AI
Product
Airflow
On CISA KEVExploited in the wild
158
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 14High 44Medium 97Low 3
Watch
Add Airflow to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-13927 In wildKEV | 9.8 | Nov 10 | Apache Airflow's Experimental API Authentication Bypass Affected: before 1.10.11 |
| CVE-2026-33264 | 9.8 | Jul 7 | Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize() Affected: before 3.3.0 |
| CVE-2023-25754 | 9.8 | May 8 | Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.6.0 Affected: before 2.6.0 |
| CVE-2023-22884 | 9.8 | Jan 21 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache… Affected: before 2.5.1 |
| CVE-2022-40189 | 9.8 | Nov 22 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to… Affected: before 2.3.0 |
| CVE-2022-38649 | 9.8 | Nov 22 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to… Affected: before 2.3.0 |
| CVE-2022-38054 | 9.8 | Sep 2 | In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation Affected: 2.2.4 through 2.3.3 |
| CVE-2021-38540 | 9.8 | Sep 9 | The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3 Affected: 2.0.0 before 2.1.3 |
| CVE-2020-11982 | 9.8 | Jul 17 | An issue was found in Apache Airflow versions 1.10.10 and below Affected: through 1.10.10 |
| CVE-2020-11981 | 9.8 | Jul 17 | An issue was found in Apache Airflow versions 1.10.10 and below Affected: through 1.10.10 |
| CVE-2017-17836 | 9.8 | Jan 23 | In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow Affected: through 1.8.2 |
| CVE-2026-86473 | 9.1 | Sep 21 | Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry Affected: 3.0.0 before 3.3.2 |
| CVE-2026-42252 | 9.1 | Jun 1 | Apache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern Affected: 3.0.0 before 3.2.2 |
| CVE-2025-57735 | 9.1 | Apr 9 | Apache Airflow: Airflow Logout Not Invalidating JWT Affected: 3.0.0 before 3.2.0 |
Showing 14