CVE-2019-12417Medium· 4.8▾ SunlitApache Airflow vulnerable to XSS and local file disclosure
▾ Sunlit zone — Low / medium · no exploitation signal
impact 26.4 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.3%
A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process.
airflow < 1.10.6Upgrade to a patched release:
airflow 1.10.6Connected by shared product, vendor, weakness, or advisory.
CVE-2026-48828Medium· 6.5The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which triggers on secret-suffixed key names like `*_password` / `*_token` / `*_secret`) …
CVE-2024-45784High· 7.5Apache Airflow: Sensitive configuration values are not masked in the logs by default
CVE-2026-68970Medium· 6.5Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI
CVE-2026-68969Medium· 6.5Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`)
CVE-2026-68968High· 7.5Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse
CVE-2026-68076Medium· 5.4Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope