Apache Airflow

Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure)

Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs

Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options

Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key

Apache Airflow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access

Apache Airflow: Secrets in rendered templates not redacted properly and exposed in the UI

Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response

Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata

Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id}

Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)

Apache Airflow: Airflow externalLogUrl Permission Bypass

Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service

Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path

Apache Airflow: Connection Secrets not masked in UI when Connection are added via Airflow cli

Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext

Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets

Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking

Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints

Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI

Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI

Apache Airflow: Open redirect during login

In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit.

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.

Apache Airflow Reflected XSS via Origin Query Argument in URL

An issue was found in Apache Airflow versions 1.10.10 and below. A stored XSS vulnerability was discovered in the Chart pages of the the "classic" UI.

Apache Airflow: Reflected XSS via Origin Query Argument in URL

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to Apache Airflow 1.9.0 or above.

Open Redirect

Apache Airflow: Stored XSS Vulnerability on provider link

Apache Airflow prior to 2.4.2 has an open redirect

Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL

Apache Airflow SMTP Provider, Apache Airflow IMAP Provider, Apache Airflow: SMTP/IMAP client components allowed MITM due to missing Certificate Validation

Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy

Apache Airflow: Dag Code and Import Error Permissions Ignored

Apache Airflow Providers SMTP: No certificate validation on SMTP STARTTLS connections in SMTP provider

Apache Airflow: No certificate validation on SMTP STARTTLS connections

In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.

Apache Airflow Spark Provider RCE that bypass restrictions to read arbitrary files

Apache Airflow: Cache Control - Storage of Sensitive Data in Browser Cache

Stored XSS on Apache Airflow