DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Apache Airflow: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-05-31
Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um beliebigen Programmcode auszuführen, um Informationen offenzulegen, um Dateien zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.
01
beschreibt (17)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-49298US | — | — | ||
A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate against the Execution API to be passed to the worker container as command-line ar… | ||||
| CVE-2026-49267US | — | — | ||
Apache Airflow's EmailOperator and the underlying `airflow.utils.email` helpers established SMTP STARTTLS connections without verifying the remote certificate when the deployment u… | ||||
| CVE-2026-48726US | — | — | ||
A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for `FabAuthManager` and `Ke… | ||||
| CVE-2026-46764US | medium4.3 | — | ||
The Event Log detail endpoint `GET /api/v2/eventLogs/{event_log_id}` in Apache Airflow fetched audit-log rows directly by numeric ID after only the generic Audit Log permission che… | ||||
| CVE-2026-45426US | —OT erhöht | — | ||
Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued for at least one Dag. Apache Airflow's Log server authorized… | ||||
| CVE-2026-45360US | — | — | ||
Apache Airflow's scheduler-side deadline-reference decoder (`SerializedCustomReference.deserialize_reference`) imported and dispatched arbitrary class paths drawn from DAG-author-c… | ||||
| CVE-2026-42360US | — | — | ||
A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g. nested `password` / `token` / `secret` / `api_key` keys inside a JSON template… | ||||
| CVE-2026-42359US | — | — | ||
A bug in Apache Airflow's XCom PATCH endpoint `PATCH /api/v2/xcomEntries/{key}` allowed an authenticated UI/API user with XCom write permission on a Dag to set XCom entries under r… | ||||
| CVE-2026-42358US | medium6.5 | — | ||
A bug in Apache Airflow's Variable response masker caused nested-key redaction (triggered by secret-suffixed key names like `password`, `token`, `secret`, `api_key`) to be bypassed… | ||||
| CVE-2026-42252US | — | — | ||
Apache Airflow's official documentation at `core-concepts/dag-run.html` ("Passing Parameters when triggering Dags") showed a verbatim `BashOperator(bash_command="echo value: {{ dag… | ||||
| CVE-2026-41084US | — | — | ||
A bug in Apache Airflow's bulk Task Instances API (`PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances`) evaluated authorization against the `dag_id` resolved fr… | ||||
| CVE-2026-41017US | medium5.9 | — | ||
Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure` flag, so deployments running the Airflow API server behind an HTTPS-terminating reverse proxy (… | ||||
| CVE-2026-41014US | —OT erhöht | — | ||
The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization. An authenticated UI/API user with global Asset:read permis… | ||||
| CVE-2026-40963US | — | — | ||
The structure_data endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking whether the caller had read permission on those linked Dags.… | ||||
| CVE-2026-40961US | — | — | ||
A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the `is_safe_url` check, enabling redirection from a trusted Airflow dom… | ||||
| CVE-2026-40861US | — | — | ||
A Dag author could either (a) create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process (read-path attack — e.g. `/etc/pass… | ||||
| CVE-2026-45192US | — | — | ||
A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allowed an authenticated UI/API user with Connection-read permission to retrieve secrets… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Apache AirflowRelease Notes vom 2026-05-31external
- Apache Mailing List vom 2026-05-31external
- Apache Mailing List vom 2026-05-31external
- Apache Mailing List vom 2026-05-31external
- Apache Mailing List vom 2026-05-31external
- Apache Mailing List vom 2026-05-31external
- Apache Mailing List vom 2026-05-31external
- Apache Mailing List vom 2026-05-31external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan