Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path

Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response

Apache Airflow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access

Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure)

Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata

Apache Airflow: Connection Secrets not masked in UI when Connection are added via Airflow cli

Apache Airflow: Disclosure of secrets to UI via kwargs

Apache Airflow: Airflow externalLogUrl Permission Bypass

Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors

Apache Airflow: Secrets in rendered templates not redacted properly and exposed in the UI

Apache Airflow: Connection sensitive details exposed to users with READ permissions

Apache Airflow: Stored XSS Vulnerability on provider link

Apache Airflow prior to 2.4.2 has an open redirect

Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack

Apache Airflow: No certificate validation on SMTP STARTTLS connections

Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy

Apache Airflow: Cache Control - Storage of Sensitive Data in Browser Cache

In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views

Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint

Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection

Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API

Apache Airflow: Potential XSS Vulnerability

Apache Airflow: XSS vulnerability in Task Instance Log/Log Details

Apache Airflow: Potentially harmful permission changing by log task handler

Apache Airflow: Secrets not masked in UI when sensitive variables are set via Airflow cli

Apache Airflow: Command injection in "example_dag_decorator"

Apache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)

Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter

Apache Airflow: Airflow Variables were not masked in the UI for authenticated users

Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target

Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints

Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter

Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities

Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated topologies and all DAGs names to unauthorized users

Apache Airflow: DAG authorization bypass

Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used

Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1

Apache Airflow: DAG authorization bypass on /ui/structure/structure_data

Apache Airflow: Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access