You are viewing a plain text version of this content. The canonical link for it is here.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-08-06 are released - posted by Jarek Potiuk <ja...@potiuk.com> on 2026/08/09 01:03:04 UTC, 0 replies.
- CVE-2026-68872: Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable - posted by Jarek Potiuk <po...@apache.org> on 2026/08/10 16:01:09 UTC, 0 replies.
- CVE-2026-68871: Apache Airflow Yandex provider: yandex Lockbox backend: team-scope guard bypass resolves another team's Connection or Variable - posted by Jarek Potiuk <po...@apache.org> on 2026/08/10 16:01:36 UTC, 0 replies.
- CVE-2026-68870: Apache Airflow Microsoft Azure provider: microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's Connection or Variable - posted by Jarek Potiuk <po...@apache.org> on 2026/08/10 16:03:48 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-08-08 are released - posted by Jarek Potiuk <ja...@potiuk.com> on 2026/08/10 16:31:45 UTC, 0 replies.
- CVE-2026-68868: Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables - posted by Jarek Potiuk <po...@apache.org> on 2026/08/12 08:26:47 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow 3.3.1 Released - posted by Rahul Vats <ra...@gmail.com> on 2026/08/12 09:35:44 UTC, 5 replies.
- CVE-2026-58076: Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server - posted by Rahul Vats <ra...@apache.org> on 2026/08/12 13:22:24 UTC, 0 replies.
- CVE-2026-59244: Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI - posted by Rahul Vats <ra...@apache.org> on 2026/08/12 13:23:58 UTC, 0 replies.
- CVE-2026-59242: Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint - posted by Rahul Vats <ra...@apache.org> on 2026/08/12 13:26:17 UTC, 0 replies.
- CVE-2026-54183: Apache Airflow: Airflow Variables were not masked in the UI for authenticated users - posted by Rahul Vats <ra...@apache.org> on 2026/08/12 13:27:44 UTC, 0 replies.
- CVE-2026-67260: Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization - posted by Rahul Vats <ra...@apache.org> on 2026/08/12 13:43:31 UTC, 0 replies.
- CVE-2026-67587: Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget - posted by Rahul Vats <ra...@apache.org> on 2026/08/12 13:45:53 UTC, 0 replies.
- CVE-2026-65017: Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass) - posted by Rahul Vats <ra...@apache.org> on 2026/08/12 13:48:27 UTC, 0 replies.
- CVE-2026-68968: Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id - posted by Rahul Vats <ra...@apache.org> on 2026/08/12 13:49:21 UTC, 0 replies.
- CVE-2026-68969: Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext - posted by Rahul Vats <ra...@apache.org> on 2026/08/12 13:51:41 UTC, 0 replies.
- CVE-2026-68970: Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI - posted by Rahul Vats <ra...@apache.org> on 2026/08/12 13:52:16 UTC, 0 replies.
- CVE-2026-68971: Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints - posted by Rahul Vats <ra...@apache.org> on 2026/08/12 13:53:06 UTC, 0 replies.
- CVE-2026-68076: Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection - posted by Rahul Vats <ra...@apache.org> on 2026/08/12 13:53:59 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Python Client 3.3.1 Released - posted by Rahul Vats <ra...@gmail.com> on 2026/08/17 11:14:34 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-08-18 are released - posted by Hussein Awala <hu...@awala.fr> on 2026/08/23 20:56:01 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-08-25 are released - posted by Niko Oliveira <on...@apache.org> on 2026/08/30 00:47:15 UTC, 0 replies.