Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Airflow

169 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2026-75157 Public exploit

    Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

    Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-trigger…

    Apache Software Foundation Apache Airflow
  • High 8.8
    CVE-2022-40127 Public exploit EPSS 86%

    Apache Airflow <2.4.0 has an RCE in a bash example

    A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.

    Apache Software Foundation Apache Airflow apache-airflow PyPI
  • High 8.8
    CVE-2020-11978 Exploited Public exploit EPSS 99%

    Remote code execution (RCE) in Apache Airflow

    An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user runnin…

    Apache Software Foundation Apache Airflow apache-airflow PyPI
    KEV Jan 18, 2022