Medium
CVE-2026-32794
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 205
Reset filters
Medium
CVE-2026-25604
Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass
High
CVE-2025-69219
Apache Airflow Providers Http has Unsafe Pickle Deserializatio leading to RCE via HttpOperator
High
CVE-2024-56373
Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate table
Medium
CVE-2025-65995
Apache Airflow error reporting may expose full kwargs
Medium
CVE-2025-27555
Apache Airflow exposes sensitive information in its log files
High
CVE-2025-30473
Apache Airflow Common SQL Provider Vulnerable to SQL Injection
Medium
CVE-2025-27018
Apache Airflow MySQL Provider is Vulnerable to SQL Injection
Low
CVE-2024-45033
Apache Airflow Fab Provider Insufficient Session Expiration vulnerability
Low
CVE-2024-50378
Apache Airflow vulnerable to Insertion of Sensitive Information Into Sent Data
Medium
CVE-2026-49487
In Apache Airflow before 3.3.0, the REST API task-instance detail and list
Medium
CVE-2026-49296
Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. `GET /api/v2/dagSources/{dag_id}` — and the equivalent Dag-so
Medium
CVE-2026-48828
Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API
Medium
CVE-2026-48891
A bug in Apache Airflow's `/ui/dependencies` scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the `de
Medium
CVE-2026-48892
The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRE
Critical
CVE-2026-33264
A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a
Low
CVE-2024-29733
Improper Certificate Validation vulnerability in Apache Airflow FTP Provider
High
CVE-2023-41267
Apache HDFS Provider error message suggested
High
CVE-2023-27604
Airflow Sqoop Provider RCE Vulnerability
High
CVE-2023-40272
Apache Airflow Spark Provider Improper Input Validation vulnerability
High
CVE-2023-37415
Apache Airflow Apache Hive Provider Improper Input Validation vulnerability
High
CVE-2023-33234
Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration
High
CVE-2023-34395
Apache Airflow ODBC Provider Argument Injection vulnerability
High
CVE-2023-22886
Apache Airflow JDBC Provider Improper Input Validation vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.