Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-40690 | medium | 4.3 | No | The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could br... | 2026-11-03 |
| CVE-2026-38743 | medium | 4.3 | No | The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance records: a... | 2026-11-03 |
| CVE-2026-34538 | medium | 6.5 | No | Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permiss... | 2026-11-03 |
| CVE-2026-33858 | high | 8.8 | No | Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to exec... | 2026-11-03 |
| CVE-2026-33264 | critical | 9.8 | No | A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / AP... | 2026-11-03 |
| CVE-2026-32690 | low | 3.7 | No | Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets s... | 2026-11-03 |
| CVE-2026-32228 | high | 7.5 | No | UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.... | 2026-11-03 |
| CVE-2026-31987 | high | 7.5 | No | JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow ver... | 2026-11-03 |
| CVE-2026-30912 | high | 7.5 | No | In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lea... | 2026-11-03 |
| CVE-2026-30911 | high | 8.1 | No | Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints th... | 2026-11-03 |
| CVE-2026-30898 | high | 8.8 | No | An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user inp... | 2026-11-03 |
| CVE-2026-28779 | high | 7.5 | No | Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base... | 2026-11-03 |
| CVE-2026-28563 | medium | 4.3 | No | Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized... | 2026-11-03 |
| CVE-2026-26929 | medium | 6.5 | No | Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request i... | 2026-11-03 |
| CVE-2026-25917 | high | 7.2 | No | Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to exec... | 2026-11-03 |
| CVE-2026-25219 | medium | 6.5 | No | The `access_key` and `connection_string` connection properties were not marked as sensitive names in secrets masker. This means that user wi... | 2026-11-03 |
| CVE-2026-24098 | medium | 6.5 | No | Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to... | 2026-11-03 |
| CVE-2026-22922 | medium | 6.5 | No | Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limit... | 2026-11-03 |
| CVE-2026-108817 | medium | 5.5 | No | A vulnerability was determined in agno-agi agno up to 3.0.9. Affected by this issue is the function agno.CodingTools.run_shell in the librar... | 2026-11-03 |
| CVE-2025-68675 | high | 7.5 | No | In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embed... | 2026-11-03 |