DeutschShown in its original language — a full translation is planned for a future version.
Apache Airflow: Mehrere Schwachstellen
view advisory published 2026-08-12
Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.
01
describes (13)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-68971US | —OT elevated | — | ||
Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_until_finished` authorized the target Dag… | ||||
| CVE-2026-68970US | —OT elevated | — | ||
Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered… | ||||
| CVE-2026-68969US | — | — | ||
Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` an… | ||||
| CVE-2026-68968US | — | — | ||
Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse. The authorization dependency par… | ||||
| CVE-2026-68076US | — | — | ||
Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no te… | ||||
| CVE-2026-67587US | — | — | ||
Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncC… | ||||
| CVE-2026-67260US | — | — | ||
Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next… | ||||
| CVE-2026-65017US | — | — | ||
Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Con… | ||||
| CVE-2026-59244US | medium6.5OT elevated | — | ||
Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a… | ||||
| CVE-2026-59242US | — | — | ||
Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` without the `_check_forbi… | ||||
| CVE-2026-58076US | high8.8 | — | ||
Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments f… | ||||
| CVE-2026-54183US | — | — | ||
Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nest… | ||||
| CVE-2026-68868US | — | — | ||
The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name`… | ||||
02
references
External citations — patches, advisories, analysis.
- GitHub Advisory Database vom 2026-08-12external
- GitHub Advisory Database vom 2026-08-12external
- GitHub Advisory Database vom 2026-08-12external
- GitHub Advisory Database vom 2026-08-12external
- GitHub Advisory Database vom 2026-08-12external
- GitHub Advisory Database vom 2026-08-12external
- GitHub Advisory Database vom 2026-08-12external
- GitHub Advisory Database vom 2026-08-12external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan