Skip to content
OpenAdvisories
High WID-SEC-2026-1073 2 CVEs

Apache Airflow: Mehrere Schwachstellen

Published Apr 13, 2026 · Updated Apr 13, 2026 · de-DE

Vendor: Apache Product: Airflow

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um beliebigen Programmcode auszuführen oder nicht näher spezifizierte Auswirkungen zu erreichen, wodurch möglicherweise Sicherheitsmaßnahmen umgangen werden.

Product

Apache Airflow ist eine Plattform zur programmatischen Erstellung, Planung und Überwachung von Workflows.

Vulnerabilities 2

  • High 8.8
    CVE-2026-33858

    Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API

    Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low. Users are recommended …

    Apache Software Foundation Apache Airflow apache-airflow PyPI
  • High 7.5
    CVE-2025-66236

    Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI

    Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay attention to security details and security model of Airflow. Some assumptions the Deployment Manager could make were not cl…

    Apache Software Foundation Apache Airflow apache-airflow PyPI

Revision history

  1. #1

    Initiale Fassung

References