Skip to content
OpenAdvisories
Medium WID-SEC-2026-4005 4 CVEs

Apache Airflow: Mehrere Schwachstellen

Published Oct 15, 2026 · Updated Oct 15, 2026 · de-DE

Vendor: Apache Product: Airflow Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen.

Product

Apache Airflow ist eine Plattform zur programmatischen Erstellung, Planung und Überwachung von Workflows.

Vulnerabilities 4

  • Critical 9.1
    CVE-2026-94134 Public exploit

    Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default

    The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. A…

    Apache Software Foundation Apache Airflow SFTP provider Apache Airflow SSH provider
  • Medium 6.5
    CVE-2026-92228

    Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read

    The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are aff…

    Apache Software Foundation Apache Airflow Keycloak provider
  • Medium 5.8
    CVE-2026-96806

    Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token

    The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware` then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the …

    Apache Software Foundation Apache Airflow Keycloak provider
  • Medium 4.3
    CVE-2026-94135

    Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default

    The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false. Deployments that run SFTP sensors or o…

    Apache Software Foundation Apache Airflow SFTP provider

Revision history

  1. #1

    Initiale Fassung

References