DeutschShown in its original language — a full translation is planned for a future version.
Apache Airflow: Mehrere Schwachstellen
view advisory published 2026-07-06
Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, und um Informationen offenzulegen.
01
describes (6)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-49487US | — | — | ||
In Apache Airflow before 3.3.0, the REST API task-instance detail and list
endpoints returned a deferred task's trigger kwargs without masking. When a
deferred operator passed a se… | ||||
| CVE-2026-49296US | — | — | ||
Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. `GET /api/v2/dagSources/{dag_id}` — and t… | ||||
| CVE-2026-48892US | — | — | ||
The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_… | ||||
| CVE-2026-48891US | — | — | ||
A bug in Apache Airflow's `/ui/dependencies` scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag… | ||||
| CVE-2026-48828US | — | — | ||
The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which triggers on secret-suffix… | ||||
| CVE-2026-33264US | — | — | ||
A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG… | ||||
02
references
External citations — patches, advisories, analysis.
- Apache Airflow Release Notes vom 2026-07-06external
- Apache Mailing List vom 2026-07-06external
- Apache Mailing List vom 2026-07-06external
- Apache Mailing List vom 2026-07-06external
- Apache Mailing List vom 2026-07-06external
- Apache Mailing List vom 2026-07-06external
- Apache Mailing List vom 2026-07-06external
- WID-SEC-W-2026-2223 - CSAF Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan