Skip to content
OpenAdvisories

Package · PyPI

apache-airflow

158 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 4.8
    CVE-2026-32794 Public exploit

    Apache Airflow Provider for Databricks: TLS Certificate Verification Disabled in Databricks Provider K8s Token Exchange

    Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipula…

    Apache Software Foundation Apache Airflow Provider for Databricks apache-airflow PyPI
  • Critical 9.8
    CVE-2023-22884 Public exploit EPSS 12%

    Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Ai…

    Apache Software Foundation Apache Airflow Apache Airflow MySQL Provider apache-airflow PyPI
  • High 8.8
    CVE-2022-40127 Public exploit EPSS 86%

    Apache Airflow <2.4.0 has an RCE in a bash example

    A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.

    Apache Software Foundation Apache Airflow apache-airflow PyPI
  • Critical 9.8
    CVE-2021-38540 Public exploit EPSS 81%

    Apache Airflow: Variable Import endpoint missed authentication check

    The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclo…

    Apache Software Foundation Apache Airflow apache-airflow PyPI
  • Critical 9.8
    CVE-2020-13927 Exploited Public exploit EPSS 100%

    Authentication bypass in Apache Airflow

    The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and …

    apache-airflow PyPI
    KEV Jan 18, 2022
  • Critical 9.8
    CVE-2020-11981 Public exploit EPSS 37%

    Command injection via Celery broker in Apache Airflow

    An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.

    Apache Software Foundation Apache Airflow apache-airflow PyPI
  • High 8.8
    CVE-2020-11978 Exploited Public exploit EPSS 99%

    Remote code execution (RCE) in Apache Airflow

    An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user runnin…

    Apache Software Foundation Apache Airflow apache-airflow PyPI
    KEV Jan 18, 2022