Apache Airflow

Name: Apache Airflow
Brand: Apache

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

critical

by severity

0critical1high7medium0low

updated 2026-10-28

vulnerabilities (95)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-69219US	—	0.71% (53rd)	Exploit	no fix	2026-03-09	≤ Providers Http <6.0.0
CVE-2026-59243US	—	0.64% (51st)	Exploit	no fix	2026-07-29	≤ FAB provider <3.7.3
CVE-2026-94134US	—	0.60% (48th)	Exploit	no fix	2026-10-15	3 versions
CVE-2026-75157US	—OT elevated	0.44% (38th)	Exploit	3.3.2	2026-09-18	< 3.3.2
CVE-2026-32794US	—	0.39% (33rd)	Exploit	no fix	2026-03-30	≤ Provider for Databricks <1.12.0
CVE-2019-12398US	medium4.8	2.82% (87th)	—	no fix	2020-01-14	≤ Apache Airflow ≤ 1.10.4
CVE-2026-33264US	—	1.65% (76th)	—	3.3.0	2026-07-07	< 3.3.0
CVE-2024-56373US	—	1.23% (69th)	—	2.11.1	2026-02-24	< 2.11.1
CVE-2026-86792US	—	1.19% (68th)	—	no fix	2026-09-16	4 versions
CVE-2026-82310US	—	1.00% (63rd)	—	no fix	2026-09-16	≤ FAB Provider <3.9.0
CVE-2026-49297US	—	0.99% (62nd)	—	no fix	2026-07-06	≤ Google Provider <22.2.1
CVE-2026-76187US	—	0.98% (62nd)	—	no fix	2026-09-16	≤ Keycloak Provider <0.10.0
CVE-2026-82311US	—	0.98% (62nd)	—	no fix	2026-09-16	≤ FAB Provider <3.9.0
CVE-2026-86462US	—	0.83% (57th)	—	no fix	2026-09-16	≤ FAB Provider <3.9.0
CVE-2026-25917US	—	0.82% (57th)	—	3.2.0	2026-04-18	< 3.2.0
CVE-2026-76186US	—	0.81% (57th)	—	no fix	2026-09-16	≤ Keycloak Provider <0.10.0
CVE-2026-86465US	medium6.5	0.81% (57th)	—	no fix	2026-09-16	≤ Akeyless Provider <0.3.1
CVE-2026-67260US	—	0.78% (56th)	—	3.3.1	2026-08-12	< 3.3.1
CVE-2026-30898US	—	0.77% (55th)	—	3.2.0	2026-04-18	< 3.2.0
CVE-2026-86473US	—	0.75% (55th)	—	3.3.2	2026-09-21	< 3.3.2
CVE-2026-31987US	—	0.74% (54th)	—	3.2.0	2026-04-16	< 3.2.0
CVE-2026-82355US	—	0.73% (54th)	—	3.3.2	2026-09-21	< 3.3.2
CVE-2026-28779US	—	0.70% (53rd)	—	3.1.8	2026-03-17	< 3.1.8
CVE-2026-40861US	—	0.69% (53rd)	—	3.2.2	2026-06-01	< 3.2.2
CVE-2026-34538US	—	0.69% (52nd)	—	3.2.0	2026-04-09	< 3.2.0
CVE-2026-45360US	—	0.68% (52nd)	—	3.2.2	2026-06-01	< 3.2.2
CVE-2025-57735US	—	0.67% (52nd)	—	3.2.0	2026-04-09	< 3.2.0
CVE-2026-49487US	—	0.66% (52nd)	—	3.3.0	2026-07-07	< 3.3.0
CVE-2026-48892US	—	0.66% (52nd)	—	3.3.0	2026-07-07	< 3.3.0
CVE-2026-48828US	—	0.66% (52nd)	—	3.3.0	2026-07-07	< 3.3.0
CVE-2026-40961US	—	0.65% (51st)	—	3.2.2	2026-06-01	< 3.2.2
CVE-2026-75158US	—	0.64% (50th)	—	3.3.2	2026-09-21	< 3.3.2
CVE-2026-48891US	—	0.64% (50th)	—	3.3.0	2026-07-07	< 3.3.0
CVE-2026-50203US	—	0.63% (50th)	—	no fix	2026-06-17	≤ SFTP provider <5.8.1
CVE-2026-67587US	—	0.61% (49th)	—	3.3.1	2026-08-12	< 3.3.1
CVE-2026-49296US	—	0.60% (49th)	—	3.3.0	2026-07-07	< 3.3.0
CVE-2026-68868US	—	0.60% (48th)	—	3.3.1	2026-08-12	< 3.3.1
CVE-2026-68872US	—	0.60% (48th)	—	no fix	2026-08-10	3 versions
CVE-2026-33858US	—	0.59% (48th)	—	3.2.0	2026-04-13	< 3.2.0
CVE-2026-45361US	—	0.59% (48th)	—	no fix	2026-05-25	≤ Google provider <22.0.0
CVE-2025-54550US	—	0.58% (47th)	—	3.2.0	2026-04-15	< 3.2.0
CVE-2026-46745US	—	0.57% (47th)	—	no fix	2026-05-25	≤ FAB provider <3.6.4
CVE-2026-42359US	—	0.57% (47th)	—	3.2.2	2026-06-01	< 3.2.2
CVE-2026-86843US	—	0.56% (46th)	—	no fix	2026-09-29	3 versions
CVE-2026-30911US	—OT elevated	0.56% (46th)	—	3.1.8	2026-03-17	< 3.1.8
CVE-2026-25219US	—	0.55% (46th)	—	3.2.0	2026-04-15	< 3.2.0
CVE-2026-59242US	—	0.53% (45th)	—	3.3.1	2026-08-12	< 3.3.1
CVE-2026-49298US	—	0.49% (42nd)	—	3.2.2	2026-06-01	< 3.2.2
CVE-2026-58076US	high8.8	0.48% (42nd)	—	3.3.1	2026-08-12	< 3.3.1
CVE-2026-40963US	—	0.48% (41st)	—	3.2.2	2026-06-01	< 3.2.2

showing 50 of 95

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-200Exposure of Sensitive Information to an Unauthorized Actor11 CVEs
CWE-502Deserialization of Untrusted Data9 CVEs
CWE-639Authorization Bypass Through User-Controlled Key8 CVEs
CWE-532Insertion of Sensitive Information into Log File7 CVEs
CWE-613Insufficient Session Expiration7 CVEs
CWE-668Exposure of Resource to Wrong Sphere4 CVEs
CWE-863Incorrect Authorization4 CVEs
CWE-1220Insufficient Granularity of Access Control3 CVEs

sources (2)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)94 CVEs
EUEU Vulnerability Database (ENISA)1 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan