You are viewing a plain text version of this content. The canonical link for it is here.
- CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass - posted by Niko Oliveira <on...@apache.org> on 2026/09/08 16:32:21 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-09-09 are released - posted by "Beck, Vincent" <vi...@amazon.com> on 2026/09/14 16:16:49 UTC, 0 replies.
- CVE-2026-86466: Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated - posted by Vincent Beck <vi...@apache.org> on 2026/09/15 18:23:24 UTC, 0 replies.
- CVE-2026-76187: Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT - posted by Vincent Beck <vi...@apache.org> on 2026/09/15 18:25:10 UTC, 0 replies.
- CVE-2026-76186: Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity - posted by Vincent Beck <vi...@apache.org> on 2026/09/15 18:26:40 UTC, 0 replies.
- CVE-2026-82310: Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access - posted by Vincent Beck <vi...@apache.org> on 2026/09/15 18:27:24 UTC, 0 replies.
- CVE-2026-86792: Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration - posted by Vincent Beck <vi...@apache.org> on 2026/09/15 18:28:19 UTC, 0 replies.
- CVE-2026-86462: Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions - posted by Vincent Beck <vi...@apache.org> on 2026/09/15 18:29:07 UTC, 0 replies.
- CVE-2026-82311: Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false - posted by Vincent Beck <vi...@apache.org> on 2026/09/15 18:30:28 UTC, 0 replies.
- CVE-2026-86465: Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key - posted by Vincent Beck <vi...@apache.org> on 2026/09/15 18:31:07 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow 3.3.2 Released - posted by Rahul Vats <ra...@gmail.com> on 2026/09/17 10:23:03 UTC, 0 replies.
- CVE-2026-75157: Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression) - posted by Rahul Vats <ra...@apache.org> on 2026/09/18 04:45:03 UTC, 0 replies.
- CVE-2026-82355: Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation - posted by Rahul Vats <ra...@apache.org> on 2026/09/21 13:22:25 UTC, 0 replies.
- CVE-2026-86473: Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry - posted by Rahul Vats <ra...@apache.org> on 2026/09/21 13:23:02 UTC, 0 replies.
- CVE-2026-75158: Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter - posted by Rahul Vats <ra...@apache.org> on 2026/09/21 13:24:09 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Python Client 3.3.2 Released - posted by Rahul Vats <ra...@gmail.com> on 2026/09/21 14:55:44 UTC, 1 replies.
- CVE-2026-97636: Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key - posted by Jarek Potiuk <po...@apache.org> on 2026/09/24 20:58:58 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-09-22 are released - posted by Shahar Epstein <sh...@gmail.com> on 2026/09/29 08:05:53 UTC, 0 replies.
- CVE-2026-81862: Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs - posted by Shahar Epstein <sh...@apache.org> on 2026/09/29 08:48:46 UTC, 0 replies.
- CVE-2026-81914: Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names - posted by Shahar Epstein <sh...@apache.org> on 2026/09/29 08:49:33 UTC, 0 replies.
- CVE-2026-81930: Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain - posted by Shahar Epstein <sh...@apache.org> on 2026/09/29 08:51:05 UTC, 0 replies.
- CVE-2026-86843: Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag - posted by Shahar Epstein <sh...@apache.org> on 2026/09/29 08:51:32 UTC, 0 replies.