Skip to content
OpenAdvisories
High WID-SEC-2026-2305 2 CVEs

Apache Airflow: Mehrere Schwachstellen

Published Jul 13, 2026 · Updated Jul 13, 2026 · de-DE

Vendor: Apache Product: Airflow Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um seine Privilegien zu erhöhen.

Product

Apache Airflow ist eine Plattform zur programmatischen Erstellung, Planung und Überwachung von Workflows.

Vulnerabilities 2

  • High 8.1
    CVE-2026-58065

    Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key verification

    The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHostKeyChecking=no` by default, disabling SSH host-key verification. An attacker who can intercept the network path between an Airflow worker and the Git server can impersonate the s…

    Apache Software Foundation Apache Airflow Git provider
  • High 8.1
    CVE-2026-59245

    Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision)

    In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission resource name produced by `resource_name()`, so a user granted per-DAG `access_control` on that one DAG was silently granted the global all-DAG…

    Apache Software Foundation Apache Airflow FAB provider

Revision history

  1. #1

    Initiale Fassung

References