Media
CVE-2026-45192
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 205
Restablecer filtros
Alta
CVE-2026-45360
Apache Airflow Vulnerable to Deserialization of Untrusted Data
Alta
CVE-2026-45361
Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attack
Media
CVE-2026-42526
In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `"my_t
Media
CVE-2026-43826
The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedd
Media
CVE-2026-41018
Apache Airflow Providers Elasticsearch: Elasticsearch task-log handlers leak credentials embedded in the host URL
Media
CVE-2026-41016
apache-airflow-providers-smtp: No certificate validation on SMTP STARTTLS connections in SMTP provider
Media
CVE-2026-40690
Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions
Media
CVE-2026-38743
Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance record
Baja
CVE-2026-32690
Apache Airflow Exposes Secrets in Variables Saved as JSON Dictionaries
Alta
CVE-2026-25917
Apache Airflow allows code execution through crafted XCom payloads
Media
CVE-2026-30912
Apache Airflow exposes SQL stack trace despite "api/expose_stack_traces" set to false
Alta
CVE-2026-32228
Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions
Alta
CVE-2026-31987
Apache Airflow: JWT token appearing in logs
Alta
CVE-2025-54550
Apache Airflow: RCE by race condition in example_xcom dag
Media
CVE-2026-25219
Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access
Alta
CVE-2026-33858
Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly tru
Media
CVE-2025-66236
Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI
Media
CVE-2026-34538
Apache Airflow has an authorization bypass in DagRun wait endpoint
Media
CVE-2026-28563
Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dep
Alta
CVE-2026-30911
Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve,
Alta
CVE-2026-28779
Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.
Media
CVE-2026-26929
Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). As a
Media
CVE-2026-24098
Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated Users
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.