Skip to content
OpenAdvisories
Medium WID-SEC-2026-0493 2 CVEs

Apache Airflow: Mehrere Schwachstellen

Published Feb 23, 2026 · Updated Feb 24, 2026 · Revision 2 · de-DE

Vendor: Apache Product: Airflow

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um beliebigen Programmcode auszuführen oder vertrauliche Informationen offenzulegen.

Product

Apache Airflow ist eine Plattform zur programmatischen Erstellung, Planung und Überwachung von Workflows.

Vulnerabilities 2

  • High 8.4
    CVE-2024-56373

    Apache Airflow: SSTI to Code Execution in Airflow through Shared DB Information

    DAG Author (who already has quite a lot of permissions) could manipulate database of Airflow 2 in the way to execute arbitrary code in the web-server context, which they should normally not be able to do, leading to potentially remote code execution in the co…

    Apache Software Foundation Apache Airflow apache-airflow PyPI
  • Medium 6.5
    CVE-2025-27555

    Apache Airflow: Connection Secrets not masked in UI when Connection are added via Airflow cli

    Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive connection parameters were set via airflow CLI, values of those variables…

    Apache Software Foundation Apache Airflow apache-airflow PyPI

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2025-207547, EUVD-2024-55432

  2. #1

    Initiale Fassung

References