Skip to content
OpenAdvisories
High WID-SEC-2026-1168 6 CVEs

Apache Airflow und Apache Airflow Keycloak Provider: Mehrere Schwachstellen

Published Apr 19, 2026 · Updated Apr 19, 2026 · de-DE

Vendor: Apache Product: Airflow

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Airflow und dem Airflow Keycloak Provider ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.

Product

Apache Airflow ist eine Plattform zur programmatischen Erstellung, Planung und Überwachung von Workflows.

Vulnerabilities 6

  • High 8.8
    CVE-2026-30898

    Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf

    An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker. Users should review if any of their ow…

    Apache Software Foundation Apache Airflow
  • High 7.5
    CVE-2026-30912

    Apache Airflow: Exposing stack trace in case of constraint error

    In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, w…

    Apache Software Foundation Apache Airflow apache-airflow apache-airflow-core PyPI
  • High 7.5
    CVE-2026-32228

    Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to

    UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.

    Apache Software Foundation Apache Airflow apache-airflow-core PyPI
  • High 7.2
    CVE-2026-25917

    Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)

    Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low. Users are recommended …

    Apache Software Foundation Apache Airflow apache-airflow apache-airflow-core PyPI
  • Medium 5.4
    CVE-2026-40948

    Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager

    The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliv…

    Apache Software Foundation Apache Airflow Providers Keycloak apache-airflow-providers-keycloak PyPI
  • Low 3.7
    CVE-2026-32690

    Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1

    Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked. If you do not store variables with sensitive values in JSON form, you are not a…

    Apache Software Foundation Apache Airflow apache-airflow apache-airflow-core PyPI

Revision history

  1. #1

    Initiale Fassung

References