You are viewing a plain text version of this content. The canonical link for it is here.
- [ANNOUNCE] Apache Airflow CTL 0.1.4 from 0.1.4rc3 released - posted by Jarek Potiuk <ja...@potiuk.com> on 2026/05/05 19:05:36 UTC, 0 replies.
- CVE-2026-43826: Apache Airflow Providers OpenSearch: OpenSearch task-log handler leaks credentials embedded in the host URL - posted by Shahar Epstein <sh...@apache.org> on 2026/05/10 19:28:36 UTC, 0 replies.
- CVE-2026-41018: Apache Airflow Providers Elasticsearch: Elasticsearch task-log handlers leak credentials embedded in the host URL - posted by Shahar Epstein <sh...@apache.org> on 2026/05/10 19:34:26 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-05-05 are released - posted by "Beck, Vincent" <vi...@amazon.com> on 2026/05/11 17:33:48 UTC, 0 replies.
- Guidance required for migrating Airflow 2.0.0 metadata to Airflow 3.x on AKS - posted by "Guruswamy, Hemanthraj via users" <us...@airflow.apache.org> on 2026/05/15 05:08:23 UTC, 1 replies.
- 💌 Airflow Summit 2026 - Program is ready! 👀 - posted by Teyza Ponce <te...@sg.com.mx> on 2026/05/15 19:10:37 UTC, 0 replies.
- CVE-2026-27173: Apache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line Arguments - posted by Vincent Beck <vi...@apache.org> on 2026/05/19 18:06:00 UTC, 0 replies.
- CVE-2026-42526: Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends - posted by Vincent Beck <vi...@apache.org> on 2026/05/19 18:08:11 UTC, 0 replies.
- 💌 Discover the tracks and book with the Early Bird rate - posted by Teyza Ponce <te...@sg.com.mx> on 2026/05/21 14:00:00 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-05-19 are released - posted by Jens Scheffler <j_...@gmx.de> on 2026/05/23 14:52:37 UTC, 0 replies.
- CVE-2026-45361: Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default) - posted by Jens Scheffler <js...@apache.org> on 2026/05/24 20:12:05 UTC, 0 replies.
- CVE-2026-46745: Apache Airflow FAB provider: [ Security Report ] LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token (ZDRES-223) - posted by Jens Scheffler <js...@apache.org> on 2026/05/24 20:19:46 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-05-25 are released - posted by Jens Scheffler <js...@apache.org> on 2026/05/27 16:55:27 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow 3.2.2 Released - posted by Rahul Vats <ra...@gmail.com> on 2026/05/29 06:13:51 UTC, 0 replies.
- ⏰ Early Bird pricing ends this weekend! - posted by Teyza Ponce <te...@sg.com.mx> on 2026/05/29 15:08:46 UTC, 0 replies.
- CVE-2026-40861: Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 11:35:50 UTC, 0 replies.
- CVE-2026-40961: Apache Airflow: Open Redirect Bypass Vulnerability - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 11:37:43 UTC, 0 replies.
- CVE-2026-40963: Apache Airflow: DAG authorization bypass on /ui/structure/structure_data - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 11:39:07 UTC, 0 replies.
- CVE-2026-41014: Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 11:40:24 UTC, 0 replies.
- CVE-2026-49267: Apache Airflow: No certificate validation on SMTP STARTTLS connections - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 11:42:43 UTC, 0 replies.
- CVE-2026-41017: Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 11:45:13 UTC, 0 replies.
- CVE-2026-41084: Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 11:47:57 UTC, 0 replies.
- CVE-2026-42252: Apache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 11:50:40 UTC, 0 replies.
- CVE-2026-42360: Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 11:54:12 UTC, 0 replies.
- CVE-2026-42358: Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 11:58:45 UTC, 0 replies.
- CVE-2026-42359: Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 12:03:06 UTC, 0 replies.
- CVE-2026-45360: Apache Airflow: Arbitrary import in custom deadline-reference deserialization - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 12:08:58 UTC, 0 replies.
- CVE-2026-45426: Apache Airflow: Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 12:11:30 UTC, 0 replies.
- CVE-2026-46764: Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 12:13:34 UTC, 0 replies.
- CVE-2026-48726: Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 12:17:29 UTC, 0 replies.
- CVE-2026-49298: Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 12:18:33 UTC, 0 replies.