In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint

Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL

Apache Airflow prior to 2.4.2 has an open redirect

In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's `/confirm` endpoint

It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit

In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit

An issue was found in Apache Airflow versions 1.10.10 and below

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack

Apache Airflow: No certificate validation on SMTP STARTTLS connections

Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy

Apache Airflow Providers SMTP: No certificate validation on SMTP STARTTLS connections in SMTP provider

Apache Airflow: Dag Code and Import Error Permissions Ignored

Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL Certificate…

Apache Airflow: Cache Control - Storage of Sensitive Data in Browser Cache

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to…

In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views

Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint

Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection

Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API

Apache Airflow: Potential XSS Vulnerability

Apache Airflow: XSS vulnerability in Task Instance Log/Log Details

Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description…

Task instance details page in the UI is vulnerable to a stored XSS.This issue affects Apache Airflow: before 2.6.0

An issue was found in Apache Airflow versions 1.10.10 and below

Apache Airflow: Potentially harmful permission changing by log task handler

Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.5.2

If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a…

Flask-AppBuilder is a development framework, built on top of Flask

The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0

In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack

Apache Airflow: Secrets not masked in UI when sensitive variables are set via Airflow cli

In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary…

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views

Apache Airflow: Overly broad default permissions for Viewer/Ops (audit logs)

In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in a race condition…

Apache Airflow: Command injection in "example_dag_decorator"

Apache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)

Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter

Apache Airflow: Airflow Variables were not masked in the UI for authenticated users

Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target

Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints

Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter

Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities

Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated topologies and all DAGs names to unauthorized users

Apache Airflow: DAG authorization bypass

Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used

Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could…