Apache Airflow vulnerabilities and fixes

CVEs that mention Apache Airflow, ranked by priority. 17 tracked.

Apache Airflow has 17 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 17. Most recent: 2026-08-12. Highest priority: CVE-2026-59243 (score 60/100).

• CVE-2026-59243 CRITICAL 9.8 UPGRADE The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so
• CVE-2026-67260 HIGH 7.3 UPGRADE Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swe
• CVE-2026-67587 HIGH 8.8 UPGRADE Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, whic
• CVE-2026-58076 HIGH 8.8 UPGRADE Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class nam
• CVE-2026-68968 HIGH 7.5 UPGRADE Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backf
• CVE-2026-68868 MEDIUM 6.5 UPGRADE The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team sco
• CVE-2026-68872 MEDIUM 6.5 UPGRADE The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resol
• CVE-2026-65017 MEDIUM 6.5 UPGRADE Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments
• CVE-2026-59242 MEDIUM 5.4 UPGRADE Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal
• CVE-2026-68871 MEDIUM 6.5 UPGRADE The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Va
• CVE-2026-68969 MEDIUM 6.5 UPGRADE Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they w
• CVE-2026-68971 MEDIUM 6.5 UPGRADE Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom re
• CVE-2026-59244 MEDIUM 6.5 UPGRADE Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered
• CVE-2026-68076 MEDIUM 5.4 UPGRADE Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the w
• CVE-2026-68870 MEDIUM 5.3 The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connec
• CVE-2026-68970 MEDIUM 6.5 UPGRADE Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets store
• CVE-2026-54183 MEDIUM 4.3 UPGRADE Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the U

FAQ

How do I fix Apache Airflow vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Apache Airflow being exploited right now?

None of the tracked Apache Airflow CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Apache Airflow CVE should I patch first?

CVE-2026-59243 currently ranks highest (60/100): The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so .

← Back to latest CVEs