Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-68970 | medium | 6.5 | No | Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cl... | 2026-11-03 |
| CVE-2026-68969 | medium | 6.5 | No | Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk... | 2026-11-03 |
| CVE-2026-68968 | high | 7.5 | No | Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to... | 2026-11-03 |
| CVE-2026-68076 | medium | 5.4 | No | Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard m... | 2026-11-03 |
| CVE-2026-67587 | high | 8.8 | No | Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by... | 2026-11-03 |
| CVE-2026-67260 | high | 7.3 | No | Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That swee... | 2026-11-03 |
| CVE-2026-65017 | medium | 6.5 | No | Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has ena... | 2026-11-03 |
| CVE-2026-59244 | medium | 6.5 | No | Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value... | 2026-11-03 |
| CVE-2026-59242 | medium | 5.4 | No | Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.dese... | 2026-11-03 |
| CVE-2026-58076 | high | 8.8 | No | Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized bl... | 2026-11-03 |
| CVE-2026-54183 | medium | 4.3 | No | Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-dept... | 2026-11-03 |
| CVE-2026-49487 | medium | 6.5 | No | In Apache Airflow before 3.3.0, the REST API task-instance detail and list endpoints returned a deferred task's trigger kwargs without maski... | 2026-11-03 |
| CVE-2026-49298 | high | 8.8 | No | A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate against the Execution API to be passed to... | 2026-11-03 |
| CVE-2026-49296 | medium | 6.5 | No | Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. `... | 2026-11-03 |
| CVE-2026-48892 | medium | 6.5 | No | The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SE... | 2026-11-03 |
| CVE-2026-49267 | medium | 5.9 | No | Apache Airflow's EmailOperator and the underlying `airflow.utils.email` helpers established SMTP STARTTLS connections without verifying the... | 2026-11-03 |
| CVE-2026-48891 | medium | 4.3 | No | A bug in Apache Airflow's `/ui/dependencies` scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized... | 2026-11-03 |
| CVE-2026-48828 | medium | 6.5 | No | The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key... | 2026-11-03 |
| CVE-2026-48726 | medium | 6.5 | No | A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the... | 2026-11-03 |
| CVE-2026-46764 | medium | 4.3 | No | The Event Log detail endpoint `GET /api/v2/eventLogs/{event_log_id}` in Apache Airflow fetched audit-log rows directly by numeric ID after o... | 2026-11-03 |