Apache Airflow Command Injection

Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()

In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow

Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

Apache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern

Apache Airflow: Airflow Logout Not Invalidating JWT

Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server

Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget

Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator

Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments

Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf

Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API

Apache Airflow: Authenticated DAG authors could execute code on scheduler nodes

Apache Airflow: Command Injection in an example DAG

In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object

In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow

Apache Airflow: RCE by race condition in example_xcom dag

Session still functional after user is deactivated

Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation

Apache Airflow: Exposing stack trace in case of constraint error

Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to

Apache Airflow: JWT token appearing in logs

Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI

The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled…

Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization

Apache Airflow: Arbitrary import in custom deadline-reference deserialization

Apache Airflow: Open Redirect Bypass Vulnerability

Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)

Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI

Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)

Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext

Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI

Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints

Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs

Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key

Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id}

Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options

Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler

Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking

Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets

Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path

Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response

Apache Airflow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access

Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure)

Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL

Apache Airflow prior to 2.4.2 has an open redirect

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack

Apache Airflow: No certificate validation on SMTP STARTTLS connections