p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in apache-airflow-core

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für apache-airflow-core: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 5

  1. CVE-2026-49298

    Hoch · CVSS 8.8EPSS 0,49%Korrektur verfügbar

    Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments

    A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate against the Execution API to be passed to the worker container as command-line arguments visible in the pod spec. An authenticated UI/API user with Kubernetes read-only access to the cluster (e.g. `pods/get` in the Airflow namespace) could harvest the JWT from `kubectl describe pod` output and then call state-mutating Execution API endpoints — triggering Dag runs, clearing runs, reading or writing Variables / Connections / XComs — as if they were a running task. Affects deployments using the `KubernetesExecutor`. Users are advised to upgrade to

    apache-airflow-corePython
    • Auf 3.2.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-32690

    Niedrig · CVSS 3.7EPSS 0,42%Korrektur verfügbar

    Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1

    Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked. If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to Apache Airflow 3.2.0 that has the fix implemented

    apache-airflow-corePython
    • Auf 3.2.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2026-30912

    Hoch · CVSS 7.5EPSS 0,45%Korrektur verfügbar

    Apache Airflow: Exposing stack trace in case of constraint error

    In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.

    apache-airflow-corePython
    • Auf 3.2.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2026-25917

    Hoch · CVSS 7.2EPSS 0,82%Korrektur verfügbar

    Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)

    Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.

    apache-airflow-corePython
    • Auf 3.2.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →