You are viewing a plain text version of this content. The canonical link for it is here.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-06-26 are released - posted by Shahar Epstein <sh...@apache.org> on 2026/07/03 17:02:09 UTC, 0 replies.
- CVE-2026-49297: Apache Airflow Google provider: Path traversal via GCS object names → local/SFTP filesystem (GCSToSFTPOperator + GCSTimeSpanFileTransformOperator) - posted by Shahar Epstein <sh...@apache.org> on 2026/07/04 05:07:49 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-07-01 are released - posted by Shahar Epstein <sh...@apache.org> on 2026/07/04 19:07:20 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow 3.3.0 Released - posted by Rahul Vats <ra...@gmail.com> on 2026/07/06 15:03:03 UTC, 0 replies.
- CVE-2026-33264: Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize() - posted by Rahul Vats <ra...@apache.org> on 2026/07/07 08:19:19 UTC, 0 replies.
- CVE-2026-49487: Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs - posted by Rahul Vats <ra...@apache.org> on 2026/07/07 08:25:46 UTC, 0 replies.
- CVE-2026-48828: Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key - posted by Rahul Vats <ra...@apache.org> on 2026/07/07 08:26:54 UTC, 0 replies.
- CVE-2026-49296: Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id} - posted by Rahul Vats <ra...@apache.org> on 2026/07/07 08:28:19 UTC, 0 replies.
- CVE-2026-48891: Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target - posted by Rahul Vats <ra...@apache.org> on 2026/07/07 08:29:32 UTC, 0 replies.
- CVE-2026-48892: Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options - posted by Rahul Vats <ra...@apache.org> on 2026/07/07 08:31:23 UTC, 0 replies.
- Looking for speakers Austin meetup - posted by Mara Ruvalcaba <ma...@sg.com.mx> on 2026/07/07 19:00:27 UTC, 1 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on are released - posted by "Beck, Vincent" <vi...@amazon.com> on 2026/07/10 17:21:56 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-07-06 are released - posted by "Beck, Vincent" <vi...@amazon.com> on 2026/07/10 17:36:39 UTC, 0 replies.
- CVE-2026-58065: Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key verification - posted by Vincent Beck <vi...@apache.org> on 2026/07/13 14:17:24 UTC, 0 replies.
- CVE-2026-59245: Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision) - posted by Vincent Beck <vi...@apache.org> on 2026/07/13 14:18:49 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Python Client 3.3.0 Released - posted by Rahul Vats <ra...@gmail.com> on 2026/07/14 14:01:00 UTC, 1 replies.
- Airflow 3.3.0: databricks provider fixed in constraints and Docker images (Python 3.11/3.12) - posted by Jarek Potiuk <ja...@potiuk.com> on 2026/07/19 04:00:06 UTC, 0 replies.
- Airflow Summit 2026 Content FAQ - posted by Mara Ruvalcaba <ma...@sg.com.mx> on 2026/07/23 16:32:29 UTC, 1 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-07-22 are released - posted by Shahar Epstein <sh...@apache.org> on 2026/07/28 08:39:47 UTC, 0 replies.
- CVE-2026-59243: Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`) - posted by Shahar Epstein <sh...@apache.org> on 2026/07/28 10:24:07 UTC, 0 replies.