Medium
CVE-2026-22922
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 205
Reset filters
High
CVE-2025-68675
Apache Airflow proxy credentials for various providers might leak in task logs
High
CVE-2025-68438
Apache Airflow secrets in rendered templates could contain parts of sensitive values when truncated
Critical
CVE-2025-67895
Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context
Medium
CVE-2025-66388
A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without t
Medium
CVE-2025-62503
Apache Airflow's create action can upsert existing Pools/Connections/Variables
Medium
CVE-2025-54941
Apache Airflow has a command injection vulnerability in "example_dag_decorator"
Medium
CVE-2025-62402
Apache Airflow `/api/v2/dagReports` executes DAG Python in API
Medium
CVE-2025-54831
Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively
Critical
CVE-2025-50213
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.
High
CVE-2024-45784
Apache Airflow: Sensitive configuration values are not masked in the logs by default
High
CVE-2024-45498
Apache Airflow vulnerable to Improper Encoding or Escaping of Output
High
CVE-2024-45034
Apache Airflow vulnerable to Execution with Unnecessary Privileges
Medium
CVE-2024-41937
Apache Airflow Cross-site Scripting Vulnerability
Low
CVE-2024-42447
Apache Airflow Providers FAB Insufficient Session Expiration vulnerability
High
CVE-2024-39877
Apache Airflow has DAG Author Code Execution possibility in airflow-scheduler
Medium
CVE-2024-39863
Apache Airflow Potential Cross-site Scripting Vulnerability
Low
CVE-2024-25142
Apache Airflow does not return the "Cache-Control" header for dynamic content
Medium
CVE-2024-32077
Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs.
Medium
CVE-2024-31869
Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used
Medium
CVE-2024-29735
Apache Airflow Improper Preservation of Permissions vulnerability
Medium
CVE-2024-28746
Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which t
Medium
CVE-2024-26280
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permit
Medium
CVE-2024-27906
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.