apache-airflow has 43 CVEs on record between 2022 and 2026. Disclosures have slowed: 0 in the last 90 days after 17 in the 90 before. The busiest recent month was June 2026 with 16. The median CVSS is 6.5 (medium), with 5 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 0 prev 17
Worst active — by depth score
CVE-2023-22884Critical· 9.8Command Injection in Apache Airflow and Apache Airflow MySQL Provider68CVE-2022-40189Critical· 9.8OS Command Injection in Apache Airflow55CVE-2022-38649Critical· 9.8OS Command Injection in Apache Airflow55CVE-2026-33264Critical· 9.8A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler /…54CVE-2026-42252Critical· 9.1Apache Airflow vulnerable to Improper Neutralization of Special Elements Used in a Template Engine50
apache-airflow vulnerabilities
CVEs affecting apache-airflow, newest first. Open any entry for full detail, references, and exploit status.
43 CVEsRSS
CVE-2024-50378Medium· 6.5Apache Airflow vulnerable to Insertion of Sensitive Information Into Sent Data
Apache Airflow vulnerable to Insertion of Sensitive Information Into Sent Data
CVE-2024-45498High· 8.8Apache Airflow vulnerable to Improper Encoding or Escaping of Output
Apache Airflow vulnerable to Improper Encoding or Escaping of Output
CVE-2024-45034High· 8.8Apache Airflow vulnerable to Execution with Unnecessary Privileges
Apache Airflow vulnerable to Execution with Unnecessary Privileges
CVE-2024-41937Medium· 6.1Apache Airflow Cross-site Scripting Vulnerability
Apache Airflow Cross-site Scripting Vulnerability
CVE-2024-39863Medium· 5.4Apache Airflow Potential Cross-site Scripting Vulnerability
Apache Airflow Potential Cross-site Scripting Vulnerability
CVE-2024-39877High· 8.8Apache Airflow has DAG Author Code Execution possibility in airflow-scheduler
Apache Airflow has DAG Author Code Execution possibility in airflow-scheduler
CVE-2024-25142LowApache Airflow does not return the "Cache-Control" header for dynamic content
Apache Airflow does not return the "Cache-Control" header for dynamic content
CVE-2024-31869Medium· 4.3Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used
Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used
CVE-2024-29735Medium· 5.3Apache Airflow Improper Preservation of Permissions vulnerability
Apache Airflow Improper Preservation of Permissions vulnerability
CVE-2023-22884Critical· 9.8PoCCommand Injection in Apache Airflow and Apache Airflow MySQL Provider
Command Injection in Apache Airflow and Apache Airflow MySQL Provider
CVE-2022-40189Critical· 9.8OS Command Injection in Apache Airflow
OS Command Injection in Apache Airflow
CVE-2022-38649Critical· 9.8OS Command Injection in Apache Airflow
OS Command Injection in Apache Airflow
CVE-2022-40954Medium· 5.5OS Command Injection in Apache Airflow
OS Command Injection in Apache Airflow