Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI

Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)

Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext

Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI

Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints

Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs

Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key

Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id}

Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options

Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler

Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking

Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets

Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path

Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response

Apache Airflow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access

Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure)

Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata

Apache Airflow: Connection Secrets not masked in UI when Connection are added via Airflow cli

Apache Airflow: Disclosure of secrets to UI via kwargs

Apache Airflow: Airflow externalLogUrl Permission Bypass

Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors

Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL

Apache Airflow prior to 2.4.2 has an open redirect

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack

Apache Airflow: No certificate validation on SMTP STARTTLS connections

Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy

In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views

Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint

Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection

Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter

Apache Airflow: Airflow Variables were not masked in the UI for authenticated users

Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target

Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints

Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter

Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities

Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated topologies and all DAGs names to unauthorized users

Apache Airflow: DAG authorization bypass

Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation