AA
Product
Apache Airflow
On CISA KEVExploited in the wild
69
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 27Medium 34Low 3
Watch
Add Apache Airflow to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-33264 | 9.8 | Jul 7 | Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize() Affected: before 3.3.0 |
| CVE-2017-17836 | 9.8 | Jan 23 | In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow Affected: Apache Airflow <= 1.8.2 |
| CVE-2026-86473 | 9.1 | Sep 21 | Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry Affected: 3.0.0 before 3.3.2 |
| CVE-2026-42252 | 9.1 | Jun 1 | Apache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern Affected: 3.0.0 before 3.2.2 |
| CVE-2025-57735 | 9.1 | Apr 9 | Apache Airflow: Airflow Logout Not Invalidating JWT Affected: 3.0.0 before 3.2.0 |
Showing 5