Apache Software Foundation · Apache Airflow / Apache Software Foundation · Apache Airflow
high7.3
CVE-2026-67260

Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization

Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new awaiting_input task state swept by the scheduler. That sweep deserializes the task instance's next_kwargs without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job. No non-default configuration is required: the sweep runs unconditionally every 15 seconds, and the default allowed_deserialization_classes setting does not cover this code path. Versions before 3.3.0 are not affected, because human-in-the-loop tasks deferred onto the triggerer instead. This is a different code path from CVE-2026-58076, which covers the same unguarded exception-node deserialization reached elsewhere — deployments that applied that fix must upgrade for this issue as well. Users are advised to upgrade to apache-airflow 3.3.1 or later.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow
high8.8
CVE-2026-67587

Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget

Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default allowed_deserialization_classes allow-list, so tightening that setting does not help. A Dag author — who controls a task instance's next_kwargs through the task execution API — can therefore cause an arbitrary module to be imported inside the scheduler process, when the scheduler's awaiting_input timeout sweep deserializes that value. No non-default configuration is required; the sweep runs unconditionally. Versions before 3.3.0 are not affected: the class existed, but the scheduler sweep that reaches it did not. This is a separate code path from CVE-2026-58076 and CVE-2026-67260, which cover different gadgets reaching deserialization — applying either of those fixes does not address this one. Users are advised to upgrade to apache-airflow 3.3.1 or later.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow
medium6.5
CVE-2026-65017

Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets masker matched only base section and option names and did not normalize team-prefixed sections before the sensitivity check (CWE-200). This is a distinct masker bypass from CVE-2026-48828 and CVE-2026-48892: deployments that upgraded to apache-airflow 3.3.0 to address those issues remain affected by this team-scoped variant. Users are advised to upgrade to apache-airflow 3.3.1 or later, which normalizes team-scoped sections before masking.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow
high7.5
CVE-2026-68968

Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfill_id path segment failed to parse. The authorization dependency parsed it with int() while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int() rejects (1.0 coerces to 1); FastAPI resolves dependencies before endpoint validation, so the two acted on different Dags. An authenticated user holding edit permission on any single Dag could therefore read, pause and cancel backfills belonging to any other Dag, including moving another Dag's queued runs to failed. No non-default configuration is required and backfill ids are sequential, so finding a target is trivial. Users are advised to upgrade to apache-airflow 3.3.1 or later, which parses the backfill id with the same type the routes declare.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow / Apache Software Foundation · Apache Airflow
medium6.5
CVE-2026-68969

Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext

Apache Airflow wrote Variable values and Connection extra contents to the audit log in cleartext when they were submitted through the bulk endpoints (PATCH /api/v2/variables and PATCH /api/v2/connections). The audit-log masking recognised only top-level request fields, and a bulk request nests its entities two levels below, so no masking was applied to them. Any authenticated user with audit-log read access -- who need not hold Variables or Connections read at all -- could recover those secrets verbatim, and the Connection extra copy is stored unencrypted in the log while the connection table encrypts it. The Airflow UI's Import Variables action posts to this endpoint, so an ordinary operator import wrote every secret in the file to the log. This is a different code path from CVE-2026-50204: that fix shipped in 3.3.0 and covers the single-entity endpoints only, so deployments that upgraded in response to that advisory remain affected and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow / Apache Software Foundation · Apache Airflow