Apache Airflow's Experimental API Authentication Bypass

Apache Airflow Command Injection

Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()

Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.6.0

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache…

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to…

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to…

In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation

The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3

An issue was found in Apache Airflow versions 1.10.10 and below

An issue was found in Apache Airflow versions 1.10.10 and below

In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow

Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

Apache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern

Apache Airflow: Airflow Logout Not Invalidating JWT

Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server

Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget

Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator

Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments

Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf

Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API

Apache Airflow: Authenticated DAG authors could execute code on scheduler nodes

Apache Airflow: Command Injection in an example DAG

Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code…

Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task"…

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter

In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI

A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks

In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object

In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow

Apache Airflow: SSTI to Code Execution in Airflow through Shared DB Information

Apache Airflow: RCE by race condition in example_xcom dag

Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization

Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections,…

Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges

Session still functional after user is deactivated

The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up…

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to…

Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to…

Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation

Apache Airflow: Exposing stack trace in case of constraint error

Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to

Apache Airflow: JWT token appearing in logs

Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI

Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications

Apache Airflow: proxy credentials for various providers might leak in task logs

Apache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated

Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs

Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enable_xcom_pickling=False"…