PatchTheCEVairflow vulnerabilities and fixes
Recent CVEs affecting airflow, with upgrade or downgrade steps. 12 tracked.
airflow has 12 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 12. Most recent: 2026-08-12. Highest priority: CVE-2026-67260 (score 49/100).
- CVE-2026-67260 HIGH 7.3 UPGRADE Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swe
- CVE-2026-67587 HIGH 8.8 UPGRADE Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, whic
- CVE-2026-58076 HIGH 8.8 UPGRADE Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class nam
- CVE-2026-68968 HIGH 7.5 UPGRADE Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backf
- CVE-2026-65017 MEDIUM 6.5 UPGRADE Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments
- CVE-2026-59242 MEDIUM 5.4 UPGRADE Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal
- CVE-2026-68969 MEDIUM 6.5 UPGRADE Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they w
- CVE-2026-68971 MEDIUM 6.5 UPGRADE Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom re
- CVE-2026-59244 MEDIUM 6.5 UPGRADE Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered
- CVE-2026-68076 MEDIUM 5.4 UPGRADE Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the w
- CVE-2026-68970 MEDIUM 6.5 UPGRADE Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets store
- CVE-2026-54183 MEDIUM 4.3 UPGRADE Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the U
FAQ
How do I fix airflow vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is airflow being exploited right now?
None of the tracked airflow CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which airflow CVE should I patch first?
CVE-2026-67260 currently ranks highest (49/100): Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swe.