apache-airflow has 43 CVEs on record between 2022 and 2026. Disclosures have slowed: 0 in the last 90 days after 17 in the 90 before. The busiest recent month was June 2026 with 16. The median CVSS is 6.5 (medium), with 5 rated critical. None have a confirmed exploitation report.

CVEs per month

Last 12 months, by publish date

1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10

Exploited share: 0% vs 1% corpus
Median CVSS: 6.5
Publish → KEV: —
Last 90 days: 0 prev 17

Weakness classes

Products

apache-airflow 43

Follow apache-airflow:RSS feed Save a search →Embed badge ↗

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

apache-airflow vulnerabilities

CVEs affecting apache-airflow, newest first. Open any entry for full detail, references, and exploit status.

43 CVEsRSS

CVE-2026-33264Critical· 9.8

3mo ago

A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler /…

A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain…

▾ Midnightapache-airflow · apache-airflowEPSS 1.6%via OSV

CVEs per month

Weakness classes

Products

Worst active — by depth score

apache-airflow vulnerabilities

A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler /…

Apache Airflow has an Incorrect Authorization issue

Apache Airflow has a Missing Authorization issue

Apache Airflow has a Deserialization of Untrusted Data vulnerability

Apache Airflow has an Authorization Bypass Through User-Controlled Key

Apache Airflow Vulnerable to Authorization Bypass Through User-Controlled Key

Apache Airflow has an Improper Authorization issue

Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Apache Airflow vulnerable to Improper Neutralization of Special Elements Used in a Template Engine

Apache Airflow has a Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Apache Airflow has a Link Following issue

Apache Airflow has no certificate validation on SMTP STARTTLS connections

Apache Airflow Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Apache Airflow Vulnerable to Deserialization of Untrusted Data

Apache Airflow: Auth manager doesn't invalidate JWT tokens after users click logout

Apache Airflow: Authenticated users can bypass the `is_safe_url` check

Apache Airflow: Incomplete redaction allowlist exposes secrets in Connection `extra` to read-permitted users

Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions

Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInst…

Apache Airflow: JWT token appearing in logs

Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access

Apache Airflow has an authorization bypass in DagRun wait endpoint

Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange

Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate table

Apache Airflow exposes sensitive information in its log files

Apache Airflow error reporting may expose full kwargs

Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access

Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated Users

Apache Airflow proxy credentials for various providers might leak in task logs

Apache Airflow secrets in rendered templates could contain parts of sensitive values when truncated