apache-airflow vulnerabilities

CVEs whose affected-version data names the apache-airflow package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

apache-airflow vulnerabilities

Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange

Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate table

Apache Airflow exposes sensitive information in its log files

Apache Airflow error reporting may expose full kwargs

Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access

Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated Users

Apache Airflow proxy credentials for various providers might leak in task logs

Apache Airflow secrets in rendered templates could contain parts of sensitive values when truncated

Apache Airflow has a command injection vulnerability in "example_dag_decorator"

Apache Airflow's create action can upsert existing Pools/Connections/Variables

Apache Airflow `/api/v2/dagReports` executes DAG Python in API

Apache Airflow vulnerable to Insertion of Sensitive Information Into Sent Data

Apache Airflow vulnerable to Improper Encoding or Escaping of Output

Apache Airflow vulnerable to Execution with Unnecessary Privileges

Apache Airflow Cross-site Scripting Vulnerability

Apache Airflow Potential Cross-site Scripting Vulnerability

Apache Airflow has DAG Author Code Execution possibility in airflow-scheduler

Apache Airflow does not return the "Cache-Control" header for dynamic content

Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used

Apache Airflow Improper Preservation of Permissions vulnerability

Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerability

Apache Airflow missing Certificate Validation

OS Command Injection in Apache Airflow