DeutschShown in its original language — a full translation is planned for a future version.
Apache Airflow: Mehrere Schwachstellen
view advisory published 2026-09-21
Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um Informationen offenzulegen, falsche Informationen darzustellen oder Sicherheitsmaßnahmen zu umgehen.
01
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-86473US | — | — | ||
Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as an Authorization beare… | ||||
| CVE-2026-82355US | — | — | ||
When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie and ignores the bear… | ||||
| CVE-2026-75158US | — | — | ||
Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authe… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan