Apache Airflow

Format String Vulnerability

Apache Airflow: proxy credentials for various providers might leak in task logs

Apache Airflow prior to 2.3.1 may include sensitive values in rendered template

Apache Airflow: Sensitive configuration values are not masked in the logs by default

Apache Airflow: Potential pickle deserialization vulnerability in XComs

Apache Airflow Celery provider, Apache Airflow: Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend

The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checking.

Apache Airflow: JWT token appearing in logs

Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications

Apache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated

Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation

Apache Airflow: Exposing stack trace in case of constraint error

Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI

Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to

Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization

Apache Airflow: Arbitrary import in custom deadline-reference deserialization

Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)

Apache Airflow: Open Redirect Bypass Vulnerability

CWE-284 Improper Access Control on Configurations Endpoint for the Stable API

In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. Same happened when creating a Connection with a password field.

Apache Airflow: Secrets can be unmasked in the "Rendered Template"

Apache Airflow path traversal by authenticated user

Apache Airflow: Creating DagRuns didn't respect Dag-level permissions in the Webserver

Apache Airflow: Permission verification bypass allows viewing dagruns of other dags

Apache Airflow: ReDoS via dags function

Apache Airflow: Bypass permission verification to view task instances of other dags

Apache Airflow: Information disclosure on configuration view

Apache Airflow: Improper access control to DAG resources

Apache Airflow: Scheduler remote DoS

Apache Airflow: Improper access control vulnerability on the "varimport" endpoint

Apache Airflow: Security vulnerability on AirFlow Connections

Apache Airflow: Improper access control vulnerability in the "List dag warnings" feature

Apache Airflow: Missing CSRF protection on DAG/trigger

Apache Airflow: Access to DAGs without relevant permission

Apache Airflow: Bypass permission verification to read code of other dags

Apache Airflow: Connection sensitive details exposed to users with READ permissions

Apache Airflow: Disclosure of secrets to UI via kwargs

Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors

Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler