Where
-Infinity
0

Trending

Last week
Last month
Last year

Apache AirflowApache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI

Risk 38
Severity
6.5
First published (updated )
CVE-2026-59244

apache-airflowApache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server

Risk 79
Severity
8.8
First published (updated )
CVE-2026-58076

Apache Apache AirflowApache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint

Risk 34
Severity
5.4
First published (updated )
CVE-2026-59242

Apache Apache AirflowApache Airflow: Airflow Variables were not masked in the UI for authenticated users

Risk 22
Severity
4.3
First published (updated )
CVE-2026-54183

Apache AirflowApache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization

Risk 51
Severity
7.3
First published (updated )
CVE-2026-67260
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Apache AirflowApache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)

Risk 38
Severity
6.5
First published (updated )
CVE-2026-65017

Apache AirflowApache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Risk 43
Severity
7.5
First published (updated )
CVE-2026-68968

Apache AirflowApache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext

Risk 38
Severity
6.5
First published (updated )
CVE-2026-68969

Apache Apache AirflowApache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI

Risk 38
Severity
6.5
First published (updated )
CVE-2026-68970

Apache Apache AirflowApache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints

Risk 38
Severity
6.5
First published (updated )
CVE-2026-68971
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Apache AirflowApache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection

Risk 34
Severity
5.4
First published (updated )
CVE-2026-68076

Apache Apache AirflowApache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()

Risk 90
Severity
9.8
First published (updated )
CVE-2026-33264

Apache AirflowApache Airflow: Task-instance API exposes secrets in deferred trigger kwargs

Risk 40
Severity
6.5
First published (updated )
CVE-2026-49487

Apache Apache AirflowApache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key

Risk 40
Severity
6.5
First published (updated )
CVE-2026-48828

Apache AirflowApache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id}

Risk 40
Severity
6.5
First published (updated )
CVE-2026-49296
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Apache AirflowApache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target

Risk 24
Severity
4.3
First published (updated )
CVE-2026-48891

Apache AirflowApache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options

Risk 40
Severity
6.5
First published (updated )
CVE-2026-48892

oss-secCVE-2026-48892: Apache Airflow: Config API leaks per-key sects backend kwargs - masker bypass on synthetic options

First published (updated )
https://seclists.org/oss-sec/2026/q3/78

oss-secCVE-2026-48891: Apache Airflow: /ui/dependencies scheduling graph leaks unadable Dag identifiers via trigger/sensor dep.source/dep.target

First published (updated )
https://seclists.org/oss-sec/2026/q3/77

oss-secCVE-2026-49296: Apache Airflow: Per-DAG ad bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id}

First published (updated )
https://seclists.org/oss-sec/2026/q3/79
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

oss-secCVE-2026-48828: Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - dact() called without the key

First published (updated )
https://seclists.org/oss-sec/2026/q3/76

oss-secCVE-2026-49487: Apache Airflow: Task-instance API exposes sects in deferd trigger kwargs

First published (updated )
https://seclists.org/oss-sec/2026/q3/80

oss-secCVE-2026-33264: Apache Airflow: DAG author RCE on webserver via unstricted import_string() in BaseSerialization.deserialize()

First published (updated )
https://seclists.org/oss-sec/2026/q3/75

pypi/apache-airflowApache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response

Risk 40
Severity
6.5
First published (updated )
CVE-2026-45192

oss-secCVE-2026-45192: Apache Airflow: Incomplete daction of Sensitive Fields in Connection Extra API sponse

First published (updated )
https://seclists.org/oss-sec/2026/q2/764
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Apache AirflowApache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments

Risk 83
Severity
8.8
First published (updated )
CVE-2026-49298

Apache Apache AirflowApache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path

Risk 40
Severity
6.5
First published (updated )
CVE-2026-48726

pypi/apache-airflowApache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter

Risk 24
Severity
4.3
First published (updated )
CVE-2026-46764

pypi/apache-airflowApache Airflow: Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access

Risk 18
Severity
3.1
First published (updated )
CVE-2026-45426

Apache AirflowApache Airflow: Arbitrary import in custom deadline-reference deserialization

Risk 54
Severity
7.3
First published (updated )
CVE-2026-45360
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203