Skip to content
OpenAdvisories
Medium WID-SEC-2026-1660 2 CVEs

Apache Airflow (Google and FAB provider): Mehrere Schwachstellen

Published May 25, 2026 · Updated May 25, 2026 · de-DE

Vendor: Apache Product: Airflow

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um Informationen offenzulegen oder Sicherheitsmaßnahmen zu umgehen.

Product

Apache Airflow ist eine Plattform zur programmatischen Erstellung, Planung und Überwachung von Workflows.

Vulnerabilities 2

  • High 8.1
    CVE-2026-45361

    Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)

    Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advi…

    Apache Software Foundation Apache Airflow Google provider apache-airflow-providers-google PyPI
  • Medium 5.3
    CVE-2026-46745

    Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token

    Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade …

    Apache Software Foundation Apache Airflow FAB provider apache-airflow-providers-fab PyPI

Revision history

  1. #1

    Initiale Fassung

References