Apache Airflow any version

Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection

Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API

No Authentication on Logging Server

In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack.

Apache Airflow: Potentially harmful permission changing by log task handler

Information disclosure in Apache Airflow

Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used

Apache Airflow: Secrets not masked in UI when sensitive variables are set via Airflow cli

In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected.

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process.

Apache Airflow: Overly broad default permissions for Viewer/Ops (audit logs)

Overly permissive umask for daemons

Apache Airflow: Command injection in "example_dag_decorator"

Apache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)

Apache Airflow: Improper access control to DAG resources

Apache Airflow Dag Runs Broken Access Control Vulnerability

Apache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access)

Apache Airflow: Sensitive parameters exposed in API when "non-sensitive-only" configuration is set

Apache Airflow: Configuration information leakage vulnerability

Apache Airflow: DAG authorization bypass

Apache Airflow: Airflow Variables were not masked in the UI for authenticated users

Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target

Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter

Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities

Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints

Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated topologies and all DAGs names to unauthorized users

Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1

Apache Airflow: Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access

Apache Airflow: DAG authorization bypass on /ui/structure/structure_data