CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 13:10 UTC)

What this means for you

This week: 5,477 CVEs published, 360 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,477; Show in the list
Critical, last 7 days: 360; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product apache:airflow. Show all products

71 CVEs, showing 51 to 71PreviousPage 2 of 2

CVE	Severity	Title	Published
CVE-2025-66236	High 7.5	Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay attention to security details and security model of Airflow.	Apr 13, 2026
CVE-2025-57735	Critical 9.1	When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted.	Apr 9, 2026
CVE-2026-34538	Medium 6.5	Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with…	Apr 9, 2026
CVE-2026-30911	High 8.1	Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve,…	Mar 17, 2026
CVE-2026-28779	High 7.5	Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.	Mar 17, 2026
CVE-2026-28563	Medium 4.3	Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs.	Mar 17, 2026
CVE-2026-26929	Medium 6.5	Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs).	Mar 17, 2026
CVE-2025-27555	Medium 6.5	Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see.	Feb 24, 2026
CVE-2024-56373	High 8.4	DAG Author (who already has quite a lot of permissions) could manipulate database of Airflow 2 in the way to execute arbitrary code in the web-server context, which they should normally not be able t…	Feb 24, 2026
CVE-2025-65995	Medium 6.5	When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators.	Feb 21, 2026
CVE-2026-24098	Medium 6.5	Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not hav…	Feb 9, 2026
CVE-2026-22922	Medium 6.5	Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log…	Feb 9, 2026
CVE-2025-68675	High 7.5	In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information.	Jan 16, 2026
CVE-2025-68438	High 7.5	In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the Rendered Templates UI.	Jan 16, 2026
CVE-2025-66388	Medium 6.5	A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without…	Dec 15, 2025
CVE-2025-62503	Medium 4.6	User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.	Oct 30, 2025
CVE-2025-62402	Medium 5.4	API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.	Oct 30, 2025
CVE-2025-54941	Medium 4.6	An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on worker.	Oct 30, 2025
CVE-2025-54831	Medium 6.5	Apache Airflow 3 introduced a change to the handling of sensitive information in Connections.	Sep 26, 2025
CVE-2020-13927 Known exploited	Critical 9.8	The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. Assigned by apache	Nov 10, 2020
CVE-2020-11978 Known exploited	High 8.8	An issue was found in Apache Airflow versions 1.10.10 and below. Assigned by apache	Jul 16, 2020

PreviousPage 2 of 2

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.