Where
-Infinity
0

Trending

Last week
Last month
Last year

Apache Apache AirflowApache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()

Risk 90
Severity
9.8
First published (updated )
CVE-2026-33264

Apache AirflowApache Airflow: Task-instance API exposes secrets in deferred trigger kwargs

Risk 40
Severity
6.5
First published (updated )
CVE-2026-49487

Apache Apache AirflowApache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key

Risk 40
Severity
6.5
First published (updated )
CVE-2026-48828

Apache AirflowApache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id}

Risk 40
Severity
6.5
First published (updated )
CVE-2026-49296

Apache AirflowApache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target

Risk 24
Severity
4.3
First published (updated )
CVE-2026-48891
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Apache AirflowApache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options

Risk 40
Severity
6.5
First published (updated )
CVE-2026-48892

oss-secCVE-2026-48892: Apache Airflow: Config API leaks per-key sects backend kwargs - masker bypass on synthetic options

First published (updated )
https://seclists.org/oss-sec/2026/q3/78

oss-secCVE-2026-48891: Apache Airflow: /ui/dependencies scheduling graph leaks unadable Dag identifiers via trigger/sensor dep.source/dep.target

First published (updated )
https://seclists.org/oss-sec/2026/q3/77

oss-secCVE-2026-49296: Apache Airflow: Per-DAG ad bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id}

First published (updated )
https://seclists.org/oss-sec/2026/q3/79

oss-secCVE-2026-48828: Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - dact() called without the key

First published (updated )
https://seclists.org/oss-sec/2026/q3/76
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

oss-secCVE-2026-49487: Apache Airflow: Task-instance API exposes sects in deferd trigger kwargs

First published (updated )
https://seclists.org/oss-sec/2026/q3/80

oss-secCVE-2026-33264: Apache Airflow: DAG author RCE on webserver via unstricted import_string() in BaseSerialization.deserialize()

First published (updated )
https://seclists.org/oss-sec/2026/q3/75

pypi/apache-airflowApache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response

Risk 40
Severity
6.5
First published (updated )
CVE-2026-45192

oss-secCVE-2026-45192: Apache Airflow: Incomplete daction of Sensitive Fields in Connection Extra API sponse

First published (updated )
https://seclists.org/oss-sec/2026/q2/764

Apache AirflowApache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments

Risk 83
Severity
8.8
First published (updated )
CVE-2026-49298
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Apache Apache AirflowApache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path

Risk 40
Severity
6.5
First published (updated )
CVE-2026-48726

pypi/apache-airflowApache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter

Risk 24
Severity
4.3
First published (updated )
CVE-2026-46764

pypi/apache-airflowApache Airflow: Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access

Risk 18
Severity
3.1
First published (updated )
CVE-2026-45426

Apache AirflowApache Airflow: Arbitrary import in custom deadline-reference deserialization

Risk 54
Severity
7.3
First published (updated )
CVE-2026-45360

pypi/apache-airflowApache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator

Risk 83
Severity
8.8
First published (updated )
CVE-2026-42359
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Apache AirflowApache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets

Risk 40
Severity
6.5
First published (updated )
CVE-2026-42358

Apache AirflowApache Airflow: Rendered template truncation bypasses nested sensitive-key masking

Risk 40
Severity
6.5
First published (updated )
CVE-2026-42360

oss-secCVE-2026-42359: Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator

First published (updated )
https://seclists.org/oss-sec/2026/q2/749

Apache Apache AirflowApache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern

Risk 70
Severity
9.1
First published (updated )
CVE-2026-42252

Apache AirflowApache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation

Risk 46
Severity
7.5
First published (updated )
CVE-2026-41084
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Apache Apache AirflowApache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy

Risk 37
Severity
5.9
First published (updated )
CVE-2026-41017

Apache Apache AirflowApache Airflow: No certificate validation on SMTP STARTTLS connections

Risk 37
Severity
5.9
First published (updated )
CVE-2026-49267

Apache AirflowApache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints

Risk 24
Severity
4.3
First published (updated )
CVE-2026-41014

pypi/apache-airflowApache Airflow: DAG authorization bypass on /ui/structure/structure_data

Risk 18
Severity
3.1
First published (updated )
CVE-2026-40963

Apache Apache AirflowApache Airflow: Open Redirect Bypass Vulnerability

Risk 46
Severity
7.2
First published (updated )
CVE-2026-40961
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203