AI
Product
Airflow
On CISA KEVExploited in the wild
158
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 14High 44Medium 97Low 3
Watch
Add Airflow to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-47037 | 4.3 | Nov 12 | We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then. Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows… Affected: before 2.7.3 |
| CVE-2023-46288 | 4.3 | Oct 23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.4.0 to 2.7.0 Affected: 2.4.0 before 2.7.0 |
| CVE-2023-45348 | 4.3 | Oct 14 | Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when the "expose_config"… Affected: 2.7.0 before 2.7.2 |
| CVE-2023-40611 | 4.3 | Sep 12 | Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting… Affected: before 2.7.3 |
| CVE-2026-82355 | 4.2 | Sep 21 | Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation Affected: 3.3.0; 3.3.1 |
| CVE-2026-32690 | 3.7 | Apr 18 | Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1 Affected: 3.0.0 before 3.2.0 |
| CVE-2026-40963 | 3.1 | Jun 1 | Apache Airflow: DAG authorization bypass on /ui/structure/structure_data Affected: 3.0.0 before 3.2.2 |
| CVE-2026-45426 | 3.1 | Jun 1 | Apache Airflow: Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access Affected: 3.0.0 before 3.2.2 |