Apache Airflow Command Injection

Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server

Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget

Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator

Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments

Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf

Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API

Apache Airflow: Authenticated DAG authors could execute code on scheduler nodes

Apache Airflow: Command Injection in an example DAG

Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler

Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task"…

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter

In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI

A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks

In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object

In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow

Apache Airflow: SSTI to Code Execution in Airflow through Shared DB Information

Apache Airflow: RCE by race condition in example_xcom dag

Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization

Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections,…

Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges

Session still functional after user is deactivated

The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up…

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to…

Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to…

Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation

Apache Airflow: Exposing stack trace in case of constraint error

Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to

Apache Airflow: JWT token appearing in logs

Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI

Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications

Apache Airflow: proxy credentials for various providers might leak in task logs

Apache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated

Apache Airflow: Sensitive configuration values are not masked in the logs by default

Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enable_xcom_pickling=False"…

Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow

A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example when they were…

In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction

The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled…

Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization

Apache Airflow: Arbitrary import in custom deadline-reference deserialization

Apache Airflow: Open Redirect Bypass Vulnerability

Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)