Skip to content
OpenAdvisories
High WID-SEC-2026-4401 18 CVEs

Apache Airflow: Mehrere Schwachstellen

Published Nov 8, 2026 · Updated Nov 11, 2026 · Revision 3 · de

Vendor: Apache Product: Airflow

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen sowie Daten zu manipulieren oder offenzulegen.

Product

Apache Airflow ist eine Plattform zur programmatischen Erstellung, Planung und Überwachung von Workflows.

Vulnerabilities 18

  • Critical 9.8
    CVE-2026-68982 Public exploit

    Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation

    Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitra…

    Apache Software Foundation Apache Airflow
  • Critical 9.1
    CVE-2026-101031

    Apache Airflow: Shell command injection in the example_dag_decorator example Dag via an IPv6 zone identifier

    The `example_dag_decorator` example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Python's `ipaddress` module and then placed it into a shell command. `ipaddress` accepts IPv6 zone identifiers containing arbitrary characters, …

    Apache Software Foundation Apache Airflow
  • High 8.8
    CVE-2026-111421

    Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow.* classes on the API server

    Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied elsewhere, so a Dag author's task could write an XCom that, when a user later viewed it through the API with deserialization enabled, made the API …

    Apache Software Foundation Apache Airflow
  • High 8.8
    CVE-2026-86829 Public exploit

    Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation

    Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies. A Dag author, who controls what a task writes to XCom, therefore controls data that is deserialized inside the scheduler process - a context the…

    Apache Software Foundation Apache Airflow
  • High 8.8
    CVE-2026-96285

    Apache Airflow: Scheduler: next_kwargs deserialized before the dict check, so resume data still invokes constructors

    Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded `next_kwargs` value is a dictionary, but performs that check only after deserializing the whole stored payload. Deserialization reconstructs nested objects of classes pe…

    Apache Software Foundation Apache Airflow
  • High 8.2
    CVE-2026-111395

    Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline callbacks

    Apache Airflow did not reject reserved serialization keys inside a Dag run's `conf`. A user allowed to trigger a Dag that uses a deadline alert with an asynchronous callback could pass a `conf` that, once the deadline was missed, either crashed the scheduler …

    Apache Software Foundation Apache Airflow
  • High 8.2
    CVE-2026-40913

    Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcement

    Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the `ImportError.can_read` permission when the failing file has no registered DAG. This happens when a file fails to parse before any DAG is defined, or when …

    Apache Software Foundation Apache Airflow
  • High 7.5
    CVE-2026-113508

    Apache Airflow: Logout token revocation fails open; errors silently swallowed

    Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL (for example the…

    Apache Software Foundation Apache Airflow
  • High 7.3
    CVE-2026-82337

    Apache Airflow: DeadlineAlert fields bypass plugin-registration gate for scheduler-side deserialization

    Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag, in the scheduler and API server. A Dag author could cause classes within Airflow's deserialization allow list t…

    Apache Software Foundation Apache Airflow
  • Medium 6.5
    CVE-2026-107474

    Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext

    The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext, although Airflow 3 treats connection…

    Apache Software Foundation Apache Airflow
  • Medium 6.5
    CVE-2026-111452

    Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhookUrl) not matched against the sensitive-field list

    Apache Airflow's secrets masker matched sensitive key names only in their snake_case form, so values stored under camelCase keys such as `privateKey`, `connectionString`, `webhookUrl` or `accessKey` — for example in a Connection's extra or a Variable — were n…

    Apache Software Foundation Apache Airflow
  • Medium 6.5
    CVE-2026-111454

    Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read

    Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset without checking whether the caller may read those Dags. An authenticated user with asset read access could learn the IDs of Dags they are not au…

    Apache Software Foundation Apache Airflow
  • Medium 6.5
    CVE-2026-111455

    Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit

    Apache Airflow's asynchronous connection test checked permissions when the test was queued — only create permission when the connection ID did not exist yet — but, when the test completed with `commit_on_success`, wrote the tested connection under that ID. A …

    Apache Software Foundation Apache Airflow
  • Medium 6.5
    CVE-2026-113504

    Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext

    Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys…

    Apache Software Foundation Apache Airflow
  • Medium 6.5
    CVE-2026-50204

    Apache Airflow: Audit-log secrets masker redacts by key name only, persisting connection and Variable secrets in cleartext

    Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the `Log.extra` column because the secrets masker matched only on configured sensitive key names. An authenticated low-privilege user with read access to the event-log / a…

    Apache Software Foundation Apache Airflow
  • Medium 6.5
    CVE-2026-76185

    Apache Airflow Task SDK: SecretCache: non-injective team cache key enables cross-team secret disclosure in multi-team mode

    Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped `_` delimiters, so different (team, secret id) pairs could collide. In multi-team deployments a Dag author could read another team's Variable or Connection v…

    Apache Software Foundation Apache Airflow Task SDK
  • Medium 6.5
    CVE-2026-86468

    Apache Airflow: CLI argv masking misses Variable values and --conn-extra, persisting secrets in audit logs

    Apache Airflow's CLI records its arguments in the audit log but masks secrets by argument position, so some supported command shapes leave secrets in cleartext, for example a trailing `--description` on Variable commands, `--conn-extra`, and the inline `--pas…

    Apache Software Foundation Apache Airflow
  • Medium 4.3
    CVE-2026-111453

    Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag_id query value but deletes rows for every readable Dag

    Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the `dag_id` query parameter, but deleted the queued events of every Dag the caller could read. An authenticated user with edit permission on one Dag and r…

    Apache Software Foundation Apache Airflow

Revision history

  1. #3

    PoC für CVE-2026-68982 aufgenommen

  2. #2

    Referenz(en) aufgenommen: EUVD-2026-119905

  3. #1

    Initiale Fassung

References