Apache Airflow
- Software type
- Orchestration platform
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/18/2026, Apache Airflow recorded 16 security vulnerabilities in the last 90 days, of which 6 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Apache Airflow and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-86473Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiryCVE-2026-75158Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filterCVE-2026-82355Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixationCVE-2026-75157Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)CVE-2026-59244Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-86473Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry | Exploitation statusNot exploited | FixYes |
| SeverityCritical |
CVE-2026-75158Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter | Exploitation statusNot exploited | FixYes | Published09/21/2026 | SeverityMedium |
|---|
CVE-2026-82355Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation | Exploitation statusNot exploited | FixYes | Published09/21/2026 | SeverityMedium |
|---|
CVE-2026-75157Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression) | Exploitation statusNot exploited | FixYes | Published09/18/2026 | SeverityHigh |
|---|
CVE-2026-59244Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI | Exploitation statusNot exploited | FixYes | Published08/12/2026 | SeverityMedium |
|---|
CVE-2026-58076Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server | Exploitation statusNot exploited | FixYes | Published08/12/2026 | SeverityHigh |
|---|
CVE-2026-59242Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint | Exploitation statusNot exploited | FixYes | Published08/12/2026 | SeverityMedium |
|---|
CVE-2026-54183Apache Airflow: Airflow Variables were not masked in the UI for authenticated users | Exploitation statusNot exploited | FixYes | Published08/12/2026 | SeverityMedium |
|---|
CVE-2026-67260Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization | Exploitation statusNot exploited | FixYes | Published08/12/2026 | SeverityHigh |
|---|
CVE-2026-67587Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget | Exploitation statusNot exploited | FixYes | Published08/12/2026 | SeverityHigh |
|---|
153 Results | Page 1 of 16