AA
Product
Apache Airflow
On CISA KEVExploited in the wild
65
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 25Medium 32Low 3
Watch
Add Apache Airflow to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-32690 | 3.7 | Apr 18 | Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1 Affected: 3.0.0 before 3.2.0 |
| CVE-2026-40963 | 3.1 | Jun 1 | Apache Airflow: DAG authorization bypass on /ui/structure/structure_data Affected: 3.0.0 before 3.2.2 |
| CVE-2026-45426 | 3.1 | Jun 1 | Apache Airflow: Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access Affected: 3.0.0 before 3.2.2 |
Showing 3