You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@security.apache.org by gi...@apache.org on 2026/10/22 06:48:12 UTC
(security-site) branch asf-site updated: Updated site from main (ede11d2abf8d91176bde5ca522314fa5850d4340)
This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/security-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new 571a2bb9 Updated site from main (ede11d2abf8d91176bde5ca522314fa5850d4340)
571a2bb9 is described below
commit 571a2bb9ef0ec565dcdd38214e97430036e9669d
Author: jenkins <bu...@apache.org>
AuthorDate: Thu Oct 22 06:48:08 2026 +0000
Updated site from main (ede11d2abf8d91176bde5ca522314fa5850d4340)
built by https://ci-builds.apache.org/job/Security/job/site/job/main/
---
blog/credits/index.html | 2 +-
projects/airflow/CVE-2026-86467.cve.json | 113 ++
projects/airflow/CVE-2026-86467.osv.json | 1 +
projects/airflow/index.html | 1618 +++++++++++----------
projects/allura/CVE-2026-92116.cve.json | 95 ++
projects/allura/CVE-2026-92116.osv.json | 1 +
projects/allura/CVE-2026-92119.cve.json | 95 ++
projects/allura/CVE-2026-92119.osv.json | 1 +
projects/allura/CVE-2026-92120.cve.json | 95 ++
projects/allura/CVE-2026-92120.osv.json | 1 +
projects/allura/index.html | 145 +-
projects/answer/CVE-2026-64943.cve.json | 96 ++
projects/answer/CVE-2026-64943.osv.json | 1 +
projects/answer/CVE-2026-64944.cve.json | 96 ++
projects/answer/CVE-2026-64944.osv.json | 1 +
projects/answer/CVE-2026-64945.cve.json | 96 ++
projects/answer/CVE-2026-64945.osv.json | 1 +
projects/answer/CVE-2026-67249.cve.json | 96 ++
projects/answer/CVE-2026-67249.osv.json | 1 +
projects/answer/CVE-2026-68482.cve.json | 96 ++
projects/answer/CVE-2026-68482.osv.json | 1 +
projects/answer/CVE-2026-71563.cve.json | 101 ++
projects/answer/CVE-2026-71563.osv.json | 1 +
projects/answer/CVE-2026-76994.cve.json | 96 ++
projects/answer/CVE-2026-76994.osv.json | 1 +
projects/answer/CVE-2026-79620.cve.json | 96 ++
projects/answer/CVE-2026-79620.osv.json | 1 +
projects/answer/CVE-2026-79624.cve.json | 96 ++
projects/answer/CVE-2026-79624.osv.json | 1 +
projects/answer/CVE-2026-79633.cve.json | 96 ++
projects/answer/CVE-2026-79633.osv.json | 1 +
projects/answer/CVE-2026-86589.cve.json | 96 ++
projects/answer/CVE-2026-86589.osv.json | 1 +
projects/answer/CVE-2026-90910.cve.json | 96 ++
projects/answer/CVE-2026-90910.osv.json | 1 +
projects/answer/index.html | 397 +++--
projects/arrow/CVE-2026-92287.cve.json | 125 ++
projects/arrow/index.html | 53 +-
projects/brpc/CVE-2026-48830.cve.json | 104 ++
projects/brpc/CVE-2026-54425.cve.json | 96 ++
projects/brpc/CVE-2026-54425.osv.json | 1 +
projects/brpc/CVE-2026-54426.cve.json | 96 ++
projects/brpc/CVE-2026-54426.osv.json | 1 +
projects/brpc/CVE-2026-54427.cve.json | 89 ++
projects/brpc/CVE-2026-54427.osv.json | 1 +
projects/brpc/CVE-2026-56386.cve.json | 102 ++
projects/brpc/CVE-2026-56386.osv.json | 1 +
projects/brpc/CVE-2026-56387.cve.json | 107 ++
projects/brpc/CVE-2026-56387.osv.json | 1 +
projects/brpc/CVE-2026-56388.cve.json | 108 ++
projects/brpc/CVE-2026-56388.osv.json | 1 +
projects/brpc/CVE-2026-58064.cve.json | 96 ++
projects/brpc/CVE-2026-58064.osv.json | 1 +
projects/brpc/CVE-2026-61902.cve.json | 96 ++
projects/brpc/CVE-2026-61902.osv.json | 1 +
projects/brpc/CVE-2026-61916.cve.json | 101 ++
projects/brpc/CVE-2026-61916.osv.json | 1 +
projects/brpc/CVE-2026-66392.cve.json | 96 ++
projects/brpc/CVE-2026-66392.osv.json | 1 +
projects/brpc/CVE-2026-74755.cve.json | 96 ++
projects/brpc/CVE-2026-74755.osv.json | 1 +
projects/brpc/CVE-2026-74757.cve.json | 96 ++
projects/brpc/CVE-2026-74757.osv.json | 1 +
projects/brpc/CVE-2026-74758.cve.json | 96 ++
projects/brpc/CVE-2026-74758.osv.json | 1 +
projects/brpc/CVE-2026-78048.cve.json | 96 ++
projects/brpc/CVE-2026-78048.osv.json | 1 +
projects/brpc/CVE-2026-78058.cve.json | 106 ++
projects/brpc/CVE-2026-78058.osv.json | 1 +
projects/brpc/CVE-2026-78066.cve.json | 96 ++
projects/brpc/CVE-2026-78066.osv.json | 1 +
projects/brpc/CVE-2026-78334.cve.json | 96 ++
projects/brpc/CVE-2026-78334.osv.json | 1 +
projects/brpc/CVE-2026-79704.cve.json | 96 ++
projects/brpc/CVE-2026-79704.osv.json | 1 +
projects/brpc/CVE-2026-80463.cve.json | 96 ++
projects/brpc/CVE-2026-80463.osv.json | 1 +
projects/brpc/CVE-2026-81755.cve.json | 96 ++
projects/brpc/CVE-2026-81755.osv.json | 1 +
projects/brpc/CVE-2026-82210.cve.json | 96 ++
projects/brpc/CVE-2026-82210.osv.json | 1 +
projects/brpc/CVE-2026-82230.cve.json | 96 ++
projects/brpc/CVE-2026-82230.osv.json | 1 +
projects/brpc/CVE-2026-82231.cve.json | 96 ++
projects/brpc/CVE-2026-82231.osv.json | 1 +
projects/brpc/CVE-2026-82425.cve.json | 96 ++
projects/brpc/CVE-2026-82425.osv.json | 1 +
projects/brpc/CVE-2026-82942.cve.json | 99 ++
projects/brpc/CVE-2026-82942.osv.json | 1 +
projects/brpc/CVE-2026-82953.cve.json | 99 ++
projects/brpc/CVE-2026-82953.osv.json | 1 +
projects/brpc/CVE-2026-84727.cve.json | 92 ++
projects/brpc/CVE-2026-84727.osv.json | 1 +
projects/brpc/CVE-2026-84747.cve.json | 96 ++
projects/brpc/CVE-2026-84747.osv.json | 1 +
projects/brpc/CVE-2026-84748.cve.json | 96 ++
projects/brpc/CVE-2026-84748.osv.json | 1 +
projects/brpc/CVE-2026-86146.cve.json | 96 ++
projects/brpc/CVE-2026-86146.osv.json | 1 +
projects/brpc/CVE-2026-86147.cve.json | 95 ++
projects/brpc/CVE-2026-86147.osv.json | 1 +
projects/brpc/CVE-2026-86249.cve.json | 93 ++
projects/brpc/CVE-2026-86249.osv.json | 1 +
projects/brpc/CVE-2026-87849.cve.json | 99 ++
projects/brpc/CVE-2026-87849.osv.json | 1 +
projects/brpc/CVE-2026-90484.cve.json | 93 ++
projects/brpc/CVE-2026-90484.osv.json | 1 +
projects/brpc/index.html | 630 +++++++-
projects/camel/CVE-2026-103412.cve.json | 160 ++
projects/camel/CVE-2026-103412.osv.json | 1 +
projects/camel/CVE-2026-103413.cve.json | 160 ++
projects/camel/CVE-2026-103413.osv.json | 1 +
projects/camel/CVE-2026-78162.cve.json | 224 +++
projects/camel/CVE-2026-78163.cve.json | 200 +++
projects/camel/CVE-2026-78164.cve.json | 345 +++++
projects/camel/CVE-2026-78165.cve.json | 195 +++
projects/camel/CVE-2026-79983.cve.json | 195 +++
projects/camel/CVE-2026-79984.cve.json | 195 +++
projects/camel/CVE-2026-79985.cve.json | 195 +++
projects/camel/CVE-2026-79986.cve.json | 195 +++
projects/camel/CVE-2026-80312.cve.json | 188 +++
projects/camel/CVE-2026-80343.cve.json | 188 +++
projects/camel/CVE-2026-80344.cve.json | 188 +++
projects/camel/CVE-2026-83531.cve.json | 186 +++
projects/camel/CVE-2026-83531.osv.json | 1 +
projects/camel/CVE-2026-84176.cve.json | 188 +++
projects/camel/CVE-2026-84178.cve.json | 173 +++
projects/camel/CVE-2026-84178.osv.json | 1 +
projects/camel/CVE-2026-84180.cve.json | 188 +++
projects/camel/CVE-2026-84181.cve.json | 188 +++
projects/camel/CVE-2026-85243.cve.json | 188 +++
projects/camel/CVE-2026-85245.cve.json | 188 +++
projects/camel/CVE-2026-85246.cve.json | 188 +++
projects/camel/CVE-2026-85247.cve.json | 188 +++
projects/camel/CVE-2026-85248.cve.json | 188 +++
projects/camel/CVE-2026-85249.cve.json | 188 +++
projects/camel/CVE-2026-85250.cve.json | 188 +++
projects/camel/CVE-2026-85251.cve.json | 188 +++
projects/camel/CVE-2026-85254.cve.json | 188 +++
projects/camel/CVE-2026-85257.cve.json | 188 +++
projects/camel/CVE-2026-85260.cve.json | 188 +++
projects/camel/CVE-2026-85296.cve.json | 188 +++
projects/camel/CVE-2026-85300.cve.json | 188 +++
projects/camel/CVE-2026-85301.cve.json | 188 +++
projects/camel/CVE-2026-85312.cve.json | 188 +++
projects/camel/CVE-2026-85313.cve.json | 188 +++
projects/camel/CVE-2026-85314.cve.json | 188 +++
projects/camel/CVE-2026-85315.cve.json | 188 +++
projects/camel/CVE-2026-85316.cve.json | 188 +++
projects/camel/CVE-2026-85317.cve.json | 188 +++
projects/camel/CVE-2026-88900.cve.json | 206 +++
projects/camel/CVE-2026-88900.osv.json | 1 +
projects/camel/CVE-2026-88901.cve.json | 173 +++
projects/camel/CVE-2026-88901.osv.json | 1 +
projects/camel/CVE-2026-91858.cve.json | 173 +++
projects/camel/CVE-2026-91858.osv.json | 1 +
projects/camel/index.html | 1613 ++++++++++++++++----
projects/cocoon/CVE-2026-108086.cve.json | 99 ++
projects/cocoon/CVE-2026-108086.osv.json | 1 +
projects/cocoon/CVE-2026-108087.cve.json | 99 ++
projects/cocoon/CVE-2026-108087.osv.json | 1 +
projects/cocoon/CVE-2026-108088.cve.json | 99 ++
projects/cocoon/CVE-2026-108088.osv.json | 1 +
projects/cocoon/CVE-2026-108089.cve.json | 99 ++
projects/cocoon/CVE-2026-108089.osv.json | 1 +
projects/cocoon/index.html | 90 +-
projects/commons/CVE-2026-105111.cve.json | 170 +++
projects/commons/CVE-2026-105111.osv.json | 1 +
projects/commons/CVE-2026-94114.cve.json | 170 +++
projects/commons/CVE-2026-94114.osv.json | 1 +
projects/commons/index.html | 224 +--
projects/couchdb/CVE-2026-107755.cve.json | 122 ++
projects/couchdb/CVE-2026-107755.osv.json | 1 +
projects/couchdb/CVE-2026-86471.cve.json | 101 ++
projects/couchdb/CVE-2026-86471.osv.json | 1 +
projects/couchdb/CVE-2026-90797.cve.json | 108 ++
projects/couchdb/CVE-2026-90797.osv.json | 1 +
projects/couchdb/CVE-2026-90798.cve.json | 122 ++
projects/couchdb/CVE-2026-90798.osv.json | 1 +
projects/couchdb/CVE-2026-90799.cve.json | 108 ++
projects/couchdb/CVE-2026-90799.osv.json | 1 +
projects/couchdb/CVE-2026-90800.cve.json | 108 ++
projects/couchdb/CVE-2026-90800.osv.json | 1 +
projects/couchdb/index.html | 136 +-
projects/cxf/CVE-2026-100227.cve.json | 96 ++
projects/cxf/CVE-2026-100227.osv.json | 1 +
projects/cxf/CVE-2026-107937.cve.json | 96 ++
projects/cxf/CVE-2026-107937.osv.json | 1 +
projects/cxf/CVE-2026-107938.cve.json | 96 ++
projects/cxf/CVE-2026-107938.osv.json | 1 +
projects/cxf/CVE-2026-108039.cve.json | 96 ++
projects/cxf/CVE-2026-108039.osv.json | 1 +
projects/cxf/CVE-2026-71575.cve.json | 110 ++
projects/cxf/CVE-2026-71575.osv.json | 1 +
projects/cxf/CVE-2026-73179.cve.json | 110 ++
projects/cxf/CVE-2026-73179.osv.json | 1 +
projects/cxf/CVE-2026-78384.cve.json | 98 ++
projects/cxf/CVE-2026-78384.osv.json | 1 +
projects/cxf/CVE-2026-79650.cve.json | 110 ++
projects/cxf/CVE-2026-79650.osv.json | 1 +
projects/cxf/CVE-2026-86463.cve.json | 98 ++
projects/cxf/CVE-2026-86463.osv.json | 1 +
projects/cxf/CVE-2026-97468.cve.json | 96 ++
projects/cxf/CVE-2026-97468.osv.json | 1 +
projects/cxf/CVE-2026-97791.cve.json | 96 ++
projects/cxf/CVE-2026-97791.osv.json | 1 +
projects/cxf/index.html | 497 +++++--
projects/datasketches/CVE-2026-103501.cve.json | 112 ++
projects/datasketches/CVE-2026-103501.osv.json | 1 +
projects/datasketches/CVE-2026-103513.cve.json | 117 ++
projects/datasketches/CVE-2026-103513.osv.json | 1 +
projects/datasketches/CVE-2026-103634.cve.json | 117 ++
projects/datasketches/CVE-2026-103634.osv.json | 1 +
projects/datasketches/CVE-2026-103635.cve.json | 117 ++
projects/datasketches/CVE-2026-103635.osv.json | 1 +
projects/datasketches/CVE-2026-103636.cve.json | 117 ++
projects/datasketches/CVE-2026-103636.osv.json | 1 +
projects/datasketches/index.html | 223 +++
projects/datasketches/index.xml | 10 +
projects/dolphinscheduler/CVE-2026-66082.cve.json | 121 ++
projects/dolphinscheduler/CVE-2026-66082.osv.json | 1 +
projects/dolphinscheduler/CVE-2026-66084.cve.json | 116 ++
projects/dolphinscheduler/CVE-2026-66084.osv.json | 1 +
projects/dolphinscheduler/CVE-2026-66087.cve.json | 116 ++
projects/dolphinscheduler/CVE-2026-66087.osv.json | 1 +
projects/dolphinscheduler/CVE-2026-71183.cve.json | 96 ++
projects/dolphinscheduler/CVE-2026-71183.osv.json | 1 +
projects/dolphinscheduler/CVE-2026-71895.cve.json | 104 ++
projects/dolphinscheduler/CVE-2026-71895.osv.json | 1 +
projects/dolphinscheduler/CVE-2026-71896.cve.json | 101 ++
projects/dolphinscheduler/CVE-2026-71896.osv.json | 1 +
projects/dolphinscheduler/index.html | 384 +++--
projects/fesod/CVE-2026-107460.cve.json | 133 ++
projects/fesod/CVE-2026-107460.osv.json | 1 +
projects/fesod/index.html | 24 +
projects/geode/CVE-2026-103371.cve.json | 84 ++
projects/geode/CVE-2026-103371.osv.json | 1 +
projects/geode/index.html | 65 +-
projects/httpd/index.html | 4 +-
projects/impala/CVE-2026-90466.cve.json | 98 ++
projects/impala/CVE-2026-90466.osv.json | 1 +
projects/impala/CVE-2026-93684.cve.json | 95 ++
projects/impala/CVE-2026-93684.osv.json | 1 +
projects/impala/CVE-2026-97720.cve.json | 95 ++
projects/impala/CVE-2026-97720.osv.json | 1 +
projects/impala/index.html | 89 +-
projects/index.html | 4 +-
projects/iotdb/CVE-2026-41114.cve.json | 141 ++
projects/iotdb/CVE-2026-41114.osv.json | 1 +
projects/iotdb/CVE-2026-58663.cve.json | 93 ++
projects/iotdb/CVE-2026-58663.osv.json | 1 +
projects/iotdb/CVE-2026-59229.cve.json | 93 ++
projects/iotdb/CVE-2026-59229.osv.json | 1 +
projects/iotdb/CVE-2026-59562.cve.json | 100 ++
projects/iotdb/CVE-2026-59562.osv.json | 1 +
projects/iotdb/index.html | 317 ++--
projects/jackrabbit/CVE-2026-92414.cve.json | 137 ++
projects/jackrabbit/CVE-2026-92414.osv.json | 1 +
projects/jackrabbit/CVE-2026-92415.cve.json | 137 ++
projects/jackrabbit/CVE-2026-92415.osv.json | 1 +
projects/jackrabbit/index.html | 68 +-
projects/johnzon/CVE-2026-71253.cve.json | 114 ++
projects/johnzon/CVE-2026-71253.osv.json | 1 +
projects/johnzon/index.html | 28 +-
projects/kylin/CVE-2026-108709.cve.json | 86 ++
projects/kylin/CVE-2026-108709.osv.json | 1 +
projects/kylin/CVE-2026-108743.cve.json | 98 ++
projects/kylin/CVE-2026-108743.osv.json | 1 +
projects/kylin/CVE-2026-108762.cve.json | 86 ++
projects/kylin/CVE-2026-108762.osv.json | 1 +
projects/kylin/CVE-2026-108766.cve.json | 91 ++
projects/kylin/CVE-2026-108766.osv.json | 1 +
projects/kylin/CVE-2026-108771.cve.json | 105 ++
projects/kylin/CVE-2026-108771.osv.json | 1 +
projects/kylin/CVE-2026-108776.cve.json | 98 ++
projects/kylin/CVE-2026-108776.osv.json | 1 +
projects/kylin/CVE-2026-108780.cve.json | 86 ++
projects/kylin/CVE-2026-108780.osv.json | 1 +
projects/kylin/CVE-2026-108823.cve.json | 103 ++
projects/kylin/CVE-2026-108823.osv.json | 1 +
projects/kylin/CVE-2026-108833.cve.json | 86 ++
projects/kylin/CVE-2026-108833.osv.json | 1 +
projects/kylin/CVE-2026-108837.cve.json | 98 ++
projects/kylin/CVE-2026-108837.osv.json | 1 +
projects/kylin/CVE-2026-63618.cve.json | 100 ++
projects/kylin/CVE-2026-63618.osv.json | 1 +
projects/kylin/CVE-2026-63619.cve.json | 109 ++
projects/kylin/CVE-2026-63619.osv.json | 1 +
projects/kylin/CVE-2026-64610.cve.json | 95 ++
projects/kylin/CVE-2026-64610.osv.json | 1 +
projects/kylin/CVE-2026-64959.cve.json | 115 ++
projects/kylin/CVE-2026-64959.osv.json | 1 +
projects/kylin/CVE-2026-68571.cve.json | 95 ++
projects/kylin/CVE-2026-68571.osv.json | 1 +
projects/kylin/CVE-2026-68572.cve.json | 95 ++
projects/kylin/CVE-2026-68572.osv.json | 1 +
projects/kylin/CVE-2026-68573.cve.json | 108 ++
projects/kylin/CVE-2026-68573.osv.json | 1 +
projects/kylin/CVE-2026-69076.cve.json | 105 ++
projects/kylin/CVE-2026-69076.osv.json | 1 +
projects/kylin/CVE-2026-69077.cve.json | 95 ++
projects/kylin/CVE-2026-69077.osv.json | 1 +
projects/kylin/CVE-2026-69080.cve.json | 100 ++
projects/kylin/CVE-2026-69080.osv.json | 1 +
projects/kylin/index.html | 508 ++++++-
projects/logging/CVE-2026-105239.cve.json | 156 ++
projects/logging/CVE-2026-105239.osv.json | 1 +
projects/logging/CVE-2026-105240.cve.json | 156 ++
projects/logging/CVE-2026-105240.osv.json | 1 +
projects/logging/CVE-2026-105241.cve.json | 156 ++
projects/logging/CVE-2026-105241.osv.json | 1 +
projects/logging/CVE-2026-105242.cve.json | 156 ++
projects/logging/CVE-2026-105242.osv.json | 1 +
projects/logging/CVE-2026-105243.cve.json | 156 ++
projects/logging/CVE-2026-105243.osv.json | 1 +
projects/logging/CVE-2026-105244.cve.json | 156 ++
projects/logging/CVE-2026-105244.osv.json | 1 +
projects/logging/index.html | 238 ++-
projects/pdfbox/index.html | 61 +-
projects/pulsar/CVE-2026-105869.cve.json | 126 ++
projects/pulsar/CVE-2026-105869.osv.json | 1 +
projects/pulsar/CVE-2026-105926.cve.json | 142 ++
projects/pulsar/CVE-2026-105926.osv.json | 1 +
projects/pulsar/CVE-2026-105927.cve.json | 131 ++
projects/pulsar/CVE-2026-105927.osv.json | 1 +
projects/pulsar/CVE-2026-105930.cve.json | 132 ++
projects/pulsar/CVE-2026-105930.osv.json | 1 +
projects/pulsar/CVE-2026-105931.cve.json | 151 ++
projects/pulsar/CVE-2026-105931.osv.json | 1 +
projects/pulsar/CVE-2026-105932.cve.json | 151 ++
projects/pulsar/CVE-2026-105932.osv.json | 1 +
projects/pulsar/CVE-2026-105933.cve.json | 126 ++
projects/pulsar/CVE-2026-105933.osv.json | 1 +
projects/pulsar/CVE-2026-105934.cve.json | 136 ++
projects/pulsar/CVE-2026-105934.osv.json | 1 +
projects/pulsar/CVE-2026-105935.cve.json | 126 ++
projects/pulsar/CVE-2026-105935.osv.json | 1 +
projects/pulsar/CVE-2026-105936.cve.json | 136 ++
projects/pulsar/CVE-2026-105936.osv.json | 1 +
projects/pulsar/CVE-2026-105937.cve.json | 136 ++
projects/pulsar/CVE-2026-105937.osv.json | 1 +
projects/pulsar/CVE-2026-105938.cve.json | 126 ++
projects/pulsar/CVE-2026-105938.osv.json | 1 +
projects/pulsar/CVE-2026-105942.cve.json | 119 ++
projects/pulsar/CVE-2026-105942.osv.json | 1 +
projects/pulsar/CVE-2026-105944.cve.json | 128 ++
projects/pulsar/CVE-2026-105944.osv.json | 1 +
projects/pulsar/CVE-2026-105945.cve.json | 131 ++
projects/pulsar/CVE-2026-105945.osv.json | 1 +
projects/pulsar/index.html | 454 +++++-
projects/skywalking/CVE-2026-85499.cve.json | 96 ++
projects/skywalking/CVE-2026-85499.osv.json | 1 +
projects/skywalking/index.html | 71 +-
projects/tomcat/CVE-2026-101296.cve.json | 119 ++
projects/tomcat/CVE-2026-101296.osv.json | 1 +
projects/tomcat/CVE-2026-101356.cve.json | 98 ++
projects/tomcat/CVE-2026-101356.osv.json | 1 +
projects/tomcat/CVE-2026-103119.cve.json | 95 ++
projects/tomcat/CVE-2026-103119.osv.json | 1 +
projects/tomcat/CVE-2026-74048.cve.json | 107 ++
projects/tomcat/CVE-2026-74048.osv.json | 1 +
projects/tomcat/CVE-2026-74049.cve.json | 119 ++
projects/tomcat/CVE-2026-74049.osv.json | 1 +
projects/tomcat/CVE-2026-80353.cve.json | 95 ++
projects/tomcat/CVE-2026-80353.osv.json | 1 +
projects/tomcat/CVE-2026-88041.cve.json | 107 ++
projects/tomcat/CVE-2026-88041.osv.json | 1 +
projects/tomcat/CVE-2026-93446.cve.json | 107 ++
projects/tomcat/CVE-2026-93446.osv.json | 1 +
projects/tomcat/index.html | 925 +++++++-----
projects/trafficserver/CVE-2025-31699.cve.json | 173 +++
projects/trafficserver/CVE-2025-31699.osv.json | 1 +
projects/trafficserver/CVE-2025-55702.cve.json | 168 +++
projects/trafficserver/CVE-2025-55702.osv.json | 1 +
projects/trafficserver/CVE-2026-111804.cve.json | 161 ++
projects/trafficserver/CVE-2026-111804.osv.json | 1 +
projects/trafficserver/CVE-2026-111805.cve.json | 193 +++
projects/trafficserver/CVE-2026-111805.osv.json | 1 +
projects/trafficserver/CVE-2026-111808.cve.json | 173 +++
projects/trafficserver/CVE-2026-111808.osv.json | 1 +
projects/trafficserver/CVE-2026-111809.cve.json | 168 +++
projects/trafficserver/CVE-2026-111809.osv.json | 1 +
projects/trafficserver/CVE-2026-111810.cve.json | 160 ++
projects/trafficserver/CVE-2026-111810.osv.json | 1 +
projects/trafficserver/CVE-2026-111811.cve.json | 168 +++
projects/trafficserver/CVE-2026-111811.osv.json | 1 +
projects/trafficserver/CVE-2026-111812.cve.json | 168 +++
projects/trafficserver/CVE-2026-111812.osv.json | 1 +
projects/trafficserver/CVE-2026-111813.cve.json | 178 +++
projects/trafficserver/CVE-2026-111813.osv.json | 1 +
projects/trafficserver/CVE-2026-111814.cve.json | 162 +++
projects/trafficserver/CVE-2026-111814.osv.json | 1 +
projects/trafficserver/CVE-2026-111815.cve.json | 168 +++
projects/trafficserver/CVE-2026-111815.osv.json | 1 +
projects/trafficserver/CVE-2026-111816.cve.json | 173 +++
projects/trafficserver/CVE-2026-111816.osv.json | 1 +
projects/trafficserver/CVE-2026-111817.cve.json | 167 +++
projects/trafficserver/CVE-2026-111817.osv.json | 1 +
projects/trafficserver/CVE-2026-112381.cve.json | 160 ++
projects/trafficserver/CVE-2026-112381.osv.json | 1 +
projects/trafficserver/index.html | 668 ++++++---
projects/xmlgraphics/index.html | 4 +-
projects/yunikorn/CVE-2026-78243.cve.json | 119 ++
projects/yunikorn/CVE-2026-78243.osv.json | 1 +
projects/yunikorn/CVE-2026-92393.cve.json | 107 ++
projects/yunikorn/CVE-2026-92393.osv.json | 1 +
projects/yunikorn/CVE-2026-97146.cve.json | 107 ++
projects/yunikorn/CVE-2026-97146.osv.json | 1 +
projects/yunikorn/index.html | 180 +++
projects/yunikorn/index.xml | 10 +
sitemap.xml | 4 +
411 files changed, 33984 insertions(+), 2641 deletions(-)
diff --git a/blog/credits/index.html b/blog/credits/index.html
index 6fb751eb..8ef8d978 100644
--- a/blog/credits/index.html
+++ b/blog/credits/index.html
@@ -132,7 +132,7 @@ for a CVE, as downstream users do not need to take any action,
so they do not need to be notified.</p>
<p>Still, as a token of our appreciation, we’d like to thank a number of such reporters here:</p>
<ul>
-<li><a href="https://github.com/bugmithlegend">bugmithlegend</a> and Davi Johns for reporting issues with Beam’s metrics permissioning</li>
+<li><a href="https://github.com/bugmithlegend">bugmithlegend</a> and <a href="https://www.linkedin.com/in/maulik-mehta-root?utm_source=share_via&utm_content=profile&utm_medium=member_android">Maulik Mehta</a> for reporting issues with Beam’s metrics permissioning</li>
<li><a href="https://www.binarly.io/research">BINARLY REsearch team</a> for notifying us of leaked GitHub tokens.</li>
<li><a href="https://www.linkedin.com/in/sahar042/">Sahar Shlichove</a>, JFrog for notifying us of a leaked 3rd-party service token.</li>
<li><a href="https://www.linkedin.com/in/naveens72/">Naveen S</a> and <a href="https://www.linkedin.com/in/ajmalmoochingal/">M Ajmal</a> for notifying us of a leaked GitHub token.</li>
diff --git a/projects/airflow/CVE-2026-86467.cve.json b/projects/airflow/CVE-2026-86467.cve.json
new file mode 100644
index 00000000..0a38f8bb
--- /dev/null
+++ b/projects/airflow/CVE-2026-86467.cve.json
@@ -0,0 +1,113 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:pypi/apache-airflow-providers-amazon",
+ "product": "Apache Airflow Amazon provider",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThan": "9.38.0",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Andrew Rukin (Arenadata)"
+ },
+ {
+ "lang": "en",
+ "type": "remediation developer",
+ "value": "Jarek Potiuk"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated attacker who can cause a victim to load a page can complete a SAML login in the victim's browser using the attacker's own assertion, silently logging the victim into the at [...]
+ }
+ ],
+ "value": "Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated attacker who can cause a victim to load a page can complete a SAML login in the victim's browser using the attacker's own assertion, silently logging the victim into the attack [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "moderate"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-352",
+ "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "patch"
+ ],
+ "url": "https://github.com/apache/airflow/pull/73698"
+ },
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/xr9d2jyk9qpglsmromt6vjl4s9jb5qn8"
+ },
+ {
+ "tags": [
+ "related"
+ ],
+ "url": "https://www.cve.org/CVERecord?id=CVE-2026-40948"
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "title": "AWS auth manager: SAML login CSRF logs users into the attacker's account",
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-86467",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-86467.osv.json b/projects/airflow/CVE-2026-86467.osv.json
new file mode 100644
index 00000000..cf6b66e5
--- /dev/null
+++ b/projects/airflow/CVE-2026-86467.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-86467", "summary": "AWS auth manager: SAML login CSRF logs users into the attacker's account", "details": "Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated attacker who can cause a victim to load a pag [...]
\ No newline at end of file
diff --git a/projects/airflow/index.html b/projects/airflow/index.html
index a2621d48..bc2dc048 100644
--- a/projects/airflow/index.html
+++ b/projects/airflow/index.html
@@ -271,23 +271,43 @@
<li>OpenSec Intelligence (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
</ul>
+<h2 id="CVE-2026-86467">AWS auth manager: SAML login CSRF logs users into the attacker’s account</h2>
+<p>CVE-2026-86467 <a href="https://cve.org/CVERecord?id=CVE-2026-86467">[CVE]</a> <a href="./CVE-2026-86467.cve.json">[CVE json]</a> <a href="./CVE-2026-86467.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-10-20T02:37:06.110Z</em></p>
+<h3 id="affected-8">Affected</h3>
+<ul>
+<li>Apache Airflow Amazon provider before 9.38.0</li>
+</ul>
+<h3 id="description-8">Description</h3>
+<p>Apache Airflow Amazon provider: the AWS auth manager’s SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated attacker who can cause a victim to load a page can complete a SAML login in the victim’s browser using the attacker’s own assertion, silently logging the victim into the attac [...]
+<h3 id="references-8">References</h3>
+<ul>
+<li><a href="https://github.com/apache/airflow/pull/73698">https://github.com/apache/airflow/pull/73698</a></li>
+<li><a href="https://lists.apache.org/thread/xr9d2jyk9qpglsmromt6vjl4s9jb5qn8">https://lists.apache.org/thread/xr9d2jyk9qpglsmromt6vjl4s9jb5qn8</a></li>
+<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-40948">https://www.cve.org/CVERecord?id=CVE-2026-40948</a></li>
+</ul>
+<h3 id="credits-8">Credits</h3>
+<ul>
+<li>Andrew Rukin (Arenadata) (finder)</li>
+<li>Jarek Potiuk (remediation developer)</li>
+</ul>
<h2 id="CVE-2026-86466">FAB Authentik provider: id_token issuer/audience not validated</h2>
<p>CVE-2026-86466 <a href="https://cve.org/CVERecord?id=CVE-2026-86466">[CVE]</a> <a href="./CVE-2026-86466.cve.json">[CVE json]</a> <a href="./CVE-2026-86466.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:44:32.186Z</em></p>
-<h3 id="affected-8">Affected</h3>
+<h3 id="affected-9">Affected</h3>
<ul>
<li>Apache Airflow FAB provider before 3.9.0</li>
</ul>
-<h3 id="description-8">Description</h3>
+<h3 id="description-9">Description</h3>
<p>Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be authenticated as the user it names, because the audience claim is never checked. Affects deployments using the FAB auth manager with Authentik OAuth where the same Authentik instance also se [...]
-<h3 id="references-8">References</h3>
+<h3 id="references-9">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/72645">https://github.com/apache/airflow/pull/72645</a></li>
<li><a href="https://lists.apache.org/thread/qh7fobs16p2hgln2yblbgf8ty4dvf4y7?users@airflow.apache.org">https://lists.apache.org/thread/qh7fobs16p2hgln2yblbgf8ty4dvf4y7?users@airflow.apache.org</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-75156">https://www.cve.org/CVERecord?id=CVE-2026-75156</a></li>
<li><a href="https://lists.apache.org/thread/qh7fobs16p2hgln2yblbgf8ty4dvf4y7">https://lists.apache.org/thread/qh7fobs16p2hgln2yblbgf8ty4dvf4y7</a></li>
</ul>
-<h3 id="credits-8">Credits</h3>
+<h3 id="credits-9">Credits</h3>
<ul>
<li>Ritik Chaddha & NEO by ProjectDiscovery (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -295,13 +315,13 @@
<h2 id="CVE-2026-86465">Akeyless secrets backend: team-scope guard bypass via user-controlled key</h2>
<p>CVE-2026-86465 <a href="https://cve.org/CVERecord?id=CVE-2026-86465">[CVE]</a> <a href="./CVE-2026-86465.cve.json">[CVE json]</a> <a href="./CVE-2026-86465.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:44:31.052Z</em></p>
-<h3 id="affected-9">Affected</h3>
+<h3 id="affected-10">Affected</h3>
<ul>
<li>Apache Airflow Akeyless provider before 0.3.1</li>
</ul>
-<h3 id="description-9">Description</h3>
+<h3 id="description-10">Description</h3>
<p>Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret belonging to a different team, because the lookup path is concatenated from an unvalidated key after the team-scoped lookup misses. The Execution API Variables route accepts a path-shaped key, so this is r [...]
-<h3 id="references-9">References</h3>
+<h3 id="references-10">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/72646">https://github.com/apache/airflow/pull/72646</a></li>
<li><a href="https://lists.apache.org/thread/vczt5xgqjv8ot8fpp1vdq3rmnfm50w0g?users@airflow.apache.org">https://lists.apache.org/thread/vczt5xgqjv8ot8fpp1vdq3rmnfm50w0g?users@airflow.apache.org</a></li>
@@ -310,7 +330,7 @@
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-68872">https://www.cve.org/CVERecord?id=CVE-2026-68872</a></li>
<li><a href="https://lists.apache.org/thread/vczt5xgqjv8ot8fpp1vdq3rmnfm50w0g">https://lists.apache.org/thread/vczt5xgqjv8ot8fpp1vdq3rmnfm50w0g</a></li>
</ul>
-<h3 id="credits-9">Credits</h3>
+<h3 id="credits-10">Credits</h3>
<ul>
<li>ReturnZero (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -318,20 +338,20 @@
<h2 id="CVE-2026-86462">FAB Admin password PATCH does not invalidate database-backed sessions</h2>
<p>CVE-2026-86462 <a href="https://cve.org/CVERecord?id=CVE-2026-86462">[CVE]</a> <a href="./CVE-2026-86462.cve.json">[CVE json]</a> <a href="./CVE-2026-86462.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:44:29.995Z</em></p>
-<h3 id="affected-10">Affected</h3>
+<h3 id="affected-11">Affected</h3>
<ul>
<li>Apache Airflow FAB provider from 3.2.0 before 3.9.0</li>
</ul>
-<h3 id="description-10">Description</h3>
+<h3 id="description-11">Description</h3>
<p>Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that user after the password change, so the password reset does not evict them. Affects deployments using the FAB auth manager with database-backed sessions; an administrator (or the user themselves) performing a routine password chan [...]
-<h3 id="references-10">References</h3>
+<h3 id="references-11">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/72657">https://github.com/apache/airflow/pull/72657</a></li>
<li><a href="https://lists.apache.org/thread/7sr4sggfv5fhhl3qgphcq0rlhg81do1s?users@airflow.apache.org">https://lists.apache.org/thread/7sr4sggfv5fhhl3qgphcq0rlhg81do1s?users@airflow.apache.org</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-82311">https://www.cve.org/CVERecord?id=CVE-2026-82311</a></li>
<li><a href="https://lists.apache.org/thread/7sr4sggfv5fhhl3qgphcq0rlhg81do1s">https://lists.apache.org/thread/7sr4sggfv5fhhl3qgphcq0rlhg81do1s</a></li>
</ul>
-<h3 id="credits-10">Credits</h3>
+<h3 id="credits-11">Credits</h3>
<ul>
<li>OpenSec Intelligence (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -339,19 +359,19 @@
<h2 id="CVE-2026-82355">Session cookie silently overrides explicit Authorization bearer header, enabling session fixation</h2>
<p>CVE-2026-82355 <a href="https://cve.org/CVERecord?id=CVE-2026-82355">[CVE]</a> <a href="./CVE-2026-82355.cve.json">[CVE json]</a> <a href="./CVE-2026-82355.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-21T14:32:02.334Z</em></p>
-<h3 id="affected-11">Affected</h3>
+<h3 id="affected-12">Affected</h3>
<ul>
<li>Apache Airflow from 3.3.0 before 3.3.2</li>
</ul>
-<h3 id="description-11">Description</h3>
+<h3 id="description-12">Description</h3>
<p>When a request to the Airflow core API carries both a session cookie and an explicit <code>Authorization: Bearer</code> token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes – and is recorded in the audit log – as the cookie’s principal rather than the identity the client explicitly presented.<br><br>Only Apache Airflow 3.3.0 and 3.3.1 are affected. Earlier r [...]
-<h3 id="references-11">References</h3>
+<h3 id="references-12">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/72225">https://github.com/apache/airflow/pull/72225</a></li>
<li><a href="https://github.com/apache/airflow/pull/72723">https://github.com/apache/airflow/pull/72723</a></li>
<li><a href="https://lists.apache.org/thread/3p7zpdvv40tn01m0xk5mt2rxg88mw8w1">https://lists.apache.org/thread/3p7zpdvv40tn01m0xk5mt2rxg88mw8w1</a></li>
</ul>
-<h3 id="credits-11">Credits</h3>
+<h3 id="credits-12">Credits</h3>
<ul>
<li>Claude Security Scans (tool)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -359,20 +379,20 @@
<h2 id="CVE-2026-82311">FAB password reset never invalidates sessions: string/int _user_id comparison is always false</h2>
<p>CVE-2026-82311 <a href="https://cve.org/CVERecord?id=CVE-2026-82311">[CVE]</a> <a href="./CVE-2026-82311.cve.json">[CVE json]</a> <a href="./CVE-2026-82311.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:44:28.944Z</em></p>
-<h3 id="affected-12">Affected</h3>
+<h3 id="affected-13">Affected</h3>
<ul>
<li>Apache Airflow FAB provider from 2.4.2 before 3.9.0</li>
</ul>
-<h3 id="description-12">Description</h3>
+<h3 id="description-13">Description</h3>
<p>Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the comparison never matches and no session is removed. An attacker who already holds a copy of the victim's session cookie keeps access as that user after the password change, so the reset does not [...]
-<h3 id="references-12">References</h3>
+<h3 id="references-13">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/72198">https://github.com/apache/airflow/pull/72198</a></li>
<li><a href="https://lists.apache.org/thread/mmplwl93shy615shkpp9p4fzyjvr4yqw?users@airflow.apache.org">https://lists.apache.org/thread/mmplwl93shy615shkpp9p4fzyjvr4yqw?users@airflow.apache.org</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-86462">https://www.cve.org/CVERecord?id=CVE-2026-86462</a></li>
<li><a href="https://lists.apache.org/thread/mmplwl93shy615shkpp9p4fzyjvr4yqw">https://lists.apache.org/thread/mmplwl93shy615shkpp9p4fzyjvr4yqw</a></li>
</ul>
-<h3 id="credits-12">Credits</h3>
+<h3 id="credits-13">Credits</h3>
<ul>
<li>Mayank Jangid (OpenSec) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -380,19 +400,19 @@
<h2 id="CVE-2026-82310">FAB auth manager: deactivated users retain and renew Core API JWT access</h2>
<p>CVE-2026-82310 <a href="https://cve.org/CVERecord?id=CVE-2026-82310">[CVE]</a> <a href="./CVE-2026-82310.cve.json">[CVE json]</a> <a href="./CVE-2026-82310.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:44:27.846Z</em></p>
-<h3 id="affected-13">Affected</h3>
+<h3 id="affected-14">Affected</h3>
<ul>
<li>Apache Airflow FAB provider from 2.0.0 before 3.9.0</li>
</ul>
-<h3 id="description-13">Description</h3>
+<h3 id="description-14">Description</h3>
<p>Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a replacement — so the account keeps its role-scoped access indefinitely after an administrator has disabled it. The user replays their own legitimate credential; no signature forgery or privilege esca [...]
-<h3 id="references-13">References</h3>
+<h3 id="references-14">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/72199">https://github.com/apache/airflow/pull/72199</a></li>
<li><a href="https://lists.apache.org/thread/85h9r50bmy8vgkgr5nyddryj1p5pxxy2?users@airflow.apache.org">https://lists.apache.org/thread/85h9r50bmy8vgkgr5nyddryj1p5pxxy2?users@airflow.apache.org</a></li>
<li><a href="https://lists.apache.org/thread/85h9r50bmy8vgkgr5nyddryj1p5pxxy2">https://lists.apache.org/thread/85h9r50bmy8vgkgr5nyddryj1p5pxxy2</a></li>
</ul>
-<h3 id="credits-13">Credits</h3>
+<h3 id="credits-14">Credits</h3>
<ul>
<li>Mayank Jangid (OpenSec) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -400,18 +420,18 @@
<h2 id="CVE-2026-81930">Unvalidated account field redirects SQL API bearer token off-domain</h2>
<p>CVE-2026-81930 <a href="https://cve.org/CVERecord?id=CVE-2026-81930">[CVE]</a> <a href="./CVE-2026-81930.cve.json">[CVE json]</a> <a href="./CVE-2026-81930.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-29T08:57:17.400Z</em></p>
-<h3 id="affected-14">Affected</h3>
+<h3 id="affected-15">Affected</h3>
<ul>
<li>Apache Airflow Snowflake provider before 6.18.0</li>
</ul>
-<h3 id="description-14">Description</h3>
+<h3 id="description-15">Description</h3>
<p>Apache Airflow's Snowflake provider did not validate the connection's <code>account</code> and <code>region</code> fields before interpolating them into request URLs. The SQL API endpoint is built as <code>https://{account}.snowflakecomputing.com/api/v2/statements</code>, so an <code>account</code> value containing <code>/</code>, <code>?</code> or <code>#</code> demotes the intended domain to a path, query or fragment and leaves the attacker in control of the request host.<br><br>The [...]
-<h3 id="references-14">References</h3>
+<h3 id="references-15">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/72174">https://github.com/apache/airflow/pull/72174</a></li>
<li><a href="https://lists.apache.org/thread/324jm2mxd5x4nq85jfw1ostz94xwzrmk">https://lists.apache.org/thread/324jm2mxd5x4nq85jfw1ostz94xwzrmk</a></li>
</ul>
-<h3 id="credits-14">Credits</h3>
+<h3 id="credits-15">Credits</h3>
<ul>
<li>Claude Security Scans (tool)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -419,18 +439,18 @@
<h2 id="CVE-2026-81914">Google Drive query injection via unescaped file and folder names</h2>
<p>CVE-2026-81914 <a href="https://cve.org/CVERecord?id=CVE-2026-81914">[CVE]</a> <a href="./CVE-2026-81914.cve.json">[CVE json]</a> <a href="./CVE-2026-81914.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-29T08:57:15.653Z</em></p>
-<h3 id="affected-15">Affected</h3>
+<h3 id="affected-16">Affected</h3>
<ul>
<li>Apache Airflow Google provider before 22.6.0</li>
</ul>
-<h3 id="description-15">Description</h3>
+<h3 id="description-16">Description</h3>
<p>Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended clauses of the attacker's choosing to the query.<br><br>The names are frequently not written by the Dag author. In a wildcard <code>gcs_to_gdrive</code> transfer they come from the source bucke [...]
-<h3 id="references-15">References</h3>
+<h3 id="references-16">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/72166">https://github.com/apache/airflow/pull/72166</a></li>
<li><a href="https://lists.apache.org/thread/90osv795jrqds051y7v3lcdzhsospooo">https://lists.apache.org/thread/90osv795jrqds051y7v3lcdzhsospooo</a></li>
</ul>
-<h3 id="credits-15">Credits</h3>
+<h3 id="credits-16">Credits</h3>
<ul>
<li>Claude Security Scans (tool)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -438,18 +458,18 @@
<h2 id="CVE-2026-81862">Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs</h2>
<p>CVE-2026-81862 <a href="https://cve.org/CVERecord?id=CVE-2026-81862">[CVE]</a> <a href="./CVE-2026-81862.cve.json">[CVE json]</a> <a href="./CVE-2026-81862.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-29T08:57:13.929Z</em></p>
-<h3 id="affected-16">Affected</h3>
+<h3 id="affected-17">Affected</h3>
<ul>
<li>Apache Airflow Teradata provider before 3.7.0</li>
</ul>
-<h3 id="description-16">Description</h3>
+<h3 id="description-17">Description</h3>
<p>Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. <code>S3ToTeradataOperator</code> and <code>AzureBlobStorageToTeradataOperator</code> interpolate the source bucket's credentials as plain string literals into the <code>CREATE MULTISET TABLE ... LOCATION</code> statement whenever the bucket is private and no <code>teradata_authorization_name</code> is configured — which is the default credential path for both operators. The statement i [...]
-<h3 id="references-16">References</h3>
+<h3 id="references-17">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/72176">https://github.com/apache/airflow/pull/72176</a></li>
<li><a href="https://lists.apache.org/thread/0vfpoh6l8gz0dpbc9z50dmkc3z07o83l">https://lists.apache.org/thread/0vfpoh6l8gz0dpbc9z50dmkc3z07o83l</a></li>
</ul>
-<h3 id="credits-16">Credits</h3>
+<h3 id="credits-17">Credits</h3>
<ul>
<li>Claude Security Scans (tool)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -457,19 +477,19 @@
<h2 id="CVE-2026-76187">Any realm client’s credentials mint an Airflow session JWT</h2>
<p>CVE-2026-76187 <a href="https://cve.org/CVERecord?id=CVE-2026-76187">[CVE]</a> <a href="./CVE-2026-76187.cve.json">[CVE json]</a> <a href="./CVE-2026-76187.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:44:25.736Z</em></p>
-<h3 id="affected-17">Affected</h3>
+<h3 id="affected-18">Affected</h3>
<ul>
<li>Apache Airflow Keycloak provider before 0.10.0</li>
</ul>
-<h3 id="description-17">Description</h3>
+<h3 id="description-18">Description</h3>
<p>Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so the credentials of an unrelated application that happens to share the realm are valid Airflow login credentials, and Airflow mints a signed session token for that application's service account. The endpoint also answer [...]
-<h3 id="references-17">References</h3>
+<h3 id="references-18">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/72205">https://github.com/apache/airflow/pull/72205</a></li>
<li><a href="https://lists.apache.org/thread/j1b9ddljxphqvoc41z7gthj4zh34vmlw?users@airflow.apache.org">https://lists.apache.org/thread/j1b9ddljxphqvoc41z7gthj4zh34vmlw?users@airflow.apache.org</a></li>
<li><a href="https://lists.apache.org/thread/5cqh5ojl3718ogb0q1dcd9vdr47z7gp3">https://lists.apache.org/thread/5cqh5ojl3718ogb0q1dcd9vdr47z7gp3</a></li>
</ul>
-<h3 id="credits-17">Credits</h3>
+<h3 id="credits-18">Credits</h3>
<ul>
<li>Claude Security Scans (tool)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -477,19 +497,19 @@
<h2 id="CVE-2026-76186">Keycloak token cookies not bound to Airflow session identity</h2>
<p>CVE-2026-76186 <a href="https://cve.org/CVERecord?id=CVE-2026-76186">[CVE]</a> <a href="./CVE-2026-76186.cve.json">[CVE json]</a> <a href="./CVE-2026-76186.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:44:19.051Z</em></p>
-<h3 id="affected-18">Affected</h3>
+<h3 id="affected-19">Affected</h3>
<ul>
<li>Apache Airflow Keycloak provider before 0.10.0</li>
</ul>
-<h3 id="description-18">Description</h3>
+<h3 id="description-19">Description</h3>
<p>Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated cookies, and never checks that the two describe the same subject. A user who holds any valid Airflow login of their own, together with another subject's Keycloak access or refresh token obtained out of band, can pair the two: Airflo [...]
-<h3 id="references-18">References</h3>
+<h3 id="references-19">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/72207">https://github.com/apache/airflow/pull/72207</a></li>
<li><a href="https://lists.apache.org/thread/5cqh5ojl3718ogb0q1dcd9vdr47z7gp3?users@airflow.apache.org">https://lists.apache.org/thread/5cqh5ojl3718ogb0q1dcd9vdr47z7gp3?users@airflow.apache.org</a></li>
<li><a href="https://lists.apache.org/thread/5cqh5ojl3718ogb0q1dcd9vdr47z7gp3">https://lists.apache.org/thread/5cqh5ojl3718ogb0q1dcd9vdr47z7gp3</a></li>
</ul>
-<h3 id="credits-18">Credits</h3>
+<h3 id="credits-19">Credits</h3>
<ul>
<li>Claude Security Scans (tool)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -497,18 +517,18 @@
<h2 id="CVE-2026-75158">Assets events API returns asset events for every Dag with no per-Dag authorization filter</h2>
<p>CVE-2026-75158 <a href="https://cve.org/CVERecord?id=CVE-2026-75158">[CVE]</a> <a href="./CVE-2026-75158.cve.json">[CVE json]</a> <a href="./CVE-2026-75158.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-21T14:32:46.741Z</em></p>
-<h3 id="affected-19">Affected</h3>
+<h3 id="affected-20">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.2</li>
</ul>
-<h3 id="description-19">Description</h3>
+<h3 id="description-20">Description</h3>
<p>Apache Airflow’s <code>/assets/events</code> API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events — including the source Dag ID, task ID, run ID and event timestamps — for Dags they have no permission to see. Because the filter was also absent from the count query, <code>total_entries</code> and pagination dis [...]
-<h3 id="references-19">References</h3>
+<h3 id="references-20">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/71741">https://github.com/apache/airflow/pull/71741</a></li>
<li><a href="https://lists.apache.org/thread/rx5lg86l0qkjl2s7dtmpqxjq0xplr4fy">https://lists.apache.org/thread/rx5lg86l0qkjl2s7dtmpqxjq0xplr4fy</a></li>
</ul>
-<h3 id="credits-19">Credits</h3>
+<h3 id="credits-20">Credits</h3>
<ul>
<li>n0mi1k (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -516,18 +536,18 @@
<h2 id="CVE-2026-75157">Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)</h2>
<p>CVE-2026-75157 <a href="https://cve.org/CVERecord?id=CVE-2026-75157">[CVE]</a> <a href="./CVE-2026-75157.cve.json">[CVE json]</a> <a href="./CVE-2026-75157.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-18T07:51:21.855Z</em></p>
-<h3 id="affected-20">Affected</h3>
+<h3 id="affected-21">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.2</li>
</ul>
-<h3 id="description-20">Description</h3>
+<h3 id="description-21">Description</h3>
<p>Apache Airflow’s asset queued-events DELETE endpoints checked the caller’s Dag-axis permission with <code>READ</code> instead of <code>EDIT</code>. Any authenticated user who could read a Dag could therefore delete that Dag’s queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing action gated on a read-only permission. Deployments are affected whenever asset-triggered scheduling is in use and Dag read access is granted more wid [...]
-<h3 id="references-20">References</h3>
+<h3 id="references-21">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/71736">https://github.com/apache/airflow/pull/71736</a></li>
<li><a href="https://lists.apache.org/thread/f2ngj296z48b3x14ss3pgbs41lbnlgmp">https://lists.apache.org/thread/f2ngj296z48b3x14ss3pgbs41lbnlgmp</a></li>
</ul>
-<h3 id="credits-20">Credits</h3>
+<h3 id="credits-21">Credits</h3>
<ul>
<li>n0mi1k (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -535,19 +555,19 @@
<h2 id="CVE-2026-75156">FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass</h2>
<p>CVE-2026-75156 <a href="https://cve.org/CVERecord?id=CVE-2026-75156">[CVE]</a> <a href="./CVE-2026-75156.cve.json">[CVE json]</a> <a href="./CVE-2026-75156.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:46:22.794Z</em></p>
-<h3 id="affected-21">Affected</h3>
+<h3 id="affected-22">Affected</h3>
<ul>
<li>Apache Airflow FAB provider from 3.7.3 before 3.8.1</li>
</ul>
-<h3 id="description-21">Description</h3>
+<h3 id="description-22">Description</h3>
<p>Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD <code>id_token</code>s during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's <strong>multi-tenant</strong> JWKS endpoint, an <code>id_token</code> minted in <em>any</em> Azure tenant — including one the attacker creates — passes signature verification, an [...]
-<h3 id="references-21">References</h3>
+<h3 id="references-22">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/71735">https://github.com/apache/airflow/pull/71735</a></li>
<li><a href="https://lists.apache.org/thread/n3l6z4jfdxj4p0t8l7m6olkq6xsc6f76">https://lists.apache.org/thread/n3l6z4jfdxj4p0t8l7m6olkq6xsc6f76</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-59243">https://www.cve.org/CVERecord?id=CVE-2026-59243</a></li>
</ul>
-<h3 id="credits-21">Credits</h3>
+<h3 id="credits-22">Credits</h3>
<ul>
<li>Roberto Nunes (finder)</li>
<li>NEO AI Engineer (@neo-ai-engineer, ProjectDiscovery) (tool)</li>
@@ -556,18 +576,18 @@
<h2 id="CVE-2026-68971">Cross-team authorization bypass in the asset materialization and dag-run result endpoints</h2>
<p>CVE-2026-68971 <a href="https://cve.org/CVERecord?id=CVE-2026-68971">[CVE]</a> <a href="./CVE-2026-68971.cve.json">[CVE json]</a> <a href="./CVE-2026-68971.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:46:20.610Z</em></p>
-<h3 id="affected-22">Affected</h3>
+<h3 id="affected-23">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.1</li>
</ul>
-<h3 id="description-22">Description</h3>
+<h3 id="description-23">Description</h3>
<p>Apache Airflow's asset materialization endpoint (<code>POST /api/v2/assets/{asset_id}/materialize</code>) and the XCom result check on <code>wait_dag_run_until_finished</code> authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global one by that field – the Keycloak auth manager, for example, checks the <code>DAG</code> resource instead of <code>DAG:&lt;team&gt;</code> &ndash [...]
-<h3 id="references-22">References</h3>
+<h3 id="references-23">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/70893">https://github.com/apache/airflow/pull/70893</a></li>
<li><a href="https://lists.apache.org/thread/kfxqqwgojdjdnt6bxg3ord4y41y334fo">https://lists.apache.org/thread/kfxqqwgojdjdnt6bxg3ord4y41y334fo</a></li>
</ul>
-<h3 id="credits-22">Credits</h3>
+<h3 id="credits-23">Credits</h3>
<ul>
<li>@haoxucu (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -575,19 +595,19 @@
<h2 id="CVE-2026-68970">Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI</h2>
<p>CVE-2026-68970 <a href="https://cve.org/CVERecord?id=CVE-2026-68970">[CVE]</a> <a href="./CVE-2026-68970.cve.json">[CVE json]</a> <a href="./CVE-2026-68970.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:47:05.846Z</em></p>
-<h3 id="affected-23">Affected</h3>
+<h3 id="affected-24">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.1</li>
</ul>
-<h3 id="description-23">Description</h3>
+<h3 id="description-24">Description</h3>
<p>Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level matched neither and was returned unmasked. Any authenticated user able to read the logs or rendered templates of a task that references such a Variable could recover the values, with no special [...]
-<h3 id="references-23">References</h3>
+<h3 id="references-24">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/70891">https://github.com/apache/airflow/pull/70891</a></li>
<li><a href="https://lists.apache.org/thread/kkrlnbsk47oght4h38mcd3h2kcb8dt28">https://lists.apache.org/thread/kkrlnbsk47oght4h38mcd3h2kcb8dt28</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-59244">https://www.cve.org/CVERecord?id=CVE-2026-59244</a></li>
</ul>
-<h3 id="credits-23">Credits</h3>
+<h3 id="credits-24">Credits</h3>
<ul>
<li>Raphael Zanarelli (@zanarellidev) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -595,19 +615,19 @@
<h2 id="CVE-2026-68969">Bulk Variable and Connection endpoints record secret values in the audit log in cleartext</h2>
<p>CVE-2026-68969 <a href="https://cve.org/CVERecord?id=CVE-2026-68969">[CVE]</a> <a href="./CVE-2026-68969.cve.json">[CVE json]</a> <a href="./CVE-2026-68969.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:47:04.500Z</em></p>
-<h3 id="affected-24">Affected</h3>
+<h3 id="affected-25">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.1</li>
</ul>
-<h3 id="description-24">Description</h3>
+<h3 id="description-25">Description</h3>
<p>Apache Airflow wrote Variable values and Connection <code>extra</code> contents to the audit log in cleartext when they were submitted through the bulk endpoints (<code>PATCH /api/v2/variables</code> and <code>PATCH /api/v2/connections</code>). The audit-log masking recognised only top-level request fields, and a bulk request nests its entities two levels below, so no masking was applied to them. Any authenticated user with audit-log read access – who need not hold Variables or [...]
-<h3 id="references-24">References</h3>
+<h3 id="references-25">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/70890">https://github.com/apache/airflow/pull/70890</a></li>
<li><a href="https://lists.apache.org/thread/p3jr90jgp2brto4vwcrx680f3x11y70c">https://lists.apache.org/thread/p3jr90jgp2brto4vwcrx680f3x11y70c</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-50204">https://www.cve.org/CVERecord?id=CVE-2026-50204</a></li>
</ul>
-<h3 id="credits-24">Credits</h3>
+<h3 id="credits-25">Credits</h3>
<ul>
<li>Harish Kolla (@Har1sh-k) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -615,18 +635,18 @@
<h2 id="CVE-2026-68968">Authorization bypass in the Backfill API through conflicting interpretations of the backfill id</h2>
<p>CVE-2026-68968 <a href="https://cve.org/CVERecord?id=CVE-2026-68968">[CVE]</a> <a href="./CVE-2026-68968.cve.json">[CVE json]</a> <a href="./CVE-2026-68968.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:47:02.989Z</em></p>
-<h3 id="affected-25">Affected</h3>
+<h3 id="affected-26">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.1</li>
</ul>
-<h3 id="description-25">Description</h3>
+<h3 id="description-26">Description</h3>
<p>Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the <code>backfill_id</code> path segment failed to parse. The authorization dependency parsed it with <code>int()</code> while the route handler parsed it as pydantic's <code>NonNegativeInt</code>, which accepts values <code>int()</code> rejects (<code>1.0</code> coerces to <code>1</code>); FastAPI resolves dependencies before endpoint validation, so the two acted on different Dags. An [...]
-<h3 id="references-25">References</h3>
+<h3 id="references-26">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/70889">https://github.com/apache/airflow/pull/70889</a></li>
<li><a href="https://lists.apache.org/thread/f9zmw6xs5b4syhwzbl6fsxm4kf2632ol">https://lists.apache.org/thread/f9zmw6xs5b4syhwzbl6fsxm4kf2632ol</a></li>
</ul>
-<h3 id="credits-25">Credits</h3>
+<h3 id="credits-26">Credits</h3>
<ul>
<li>Harish Kolla (@Har1sh-k) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -634,18 +654,18 @@
<h2 id="CVE-2026-68872">amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team’s Connection or Variable</h2>
<p>CVE-2026-68872 <a href="https://cve.org/CVERecord?id=CVE-2026-68872">[CVE]</a> <a href="./CVE-2026-68872.cve.json">[CVE json]</a> <a href="./CVE-2026-68872.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:46:13.734Z</em></p>
-<h3 id="affected-26">Affected</h3>
+<h3 id="affected-27">Affected</h3>
<ul>
<li>Apache Airflow Amazon provider before 9.34.0</li>
</ul>
-<h3 id="description-26">Description</h3>
+<h3 id="description-27">Description</h3>
<p>The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyon [...]
-<h3 id="references-26">References</h3>
+<h3 id="references-27">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/70878">https://github.com/apache/airflow/pull/70878</a></li>
<li><a href="https://lists.apache.org/thread/9nd31g40rd2zpgwwymskvjpfq1xnmllg">https://lists.apache.org/thread/9nd31g40rd2zpgwwymskvjpfq1xnmllg</a></li>
</ul>
-<h3 id="credits-26">Credits</h3>
+<h3 id="credits-27">Credits</h3>
<ul>
<li>Apache Airflow security team (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -653,18 +673,18 @@
<h2 id="CVE-2026-68871">yandex Lockbox backend: team-scope guard bypass resolves another team’s Connection or Variable</h2>
<p>CVE-2026-68871 <a href="https://cve.org/CVERecord?id=CVE-2026-68871">[CVE]</a> <a href="./CVE-2026-68871.cve.json">[CVE json]</a> <a href="./CVE-2026-68871.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:46:11.681Z</em></p>
-<h3 id="affected-27">Affected</h3>
+<h3 id="affected-28">Affected</h3>
<ul>
<li>Apache Airflow Yandex provider before 4.5.1</li>
</ul>
-<h3 id="description-27">Description</h3>
+<h3 id="description-28">Description</h3>
<p>The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using [...]
-<h3 id="references-27">References</h3>
+<h3 id="references-28">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/70877">https://github.com/apache/airflow/pull/70877</a></li>
<li><a href="https://lists.apache.org/thread/jlj9tv085txk4t0j029mvh43mz89o63c">https://lists.apache.org/thread/jlj9tv085txk4t0j029mvh43mz89o63c</a></li>
</ul>
-<h3 id="credits-27">Credits</h3>
+<h3 id="credits-28">Credits</h3>
<ul>
<li>Apache Airflow security team (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -672,19 +692,19 @@
<h2 id="CVE-2026-68870">microsoft.azure Key Vault backend: team-scope guard bypass resolves another team’s Connection or Variable</h2>
<p>CVE-2026-68870 <a href="https://cve.org/CVERecord?id=CVE-2026-68870">[CVE]</a> <a href="./CVE-2026-68870.cve.json">[CVE json]</a> <a href="./CVE-2026-68870.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:46:09.502Z</em></p>
-<h3 id="affected-28">Affected</h3>
+<h3 id="affected-29">Affected</h3>
<ul>
<li>Apache Airflow Microsoft Azure provider before 14.1.0</li>
</ul>
-<h3 id="description-28">Description</h3>
+<h3 id="description-29">Description</h3>
<p>The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode [...]
-<h3 id="references-28">References</h3>
+<h3 id="references-29">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/70876">https://github.com/apache/airflow/pull/70876</a></li>
<li><a href="https://github.com/apache/airflow/pull/70899">https://github.com/apache/airflow/pull/70899</a></li>
<li><a href="https://lists.apache.org/thread/dtkk6vtfoj1y4zjyd6s3mzg0v5g9yg0p">https://lists.apache.org/thread/dtkk6vtfoj1y4zjyd6s3mzg0v5g9yg0p</a></li>
</ul>
-<h3 id="credits-28">Credits</h3>
+<h3 id="credits-29">Credits</h3>
<ul>
<li>Apache Airflow security team (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -692,18 +712,18 @@
<h2 id="CVE-2026-68868">google Secret Manager backend: team scope is never applied, exposing every team’s Connections and Variables</h2>
<p>CVE-2026-68868 <a href="https://cve.org/CVERecord?id=CVE-2026-68868">[CVE]</a> <a href="./CVE-2026-68868.cve.json">[CVE json]</a> <a href="./CVE-2026-68868.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:46:15.844Z</em></p>
-<h3 id="affected-29">Affected</h3>
+<h3 id="affected-30">Affected</h3>
<ul>
<li>Apache Airflow Google provider before 22.3.0</li>
</ul>
-<h3 id="description-29">Description</h3>
+<h3 id="description-30">Description</h3>
<p>The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's <code>team_name</code> was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Variable, obtaining its creden [...]
-<h3 id="references-29">References</h3>
+<h3 id="references-30">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/70869">https://github.com/apache/airflow/pull/70869</a></li>
<li><a href="https://lists.apache.org/thread/03h5y0fmqlh0yf055zlocxh591ozx69x">https://lists.apache.org/thread/03h5y0fmqlh0yf055zlocxh591ozx69x</a></li>
</ul>
-<h3 id="credits-29">Credits</h3>
+<h3 id="credits-30">Credits</h3>
<ul>
<li>Apache Airflow security team (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -711,20 +731,20 @@
<h2 id="CVE-2026-68076">Connections test API: team-scope guard bypass resolves another team’s environment Connection</h2>
<p>CVE-2026-68076 <a href="https://cve.org/CVERecord?id=CVE-2026-68076">[CVE]</a> <a href="./CVE-2026-68076.cve.json">[CVE json]</a> <a href="./CVE-2026-68076.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T15:05:05.218Z</em></p>
-<h3 id="affected-30">Affected</h3>
+<h3 id="affected-31">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.1</li>
</ul>
-<h3 id="description-30">Description</h3>
+<h3 id="description-31">Description</h3>
<p>Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are allowed to contain. When the guard did not apply, the lookup fell through to an unconditional global read that resolved the stored <code>AIRFLOW_CONN__&lt;TEAM&gt;___&lt;ID&gt;</c [...]
-<h3 id="references-30">References</h3>
+<h3 id="references-31">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/70736">https://github.com/apache/airflow/pull/70736</a></li>
<li><a href="https://github.com/apache/airflow/pull/70886">https://github.com/apache/airflow/pull/70886</a></li>
<li><a href="https://github.com/apache/airflow/pull/70902">https://github.com/apache/airflow/pull/70902</a></li>
<li><a href="https://lists.apache.org/thread/v4mc51dgmrc1t82mhzsngsgzo2gxsf2l">https://lists.apache.org/thread/v4mc51dgmrc1t82mhzsngsgzo2gxsf2l</a></li>
</ul>
-<h3 id="credits-30">Credits</h3>
+<h3 id="credits-31">Credits</h3>
<ul>
<li>Andrew Rukin (Arenadata) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -732,20 +752,20 @@
<h2 id="CVE-2026-67587">DAG-author remote code execution on the Scheduler via a Serde <code>Callback</code> deserialization gadget</h2>
<p>CVE-2026-67587 <a href="https://cve.org/CVERecord?id=CVE-2026-67587">[CVE]</a> <a href="./CVE-2026-67587.cve.json">[CVE json]</a> <a href="./CVE-2026-67587.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:46:59.901Z</em></p>
-<h3 id="affected-31">Affected</h3>
+<h3 id="affected-32">Affected</h3>
<ul>
<li>Apache Airflow from 3.3.0 before 3.3.1</li>
</ul>
-<h3 id="description-31">Description</h3>
+<h3 id="description-32">Description</h3>
<p>Apache Airflow's Task SDK rebuilt a <code>Callback</code> object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because <code>SyncCallback</code> is itself an Airflow class it passes the default <code>allowed_deserialization_classes</code> allow-list, so tightening that setting does not help. A Dag author — who controls a task instance's <code>next_kwargs</code> through the task execution API — can therefore cause an arb [...]
-<h3 id="references-31">References</h3>
+<h3 id="references-32">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/70704">https://github.com/apache/airflow/pull/70704</a></li>
<li><a href="https://lists.apache.org/thread/o00ww4n69qojvsckb464dtwd2nhzy6t0">https://lists.apache.org/thread/o00ww4n69qojvsckb464dtwd2nhzy6t0</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-58076">https://www.cve.org/CVERecord?id=CVE-2026-58076</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-67260">https://www.cve.org/CVERecord?id=CVE-2026-67260</a></li>
</ul>
-<h3 id="credits-31">Credits</h3>
+<h3 id="credits-32">Credits</h3>
<ul>
<li>Nguyen Van Hiep (@hypnguyen1209), MBBank (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -753,19 +773,19 @@
<h2 id="CVE-2026-67260">DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization</h2>
<p>CVE-2026-67260 <a href="https://cve.org/CVERecord?id=CVE-2026-67260">[CVE]</a> <a href="./CVE-2026-67260.cve.json">[CVE json]</a> <a href="./CVE-2026-67260.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:46:57.273Z</em></p>
-<h3 id="affected-32">Affected</h3>
+<h3 id="affected-33">Affected</h3>
<ul>
<li>Apache Airflow from 3.3.0 before 3.3.1</li>
</ul>
-<h3 id="description-32">Description</h3>
+<h3 id="description-33">Description</h3>
<p>Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new <code>awaiting_input</code> task state swept by the scheduler. That sweep deserializes the task instance's <code>next_kwargs</code> without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job. No non-default configuration is required: the sweep runs [...]
-<h3 id="references-32">References</h3>
+<h3 id="references-33">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/70685">https://github.com/apache/airflow/pull/70685</a></li>
<li><a href="https://lists.apache.org/thread/vygr0fh82cjzjp5k4vtfmboxryvm3lyn">https://lists.apache.org/thread/vygr0fh82cjzjp5k4vtfmboxryvm3lyn</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-58076">https://www.cve.org/CVERecord?id=CVE-2026-58076</a></li>
</ul>
-<h3 id="credits-32">Credits</h3>
+<h3 id="credits-33">Credits</h3>
<ul>
<li>Erik Villegas (GitHub: @erik-451) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -773,20 +793,20 @@
<h2 id="CVE-2026-65017">Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)</h2>
<p>CVE-2026-65017 <a href="https://cve.org/CVERecord?id=CVE-2026-65017">[CVE]</a> <a href="./CVE-2026-65017.cve.json">[CVE json]</a> <a href="./CVE-2026-65017.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:47:01.247Z</em></p>
-<h3 id="affected-33">Affected</h3>
+<h3 id="affected-34">Affected</h3>
<ul>
<li>Apache Airflow from 3.3.0 before 3.3.1</li>
</ul>
-<h3 id="description-33">Description</h3>
+<h3 id="description-34">Description</h3>
<p>Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets masker matched only base section an [...]
-<h3 id="references-33">References</h3>
+<h3 id="references-34">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/70755">https://github.com/apache/airflow/pull/70755</a></li>
<li><a href="https://lists.apache.org/thread/kykn94kjf0tntx4wywtvjowh5bzdgf38">https://lists.apache.org/thread/kykn94kjf0tntx4wywtvjowh5bzdgf38</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-48828">https://www.cve.org/CVERecord?id=CVE-2026-48828</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-48892">https://www.cve.org/CVERecord?id=CVE-2026-48892</a></li>
</ul>
-<h3 id="credits-33">Credits</h3>
+<h3 id="credits-34">Credits</h3>
<ul>
<li>Andrew Rukin (Arenadata) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -794,18 +814,18 @@
<h2 id="CVE-2026-59245">FAB auth manager: a DAG named “DAGs” hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision)</h2>
<p>CVE-2026-59245 <a href="https://cve.org/CVERecord?id=CVE-2026-59245">[CVE]</a> <a href="./CVE-2026-59245.cve.json">[CVE json]</a> <a href="./CVE-2026-59245.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:45:59.383Z</em></p>
-<h3 id="affected-34">Affected</h3>
+<h3 id="affected-35">Affected</h3>
<ul>
<li>Apache Airflow FAB provider before 3.7.2</li>
</ul>
-<h3 id="description-34">Description</h3>
+<h3 id="description-35">Description</h3>
<p>In the Apache Airflow FAB auth manager, a DAG whose <code>dag_id</code> is <code>DAGs</code> collided with the global all-DAGs permission resource name produced by <code>resource_name()</code>, so a user granted per-DAG <code>access_control</code> on that one DAG was silently granted the global all-DAGs permission (privilege escalation). The escalation triggers when a DAG named <code>DAGs</code> exists and a lower-privileged user is given per-DAG access to it, granting that user read/ [...]
-<h3 id="references-34">References</h3>
+<h3 id="references-35">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/69106">https://github.com/apache/airflow/pull/69106</a></li>
<li><a href="https://lists.apache.org/thread/70f37q3mwov1vm3zolrfxlzds278c78h">https://lists.apache.org/thread/70f37q3mwov1vm3zolrfxlzds278c78h</a></li>
</ul>
-<h3 id="credits-34">Credits</h3>
+<h3 id="credits-35">Credits</h3>
<ul>
<li>Tran Hieu (h1tr3xnull) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -813,18 +833,18 @@
<h2 id="CVE-2026-59244">Secrets masker: <code>var.json</code> Variable values not masked in the Rendered Templates UI</h2>
<p>CVE-2026-59244 <a href="https://cve.org/CVERecord?id=CVE-2026-59244">[CVE]</a> <a href="./CVE-2026-59244.cve.json">[CVE json]</a> <a href="./CVE-2026-59244.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:46:03.573Z</em></p>
-<h3 id="affected-35">Affected</h3>
+<h3 id="affected-36">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.1</li>
</ul>
-<h3 id="description-35">Description</h3>
+<h3 id="description-36">Description</h3>
<p>Apache Airflow's secrets masker did not mask <code>var.json</code> Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an <code>isinstance(str)</code> guard — so a secret stored as a JSON Variable and referenced in a template via <code>var.json</code> was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardles [...]
-<h3 id="references-35">References</h3>
+<h3 id="references-36">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/68975">https://github.com/apache/airflow/pull/68975</a></li>
<li><a href="https://lists.apache.org/thread/fncod6vttfo5fvmfs3h9r8s2kmm9j1n6">https://lists.apache.org/thread/fncod6vttfo5fvmfs3h9r8s2kmm9j1n6</a></li>
</ul>
-<h3 id="credits-35">Credits</h3>
+<h3 id="credits-36">Credits</h3>
<ul>
<li>Juan Pablo Guereca (@jpgerek) (finder)</li>
<li>Juan Pablo Guereca (@jpgerek) (remediation developer)</li>
@@ -832,18 +852,18 @@
<h2 id="CVE-2026-59243">FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (<code>verify_signature</code> defaults to <code>False</code>)</h2>
<p>CVE-2026-59243 <a href="https://cve.org/CVERecord?id=CVE-2026-59243">[CVE]</a> <a href="./CVE-2026-59243.cve.json">[CVE json]</a> <a href="./CVE-2026-59243.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:46:01.303Z</em></p>
-<h3 id="affected-36">Affected</h3>
+<h3 id="affected-37">Affected</h3>
<ul>
<li>Apache Airflow FAB provider before 3.7.3</li>
</ul>
-<h3 id="description-36">Description</h3>
+<h3 id="description-37">Description</h3>
<p>The FAB auth manager's Azure AD OAuth login defaulted <code>verify_signature=False</code> when decoding the ID token, so an attacker able to present a forged or unsigned (<code>alg:none</code>) ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role (CWE-347). Deployments running the FAB auth manager with the Azure AD OAuth login path under its default configuration are affected; the Authentik path already defaul [...]
-<h3 id="references-36">References</h3>
+<h3 id="references-37">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/69374">https://github.com/apache/airflow/pull/69374</a></li>
<li><a href="https://lists.apache.org/thread/x4784l7z00tl3gw4tv2dmvoon77rxgpl">https://lists.apache.org/thread/x4784l7z00tl3gw4tv2dmvoon77rxgpl</a></li>
</ul>
-<h3 id="credits-36">Credits</h3>
+<h3 id="credits-37">Credits</h3>
<ul>
<li>MalHyuk (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -851,18 +871,18 @@
<h2 id="CVE-2026-59242">Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint</h2>
<p>CVE-2026-59242 <a href="https://cve.org/CVERecord?id=CVE-2026-59242">[CVE]</a> <a href="./CVE-2026-59242.cve.json">[CVE json]</a> <a href="./CVE-2026-59242.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:45:57.373Z</em></p>
-<h3 id="affected-37">Affected</h3>
+<h3 id="affected-38">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.1</li>
</ul>
-<h3 id="description-37">Description</h3>
+<h3 id="description-38">Description</h3>
<p>Apache Airflow's XCom <code>GET /api/v2/{...}/xcomEntries/{key}?deserialize=true</code> endpoint passed a string-literal payload through <code>BaseXCom.deserialize_value</code> without the <code>_check_forbidden_xcom_keys</code> guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary <code>airflow.*</code> classes on the API server (CWE-502). An authenticated user who can write an XCom value and then read it back with <code>deserialize=true</ [...]
-<h3 id="references-37">References</h3>
+<h3 id="references-38">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/69378">https://github.com/apache/airflow/pull/69378</a></li>
<li><a href="https://lists.apache.org/thread/dm0520yhh4mn7qknyoh45r2w6c5qg2mg">https://lists.apache.org/thread/dm0520yhh4mn7qknyoh45r2w6c5qg2mg</a></li>
</ul>
-<h3 id="credits-37">Credits</h3>
+<h3 id="credits-38">Credits</h3>
<ul>
<li>localhost-detect (@localhost-detect) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -870,19 +890,19 @@
<h2 id="CVE-2026-58076">Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server</h2>
<p>CVE-2026-58076 <a href="https://cve.org/CVERecord?id=CVE-2026-58076">[CVE]</a> <a href="./CVE-2026-58076.cve.json">[CVE json]</a> <a href="./CVE-2026-58076.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:46:54.580Z</em></p>
-<h3 id="affected-38">Affected</h3>
+<h3 id="affected-39">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.3.1</li>
</ul>
-<h3 id="description-38">Description</h3>
+<h3 id="description-39">Description</h3>
<p>Apache Airflow's serialization layer reconstructed exception nodes by calling <code>import_string()</code> on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's <code>executor_config</code> reaches that branch, so a Dag author could place a value there that causes an arbitrary callable to be imported and invoked – for example <code>subprocess.check_output</code>, or <cod [...]
-<h3 id="references-38">References</h3>
+<h3 id="references-39">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/68511">https://github.com/apache/airflow/pull/68511</a></li>
<li><a href="https://lists.apache.org/thread/t81p688t15jozxsng8521o60nh2kfsos">https://lists.apache.org/thread/t81p688t15jozxsng8521o60nh2kfsos</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-33264">https://www.cve.org/CVERecord?id=CVE-2026-33264</a></li>
</ul>
-<h3 id="credits-38">Credits</h3>
+<h3 id="credits-39">Credits</h3>
<ul>
<li>Jan Kahmen (turingpoint), GitHub: @kah-ja (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -890,18 +910,18 @@
<h2 id="CVE-2026-58065">Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key verification</h2>
<p>CVE-2026-58065 <a href="https://cve.org/CVERecord?id=CVE-2026-58065">[CVE]</a> <a href="./CVE-2026-58065.cve.json">[CVE json]</a> <a href="./CVE-2026-58065.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T15:05:21.274Z</em></p>
-<h3 id="affected-39">Affected</h3>
+<h3 id="affected-40">Affected</h3>
<ul>
<li>Apache Airflow Git provider before 0.4.1</li>
</ul>
-<h3 id="description-39">Description</h3>
+<h3 id="description-40">Description</h3>
<p>The Apache Airflow Git provider runs its git-over-SSH operations with <code>StrictHostKeyChecking=no</code> by default, disabling SSH host-key verification. An attacker who can intercept the network path between an Airflow worker and the Git server can impersonate the server (man-in-the-middle), capturing the SSH deploy key or injecting malicious repository content. Deployments that use the Git DAG bundle or Git provider to clone over SSH with a deploy key are affected. The fix change [...]
-<h3 id="references-39">References</h3>
+<h3 id="references-40">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/69103">https://github.com/apache/airflow/pull/69103</a></li>
<li><a href="https://lists.apache.org/thread/fjmclngfksz2kp7llpcjxzdz568h0zhc">https://lists.apache.org/thread/fjmclngfksz2kp7llpcjxzdz568h0zhc</a></li>
</ul>
-<h3 id="credits-39">Credits</h3>
+<h3 id="credits-40">Credits</h3>
<ul>
<li>Siyang Wu (independent researcher) (finder)</li>
<li>Leowsy-Hashblue (<a href="https://dbugs.ptsecurity.com/researchers/Leowsy-Hashblue">https://dbugs.ptsecurity.com/researchers/Leowsy-Hashblue</a>) (finder)</li>
@@ -910,19 +930,19 @@
<h2 id="CVE-2026-54183">Airflow Variables were not masked in the UI for authenticated users</h2>
<p>CVE-2026-54183 <a href="https://cve.org/CVERecord?id=CVE-2026-54183">[CVE]</a> <a href="./CVE-2026-54183.cve.json">[CVE json]</a> <a href="./CVE-2026-54183.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:46:55.864Z</em></p>
-<h3 id="affected-40">Affected</h3>
+<h3 id="affected-41">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.1</li>
</ul>
-<h3 id="description-40">Description</h3>
+<h3 id="description-41">Description</h3>
<p>Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was shown unmasked in the Variables UI. The exposure is limited to the UI: any authenticated user who can see the Variable in the UI can already read its full value through the Variables REST API, so [...]
-<h3 id="references-40">References</h3>
+<h3 id="references-41">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/68422">https://github.com/apache/airflow/pull/68422</a></li>
<li><a href="https://lists.apache.org/thread/z5mrdq6c60f2wyx4cc64cj8nv0dxd9lo">https://lists.apache.org/thread/z5mrdq6c60f2wyx4cc64cj8nv0dxd9lo</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-42358">https://www.cve.org/CVERecord?id=CVE-2026-42358</a></li>
</ul>
-<h3 id="credits-40">Credits</h3>
+<h3 id="credits-41">Credits</h3>
<ul>
<li>Omkhar Arasaratnam (@omkhar) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -930,18 +950,18 @@
<h2 id="CVE-2026-50203">Path traversal in SFTPHook.retrieve_directory allows local file write outside the destination directory via malicious server-supplied directory-entry names</h2>
<p>CVE-2026-50203 <a href="https://cve.org/CVERecord?id=CVE-2026-50203">[CVE]</a> <a href="./CVE-2026-50203.cve.json">[CVE json]</a> <a href="./CVE-2026-50203.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-17T01:48:06.460Z</em></p>
-<h3 id="affected-41">Affected</h3>
+<h3 id="affected-42">Affected</h3>
<ul>
<li>Apache Airflow SFTP provider before 5.8.1</li>
</ul>
-<h3 id="description-41">Description</h3>
+<h3 id="description-42">Description</h3>
<p>A path traversal in the SFTP provider (<code>SFTPHook.retrieve_directory</code> / <code>SFTPOperator(operation=get)</code>) let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is any deployment downloading directories from an untrusted SFTP server. Upgrade <code>apache-airflow-providers-sftp</code> to 5.8.1 or later.</p>
-<h3 id="references-41">References</h3>
+<h3 id="references-42">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67985">https://github.com/apache/airflow/pull/67985</a></li>
<li><a href="https://lists.apache.org/thread/7f4b284oh44c1n95oq8mh1qc7y1lr9dx">https://lists.apache.org/thread/7f4b284oh44c1n95oq8mh1qc7y1lr9dx</a></li>
</ul>
-<h3 id="credits-41">Credits</h3>
+<h3 id="credits-42">Credits</h3>
<ul>
<li>secuholic (finder)</li>
<li>Venkatraman Kumar (r3dw0lfsec), Securin (finder)</li>
@@ -950,18 +970,18 @@
<h2 id="CVE-2026-49818">Path traversal in GCSToSambaOperator via GCS object names</h2>
<p>CVE-2026-49818 <a href="https://cve.org/CVERecord?id=CVE-2026-49818">[CVE]</a> <a href="./CVE-2026-49818.cve.json">[CVE json]</a> <a href="./CVE-2026-49818.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-10T17:37:51.189Z</em></p>
-<h3 id="affected-42">Affected</h3>
+<h3 id="affected-43">Affected</h3>
<ul>
<li>Apache Airflow Samba provider before 4.12.6</li>
</ul>
-<h3 id="description-42">Description</h3>
+<h3 id="description-43">Description</h3>
<p>The Apache Airflow Samba provider's <code>GCSToSambaOperator</code> joined GCS object names to the SMB destination path without a containment check, so an object named with <code>../</code> segments resolved a write path outside the configured <code>destination_path</code>. An attacker able to write objects into the source GCS bucket — typically an external data producer distinct from the trusted DAG author — could write files to arbitrary locations on the Samba target when the operat [...]
-<h3 id="references-42">References</h3>
+<h3 id="references-43">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67857">https://github.com/apache/airflow/pull/67857</a></li>
<li><a href="https://lists.apache.org/thread/3vs0m3p51psgf54tts18d6336g24x3sf">https://lists.apache.org/thread/3vs0m3p51psgf54tts18d6336g24x3sf</a></li>
</ul>
-<h3 id="credits-42">Credits</h3>
+<h3 id="credits-43">Credits</h3>
<ul>
<li>secuholic (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -969,18 +989,18 @@
<h2 id="CVE-2026-49487">Task-instance API exposes secrets in deferred trigger kwargs</h2>
<p>CVE-2026-49487 <a href="https://cve.org/CVERecord?id=CVE-2026-49487">[CVE]</a> <a href="./CVE-2026-49487.cve.json">[CVE json]</a> <a href="./CVE-2026-49487.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:45:52.041Z</em></p>
-<h3 id="affected-43">Affected</h3>
+<h3 id="affected-44">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.0</li>
</ul>
-<h3 id="description-43">Description</h3>
+<h3 id="description-44">Description</h3>
<p>In Apache Airflow before 3.3.0, the REST API task-instance detail and list<br>endpoints returned a deferred task's trigger kwargs without masking. When a<br>deferred operator passed a secret (for example a provider API key) into its<br>trigger, any authenticated user with DAG-scoped task-instance read access for<br>that DAG could read that secret in clear text while the task was deferred.<br>Users should upgrade to apache-airflow 3.3.0 or later, which masks sensitive<br>values in trig [...]
-<h3 id="references-43">References</h3>
+<h3 id="references-44">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67868">https://github.com/apache/airflow/pull/67868</a></li>
<li><a href="https://lists.apache.org/thread/qlw6pozlzlfhkvmbgqsbjlq6vj4v0pc4">https://lists.apache.org/thread/qlw6pozlzlfhkvmbgqsbjlq6vj4v0pc4</a></li>
</ul>
-<h3 id="credits-43">Credits</h3>
+<h3 id="credits-44">Credits</h3>
<ul>
<li>Andrew Rukin (Arenadata) (finder)</li>
<li>Jarek Potiuk (@potiuk) (remediation developer)</li>
@@ -988,18 +1008,18 @@
<h2 id="CVE-2026-49486">FTP Provider does not protect FTPS data channel (missing PROT_P)</h2>
<p>CVE-2026-49486 <a href="https://cve.org/CVERecord?id=CVE-2026-49486">[CVE]</a> <a href="./CVE-2026-49486.cve.json">[CVE json]</a> <a href="./CVE-2026-49486.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:45:46.269Z</em></p>
-<h3 id="affected-44">Affected</h3>
+<h3 id="affected-45">Affected</h3>
<ul>
<li>Apache Airflow FTP provider before 3.15.1</li>
</ul>
-<h3 id="description-44">Description</h3>
+<h3 id="description-45">Description</h3>
<p>The Apache Airflow FTP provider's <code>FTPSHook.get_conn()</code> created an <code>ftplib.FTP_TLS</code> connection but never called <code>prot_p()</code>, so although the control channel was TLS-protected the data channel was transmitted in cleartext. Any deployment using <code>FTPSHook</code> or <code>FTPSFileTransmitOperator</code> to move files over FTPS exposed file contents and credentials-in-transit to a network attacker able to observe the data connection. Upgrade apache-airf [...]
-<h3 id="references-44">References</h3>
+<h3 id="references-45">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67946">https://github.com/apache/airflow/pull/67946</a></li>
<li><a href="https://lists.apache.org/thread/gwnsxlt9hfj5pc543wxtogbnjdn04xj1">https://lists.apache.org/thread/gwnsxlt9hfj5pc543wxtogbnjdn04xj1</a></li>
</ul>
-<h3 id="credits-44">Credits</h3>
+<h3 id="credits-45">Credits</h3>
<ul>
<li>Andrew Rukin (Arenadata) (finder)</li>
<li>Shubham Raj (remediation developer)</li>
@@ -1007,18 +1027,18 @@
<h2 id="CVE-2026-49298">JWT Token Exposure in KubernetesExecutor Command-Line Arguments</h2>
<p>CVE-2026-49298 <a href="https://cve.org/CVERecord?id=CVE-2026-49298">[CVE]</a> <a href="./CVE-2026-49298.cve.json">[CVE json]</a> <a href="./CVE-2026-49298.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:34:31.163Z</em></p>
-<h3 id="affected-45">Affected</h3>
+<h3 id="affected-46">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.2</li>
</ul>
-<h3 id="description-45">Description</h3>
+<h3 id="description-46">Description</h3>
<p>A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate against the Execution API to be passed to the worker container as command-line arguments visible in the pod spec. An authenticated UI/API user with Kubernetes read-only access to the cluster (e.g. <code>pods/get</code> in the Airflow namespace) could harvest the JWT from <code>kubectl describe pod</code> output and then call state-mutating Execution API endpoints — triggering Dag runs, c [...]
-<h3 id="references-45">References</h3>
+<h3 id="references-46">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/60108">https://github.com/apache/airflow/pull/60108</a></li>
<li><a href="https://lists.apache.org/thread/wo09vrks8189dzsot39rvrx3vnx102tt">https://lists.apache.org/thread/wo09vrks8189dzsot39rvrx3vnx102tt</a></li>
</ul>
-<h3 id="credits-45">Credits</h3>
+<h3 id="credits-46">Credits</h3>
<ul>
<li>Nikolai Dvoinishnikov (<a href="mailto:nikdvy@gmail.com">nikdvy@gmail.com</a>) (finder)</li>
<li>Anton Kuznetsov (<a href="mailto:piratusxp@gmail.com">piratusxp@gmail.com</a>) (finder)</li>
@@ -1027,18 +1047,18 @@
<h2 id="CVE-2026-49297">Path traversal via GCS object names → local/SFTP filesystem (GCSToSFTPOperator + GCSTimeSpanFileTransformOperator)</h2>
<p>CVE-2026-49297 <a href="https://cve.org/CVERecord?id=CVE-2026-49297">[CVE]</a> <a href="./CVE-2026-49297.cve.json">[CVE json]</a> <a href="./CVE-2026-49297.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-07-04T05:57:06.977Z</em></p>
-<h3 id="affected-46">Affected</h3>
+<h3 id="affected-47">Affected</h3>
<ul>
<li>Apache Airflow Google provider before 22.2.1</li>
</ul>
-<h3 id="description-46">Description</h3>
+<h3 id="description-47">Description</h3>
<p>Apache Airflow's Google provider operators <code>GCSToSFTPOperator</code> and <code>GCSTimeSpanFileTransformOperator</code> joined GCS object names returned by the bucket listing API directly to a destination filesystem path without normalisation or containment check. A user with write access to the source GCS bucket (typically a different trust principal than the DAG author — partner uploads, ingest-only service accounts, public-data buckets) could create an object whose name contain [...]
-<h3 id="references-46">References</h3>
+<h3 id="references-47">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67667">https://github.com/apache/airflow/pull/67667</a></li>
<li><a href="https://lists.apache.org/thread/cb5nvoxsj1q7rv878cyqgtg150w0zglq?users@airflow.apache.org">https://lists.apache.org/thread/cb5nvoxsj1q7rv878cyqgtg150w0zglq?users@airflow.apache.org</a></li>
</ul>
-<h3 id="credits-46">Credits</h3>
+<h3 id="credits-47">Credits</h3>
<ul>
<li>anonymous (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -1046,18 +1066,18 @@
<h2 id="CVE-2026-49296">Per-DAG read bypass discloses co-located DAGs’ source via GET /api/v2/dagSources/{dag_id}</h2>
<p>CVE-2026-49296 <a href="https://cve.org/CVERecord?id=CVE-2026-49296">[CVE]</a> <a href="./CVE-2026-49296.cve.json">[CVE json]</a> <a href="./CVE-2026-49296.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:45:50.190Z</em></p>
-<h3 id="affected-47">Affected</h3>
+<h3 id="affected-48">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.3.0</li>
</ul>
-<h3 id="description-47">Description</h3>
+<h3 id="description-48">Description</h3>
<p>Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. <code>GET /api/v2/dagSources/{dag_id}</code> — and the equivalent Dag-source view in the UI — returned the entire source file without redacting Dags the caller was not authorized to read, bypassing per-DAG read authorization. Deployments that co-locate multiple Dags in a single file and rely on per-DAG access control to limit source visibility are [...]
-<h3 id="references-47">References</h3>
+<h3 id="references-48">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67662">https://github.com/apache/airflow/pull/67662</a></li>
<li><a href="https://lists.apache.org/thread/qqv41t3oydkn9o14r2rfz1wkdrsp5jzn">https://lists.apache.org/thread/qqv41t3oydkn9o14r2rfz1wkdrsp5jzn</a></li>
</ul>
-<h3 id="credits-47">Credits</h3>
+<h3 id="credits-48">Credits</h3>
<ul>
<li>Matteo Panzeri (Università di Pavia), GitHub @matte1782 (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -1065,18 +1085,18 @@
<h2 id="CVE-2026-49267">No certificate validation on SMTP STARTTLS connections</h2>
<p>CVE-2026-49267 <a href="https://cve.org/CVERecord?id=CVE-2026-49267">[CVE]</a> <a href="./CVE-2026-49267.cve.json">[CVE json]</a> <a href="./CVE-2026-49267.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:53:11.785Z</em></p>
-<h3 id="affected-48">Affected</h3>
+<h3 id="affected-49">Affected</h3>
<ul>
<li>Apache Airflow from 2.0.0 before 3.2.2</li>
</ul>
-<h3 id="description-48">Description</h3>
+<h3 id="description-49">Description</h3>
<p>Apache Airflow's EmailOperator and the underlying <code>airflow.utils.email</code> helpers established SMTP STARTTLS connections without verifying the remote certificate when the deployment used <code>[email] smtp_starttls=True</code> without <code>[email] smtp_ssl</code>. An attacker positioned between the worker and the configured SMTP server (network MITM — typical hostile-network attack-surface for environments where the SMTP relay sits outside the worker's trust boundary) could p [...]
-<h3 id="references-48">References</h3>
+<h3 id="references-49">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65346">https://github.com/apache/airflow/pull/65346</a></li>
<li><a href="https://lists.apache.org/thread/6v2ds757000msmjmovnnqryqzks83ps0">https://lists.apache.org/thread/6v2ds757000msmjmovnnqryqzks83ps0</a></li>
</ul>
-<h3 id="credits-48">Credits</h3>
+<h3 id="credits-49">Credits</h3>
<ul>
<li>Francis Bergin (@francisbergin) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -1084,18 +1104,18 @@
<h2 id="CVE-2026-48892">Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options</h2>
<p>CVE-2026-48892 <a href="https://cve.org/CVERecord?id=CVE-2026-48892">[CVE]</a> <a href="./CVE-2026-48892.cve.json">[CVE json]</a> <a href="./CVE-2026-48892.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:45:44.357Z</em></p>
-<h3 id="affected-49">Affected</h3>
+<h3 id="affected-50">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.0</li>
</ul>
-<h3 id="description-49">Description</h3>
+<h3 id="description-50">Description</h3>
<p>The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like <code>AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID</code> and <code>AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID</code>) as synthetic config options whose option names were not in <code>sensitive_config_values</code>, so the masker did not redact them. An authenticated UI/API user with Config read permission could retrieve plaintext secrets-backend credentials (Vault <code>role_ [...]
-<h3 id="references-49">References</h3>
+<h3 id="references-50">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67622">https://github.com/apache/airflow/pull/67622</a></li>
<li><a href="https://lists.apache.org/thread/pq5yy40079h6tzh3fxvw28dd8dbk72hk">https://lists.apache.org/thread/pq5yy40079h6tzh3fxvw28dd8dbk72hk</a></li>
</ul>
-<h3 id="credits-49">Credits</h3>
+<h3 id="credits-50">Credits</h3>
<ul>
<li>Omkhar Arasaratnam (@omkhar) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -1103,19 +1123,19 @@
<h2 id="CVE-2026-48891">/ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target</h2>
<p>CVE-2026-48891 <a href="https://cve.org/CVERecord?id=CVE-2026-48891">[CVE]</a> <a href="./CVE-2026-48891.cve.json">[CVE json]</a> <a href="./CVE-2026-48891.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:45:48.267Z</em></p>
-<h3 id="affected-50">Affected</h3>
+<h3 id="affected-51">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.0</li>
</ul>
-<h3 id="description-50">Description</h3>
+<h3 id="description-51">Description</h3>
<p>A bug in Apache Airflow's <code>/ui/dependencies</code> scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the <code>dep.source</code> and <code>dep.target</code> fields of trigger / sensor dependency entries. An authenticated UI user with read permission on some Dags could enumerate the identifiers of other Dags they were not authorized to read by inspecting the dependency graph for trigg [...]
-<h3 id="references-50">References</h3>
+<h3 id="references-51">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67627">https://github.com/apache/airflow/pull/67627</a></li>
<li><a href="https://lists.apache.org/thread/wzc8nflg94rq6w8f5tvtlo0o3g4wjrfl">https://lists.apache.org/thread/wzc8nflg94rq6w8f5tvtlo0o3g4wjrfl</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-28563">https://www.cve.org/CVERecord?id=CVE-2026-28563</a></li>
</ul>
-<h3 id="credits-50">Credits</h3>
+<h3 id="credits-51">Credits</h3>
<ul>
<li>Mitchell Benjamin / Revamp Studio (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -1123,18 +1143,18 @@
<h2 id="CVE-2026-48828">Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key</h2>
<p>CVE-2026-48828 <a href="https://cve.org/CVERecord?id=CVE-2026-48828">[CVE]</a> <a href="./CVE-2026-48828.cve.json">[CVE json]</a> <a href="./CVE-2026-48828.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:45:42.320Z</em></p>
-<h3 id="affected-51">Affected</h3>
+<h3 id="affected-52">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.0</li>
</ul>
-<h3 id="description-51">Description</h3>
+<h3 id="description-52">Description</h3>
<p>The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based <code>should_hide_value_for_key</code> check (which triggers on secret-suffixed key names like <code>*_password</code> / <code>*_token</code> / <code>*_secret</code>) could not fire for JSON-decodable variable values. An authenticated UI/API user with bulk Variable read permission could retrieve plaintext values from JSON variables whose key would otherwise trigger redacti [...]
-<h3 id="references-51">References</h3>
+<h3 id="references-52">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67495">https://github.com/apache/airflow/pull/67495</a></li>
<li><a href="https://lists.apache.org/thread/y9kf314t6dhnv994hr11wj3tbow847yc">https://lists.apache.org/thread/y9kf314t6dhnv994hr11wj3tbow847yc</a></li>
</ul>
-<h3 id="credits-51">Credits</h3>
+<h3 id="credits-52">Credits</h3>
<ul>
<li>Omkhar Arasaratnam (@omkhar) (finder)</li>
<li>Shubham Raj (@shubhamraj-git) (remediation developer)</li>
@@ -1142,19 +1162,19 @@
<h2 id="CVE-2026-48726">revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path</h2>
<p>CVE-2026-48726 <a href="https://cve.org/CVERecord?id=CVE-2026-48726">[CVE]</a> <a href="./CVE-2026-48726.cve.json">[CVE json]</a> <a href="./CVE-2026-48726.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:35:18.096Z</em></p>
-<h3 id="affected-52">Affected</h3>
+<h3 id="affected-53">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.2</li>
</ul>
-<h3 id="description-52">Description</h3>
+<h3 id="description-53">Description</h3>
<p>A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for <code>FabAuthManager</code> and <code>KeycloakAuthManager</code> did not actually reach the underlying <code>revoke_token()</code> call, so the JWT remained accepted by the API server until its natural expiry. An attacker holding a previously-issued JWT for a logged-out user could continue to make authenticated API calls as that us [...]
-<h3 id="references-52">References</h3>
+<h3 id="references-53">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67289">https://github.com/apache/airflow/pull/67289</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2025-57735">https://www.cve.org/CVERecord?id=CVE-2025-57735</a></li>
<li><a href="https://lists.apache.org/thread/630jg4z6cjkv4m2yv2ljgmf1zhdj1vqx">https://lists.apache.org/thread/630jg4z6cjkv4m2yv2ljgmf1zhdj1vqx</a></li>
</ul>
-<h3 id="credits-52">Credits</h3>
+<h3 id="credits-53">Credits</h3>
<ul>
<li>Bernardo Curi (r3ngar_bugado) (finder)</li>
<li>pierrejeambrun (remediation developer)</li>
@@ -1162,18 +1182,18 @@
<h2 id="CVE-2026-46764">Event Log detail endpoint bypasses DAG-scoped event log permission filter</h2>
<p>CVE-2026-46764 <a href="https://cve.org/CVERecord?id=CVE-2026-46764">[CVE]</a> <a href="./CVE-2026-46764.cve.json">[CVE json]</a> <a href="./CVE-2026-46764.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:45:46.820Z</em></p>
-<h3 id="affected-53">Affected</h3>
+<h3 id="affected-54">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.2</li>
</ul>
-<h3 id="description-53">Description</h3>
+<h3 id="description-54">Description</h3>
<p>The Event Log detail endpoint <code>GET /api/v2/eventLogs/{event_log_id}</code> in Apache Airflow fetched audit-log rows directly by numeric ID after only the generic Audit Log permission check, while the collection endpoint <code>GET /api/v2/eventLogs</code> applied per-Dag scoping. An authenticated UI/API user with audit-log read permission for one Dag could retrieve audit-log entries for any other Dag by guessing or enumerating the numeric event log ID. Affects deployments that rel [...]
-<h3 id="references-53">References</h3>
+<h3 id="references-54">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67112">https://github.com/apache/airflow/pull/67112</a></li>
<li><a href="https://lists.apache.org/thread/ctrbj7q3m86g4qxmo9ponojgmzrcoqpv">https://lists.apache.org/thread/ctrbj7q3m86g4qxmo9ponojgmzrcoqpv</a></li>
</ul>
-<h3 id="credits-53">Credits</h3>
+<h3 id="credits-54">Credits</h3>
<ul>
<li>Stoyan Stoyanov Trendafilov (trstoyan), independent security researcher (finder)</li>
<li>Pierre Jeambrun (@pierrejeambrun) (remediation developer)</li>
@@ -1181,18 +1201,18 @@
<h2 id="CVE-2026-46745">LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token</h2>
<p>CVE-2026-46745 <a href="https://cve.org/CVERecord?id=CVE-2026-46745">[CVE]</a> <a href="./CVE-2026-46745.cve.json">[CVE json]</a> <a href="./CVE-2026-46745.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-25T11:30:22.680Z</em></p>
-<h3 id="affected-54">Affected</h3>
+<h3 id="affected-55">Affected</h3>
<ul>
<li>Apache Airflow FAB provider before 3.6.4</li>
</ul>
-<h3 id="description-54">Description</h3>
+<h3 id="description-55">Description</h3>
<p>Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.</p>
-<h3 id="references-54">References</h3>
+<h3 id="references-55">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/66417">https://github.com/apache/airflow/pull/66417</a></li>
<li><a href="https://lists.apache.org/thread/dvfy0bs181xwsrjrd3y5c55ztbzm8yhh">https://lists.apache.org/thread/dvfy0bs181xwsrjrd3y5c55ztbzm8yhh</a></li>
</ul>
-<h3 id="credits-54">Credits</h3>
+<h3 id="credits-55">Credits</h3>
<ul>
<li>Venkatraman Kumar (r3dw0lfsec), Securin (finder)</li>
<li>orbisai0security (automated scanner — Orbis Security AI) (remediation developer)</li>
@@ -1200,18 +1220,18 @@
<h2 id="CVE-2026-45426">Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access</h2>
<p>CVE-2026-45426 <a href="https://cve.org/CVERecord?id=CVE-2026-45426">[CVE]</a> <a href="./CVE-2026-45426.cve.json">[CVE json]</a> <a href="./CVE-2026-45426.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:47:13.162Z</em></p>
-<h3 id="affected-55">Affected</h3>
+<h3 id="affected-56">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.2</li>
</ul>
-<h3 id="description-55">Description</h3>
+<h3 id="description-56">Description</h3>
<p>Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued for at least one Dag. Apache Airflow's Log server authorized JWT tokens against Dag IDs by applying Python's <code>str.lstrip()</code> to the requested path segment when verifying the JWT's <code>sub</code> claim. <code>str.lstrip()</code> strips any of a <em>set</em> of characters from the left (not a prefix), so a JWT issued for a Dag named e.g. <code>dag_a</code> w [...]
-<h3 id="references-55">References</h3>
+<h3 id="references-56">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/66749">https://github.com/apache/airflow/pull/66749</a></li>
<li><a href="https://lists.apache.org/thread/hz1q7vg65vq2h4fobv5ww8tp257fbqj9">https://lists.apache.org/thread/hz1q7vg65vq2h4fobv5ww8tp257fbqj9</a></li>
</ul>
-<h3 id="credits-55">Credits</h3>
+<h3 id="credits-56">Credits</h3>
<ul>
<li>Michael Lip (theluckystrike) (finder)</li>
<li>Jarek Potiuk (@potiuk) (remediation developer)</li>
@@ -1219,18 +1239,18 @@
<h2 id="CVE-2026-45361">SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)</h2>
<p>CVE-2026-45361 <a href="https://cve.org/CVERecord?id=CVE-2026-45361">[CVE]</a> <a href="./CVE-2026-45361.cve.json">[CVE json]</a> <a href="./CVE-2026-45361.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T15:48:33.023Z</em></p>
-<h3 id="affected-56">Affected</h3>
+<h3 id="affected-57">Affected</h3>
<ul>
<li>Apache Airflow Google provider before 22.0.0</li>
</ul>
-<h3 id="description-56">Description</h3>
+<h3 id="description-57">Description</h3>
<p>Apache Airflow providers-google's <code>ComputeEngineSSHHook</code> disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to <code>apache-airflow-providers-google</code> 22.0.0 or later.</p>
-<h3 id="references-56">References</h3>
+<h3 id="references-57">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/66746">https://github.com/apache/airflow/pull/66746</a></li>
<li><a href="https://lists.apache.org/thread/3lpj7ppwxp7jtp81rnxk75xvln7qd7h2?users@airflow.apache.org">https://lists.apache.org/thread/3lpj7ppwxp7jtp81rnxk75xvln7qd7h2?users@airflow.apache.org</a></li>
</ul>
-<h3 id="credits-56">Credits</h3>
+<h3 id="credits-57">Credits</h3>
<ul>
<li>anonymous (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -1238,36 +1258,36 @@
<h2 id="CVE-2026-45360">Arbitrary import in custom deadline-reference deserialization</h2>
<p>CVE-2026-45360 <a href="https://cve.org/CVERecord?id=CVE-2026-45360">[CVE]</a> <a href="./CVE-2026-45360.cve.json">[CVE json]</a> <a href="./CVE-2026-45360.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:48:10.959Z</em></p>
-<h3 id="affected-57">Affected</h3>
+<h3 id="affected-58">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.2</li>
</ul>
-<h3 id="description-57">Description</h3>
+<h3 id="description-58">Description</h3>
<p>Apache Airflow's scheduler-side deadline-reference decoder (<code>SerializedCustomReference.deserialize_reference</code>) imported and dispatched arbitrary class paths drawn from DAG-author-controlled serialized state without an allowlist or plugin-registry gate. A DAG author whose code reaches the scheduler — the default on single-host deployments where the DAG bundle is importable from the scheduler process — could embed a custom <code>DeadlineReference</code> whose serialized form [...]
-<h3 id="references-57">References</h3>
+<h3 id="references-58">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/66737">https://github.com/apache/airflow/pull/66737</a></li>
<li><a href="https://lists.apache.org/thread/q227dghjwgfz8xsxrf2pwpz4wk43zm83">https://lists.apache.org/thread/q227dghjwgfz8xsxrf2pwpz4wk43zm83</a></li>
</ul>
-<h3 id="credits-57">Credits</h3>
+<h3 id="credits-58">Credits</h3>
<ul>
<li>Jarek Potiuk (remediation developer)</li>
</ul>
<h2 id="CVE-2026-45192">Incomplete Redaction of Sensitive Fields in Connection Extra API Response</h2>
<p>CVE-2026-45192 <a href="https://cve.org/CVERecord?id=CVE-2026-45192">[CVE]</a> <a href="./CVE-2026-45192.cve.json">[CVE json]</a> <a href="./CVE-2026-45192.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T06:51:50.457Z</em></p>
-<h3 id="affected-58">Affected</h3>
+<h3 id="affected-59">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.2</li>
</ul>
-<h3 id="description-58">Description</h3>
+<h3 id="description-59">Description</h3>
<p>A bug in the GET <code>/api/v2/connections/{connection_id}</code> REST API endpoint in Apache Airflow allowed an authenticated UI/API user with Connection-read permission to retrieve secrets stored in a Connection's <code>extra</code> JSON blob under field names not present in the redaction allowlist (<code>DEFAULT_SENSITIVE_FIELDS</code>) — for example, official Slack-provider credential field names were returned in plaintext. Affects deployments that store credentials in Connection [...]
-<h3 id="references-58">References</h3>
+<h3 id="references-59">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/66673">https://github.com/apache/airflow/pull/66673</a></li>
<li><a href="https://lists.apache.org/thread/r2q93dg2wp5h9sd9vh6y4y5ljqd9crdd">https://lists.apache.org/thread/r2q93dg2wp5h9sd9vh6y4y5ljqd9crdd</a></li>
</ul>
-<h3 id="credits-58">Credits</h3>
+<h3 id="credits-59">Credits</h3>
<ul>
<li>Or Sahar, Secure From Scratch (finder)</li>
<li>Jarek Potiuk (@potiuk) (remediation developer)</li>
@@ -1275,18 +1295,18 @@
<h2 id="CVE-2026-43826">OpenSearch task-log handler leaks credentials embedded in the host URL</h2>
<p>CVE-2026-43826 <a href="https://cve.org/CVERecord?id=CVE-2026-43826">[CVE]</a> <a href="./CVE-2026-43826.cve.json">[CVE json]</a> <a href="./CVE-2026-43826.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-10T20:27:25.758Z</em></p>
-<h3 id="affected-59">Affected</h3>
+<h3 id="affected-60">Affected</h3>
<ul>
<li>Apache Airflow Providers OpenSearch before 1.9.1</li>
</ul>
-<h3 id="description-59">Description</h3>
+<h3 id="description-60">Description</h3>
<p>The OpenSearch logging provider, when configured with a <code>host</code> URL that embeds credentials (for example <code>https://user:password@server.example.com:9200</code>), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to <code>apache-airflow-providers-opensearch</code> 1.9.1 or later and, as a defense-in-depth measure, configure the backend cr [...]
-<h3 id="references-59">References</h3>
+<h3 id="references-60">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65509">https://github.com/apache/airflow/pull/65509</a></li>
<li><a href="https://lists.apache.org/thread/bxsrqx1vwssovnwnrvgh9xcosptmf73y">https://lists.apache.org/thread/bxsrqx1vwssovnwnrvgh9xcosptmf73y</a></li>
</ul>
-<h3 id="credits-59">Credits</h3>
+<h3 id="credits-60">Credits</h3>
<ul>
<li>Aleksandr Sozinov (finder)</li>
<li>Owen-CH-Leung (finder)</li>
@@ -1295,36 +1315,36 @@
<h2 id="CVE-2026-42526">Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends</h2>
<p>CVE-2026-42526 <a href="https://cve.org/CVERecord?id=CVE-2026-42526">[CVE]</a> <a href="./CVE-2026-42526.cve.json">[CVE json]</a> <a href="./CVE-2026-42526.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-20T01:48:06.454Z</em></p>
-<h3 id="affected-60">Affected</h3>
+<h3 id="affected-61">Affected</h3>
<ul>
<li>Apache Airflow Amazon provider before 9.28.0</li>
</ul>
-<h3 id="description-60">Description</h3>
+<h3 id="description-61">Description</h3>
<p>In the AWS Secrets Manager and SSM Parameter Store secrets backends of <code>apache-airflow-providers-amazon</code> prior to 9.28.0, the team-scoping logic could resolve a <code>conn_id</code> containing a <code>/</code> (e.g. <code>&quot;my_team/conn&quot;</code>) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding <code>conn_i [...]
-<h3 id="references-60">References</h3>
+<h3 id="references-61">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65703">https://github.com/apache/airflow/pull/65703</a></li>
<li><a href="https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtyn">https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtyn</a></li>
</ul>
-<h3 id="credits-60">Credits</h3>
+<h3 id="credits-61">Credits</h3>
<ul>
<li>Justin Pakzad (remediation developer)</li>
</ul>
<h2 id="CVE-2026-42360">Rendered template truncation bypasses nested sensitive-key masking</h2>
<p>CVE-2026-42360 <a href="https://cve.org/CVERecord?id=CVE-2026-42360">[CVE]</a> <a href="./CVE-2026-42360.cve.json">[CVE json]</a> <a href="./CVE-2026-42360.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:50:36.896Z</em></p>
-<h3 id="affected-61">Affected</h3>
+<h3 id="affected-62">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.2</li>
</ul>
-<h3 id="description-61">Description</h3>
+<h3 id="description-62">Description</h3>
<p>A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g. nested <code>password</code> / <code>token</code> / <code>secret</code> / <code>api_key</code> keys inside a JSON template structure) to be bypassed when the rendered field exceeded <code>[core] max_templated_field_length</code>: Airflow stringified the structure before redaction, losing the nested key context, and persisted the plaintext value into <code>rendered_fields</code>. An aut [...]
-<h3 id="references-61">References</h3>
+<h3 id="references-62">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65906">https://github.com/apache/airflow/pull/65906</a></li>
<li><a href="https://lists.apache.org/thread/obj79bpxnl7r5olz1gsn0g94y88glnl4">https://lists.apache.org/thread/obj79bpxnl7r5olz1gsn0g94y88glnl4</a></li>
</ul>
-<h3 id="credits-61">Credits</h3>
+<h3 id="credits-62">Credits</h3>
<ul>
<li>Vincent55 (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -1332,19 +1352,19 @@
<h2 id="CVE-2026-42359">Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator</h2>
<p>CVE-2026-42359 <a href="https://cve.org/CVERecord?id=CVE-2026-42359">[CVE]</a> <a href="./CVE-2026-42359.cve.json">[CVE json]</a> <a href="./CVE-2026-42359.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T15:13:25.919Z</em></p>
-<h3 id="affected-62">Affected</h3>
+<h3 id="affected-63">Affected</h3>
<ul>
<li>Apache Airflow from 3.2.0 before 3.2.2</li>
</ul>
-<h3 id="description-62">Description</h3>
+<h3 id="description-63">Description</h3>
<p>A bug in Apache Airflow's XCom PATCH endpoint <code>PATCH /api/v2/xcomEntries/{key}</code> allowed an authenticated UI/API user with XCom write permission on a Dag to set XCom entries under reserved key names (e.g. <code>return_value</code>) that the matching POST endpoint already validated against <code>FORBIDDEN_XCOM_KEYS</code>. The endpoint also accepted serialized payload shapes the triggerer's deserializer treats as code; combined, this allowed RCE on the triggerer when the affe [...]
-<h3 id="references-62">References</h3>
+<h3 id="references-63">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65915">https://github.com/apache/airflow/pull/65915</a></li>
<li><a href="https://lists.apache.org/thread/g8dqykpf1p90tysq8tln4qtkqwb1038s">https://lists.apache.org/thread/g8dqykpf1p90tysq8tln4qtkqwb1038s</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-33858">https://www.cve.org/CVERecord?id=CVE-2026-33858</a></li>
</ul>
-<h3 id="credits-62">Credits</h3>
+<h3 id="credits-63">Credits</h3>
<ul>
<li>Jeff Vier (@boinger) (finder)</li>
<li>Anisto Mejin (Izat) (finder)</li>
@@ -1354,18 +1374,18 @@
<h2 id="CVE-2026-42358">Variable masker depth-limit bypass returns cleartext nested secrets</h2>
<p>CVE-2026-42358 <a href="https://cve.org/CVERecord?id=CVE-2026-42358">[CVE]</a> <a href="./CVE-2026-42358.cve.json">[CVE json]</a> <a href="./CVE-2026-42358.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:49:56.426Z</em></p>
-<h3 id="affected-63">Affected</h3>
+<h3 id="affected-64">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.2</li>
</ul>
-<h3 id="description-63">Description</h3>
+<h3 id="description-64">Description</h3>
<p>A bug in Apache Airflow's Variable response masker caused nested-key redaction (triggered by secret-suffixed key names like <code>password</code>, <code>token</code>, <code>secret</code>, <code>api_key</code>) to be bypassed when the JSON value's nesting depth exceeded the shared secrets masker's recursion limit: the masker returned the original nested item before checking the sensitive key name. An authenticated UI/API user with Variable read permission could harvest plaintext secret [...]
-<h3 id="references-63">References</h3>
+<h3 id="references-64">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65912">https://github.com/apache/airflow/pull/65912</a></li>
<li><a href="https://lists.apache.org/thread/33635mv3zjb75wn5453c5yf9trs8x2om">https://lists.apache.org/thread/33635mv3zjb75wn5453c5yf9trs8x2om</a></li>
</ul>
-<h3 id="credits-63">Credits</h3>
+<h3 id="credits-64">Credits</h3>
<ul>
<li>Vincent55 (confirmed in original report sign-off) (finder)</li>
<li>Aymane MAZGUITI – unclej4ck (finder)</li>
@@ -1375,18 +1395,18 @@
<h2 id="CVE-2026-42252">BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern</h2>
<p>CVE-2026-42252 <a href="https://cve.org/CVERecord?id=CVE-2026-42252">[CVE]</a> <a href="./CVE-2026-42252.cve.json">[CVE json]</a> <a href="./CVE-2026-42252.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:51:17.651Z</em></p>
-<h3 id="affected-64">Affected</h3>
+<h3 id="affected-65">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.2</li>
</ul>
-<h3 id="description-64">Description</h3>
+<h3 id="description-65">Description</h3>
<p>Apache Airflow's official documentation at <code>core-concepts/dag-run.html</code> ("Passing Parameters when triggering Dags") showed a verbatim <code>BashOperator(bash_command=&quot;echo value: {{ dag_run.conf[&#x27;conf1&#x27;] }}&quot;)</code> example without any quoting / sanitization warning. Dag authors who copied the pattern verbatim into deployments where users had <code>Dag.can_trigger</code> permission on the affected Dag (typical multi-team deploym [...]
-<h3 id="references-64">References</h3>
+<h3 id="references-65">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/64129">https://github.com/apache/airflow/pull/64129</a></li>
<li><a href="https://lists.apache.org/thread/8f4sc0rfn154jprmnwtmlst4p9zfw3w7">https://lists.apache.org/thread/8f4sc0rfn154jprmnwtmlst4p9zfw3w7</a></li>
</ul>
-<h3 id="credits-64">Credits</h3>
+<h3 id="credits-65">Credits</h3>
<ul>
<li>anonymous (finder)</li>
<li>Kevin Yang (sjyangkevin) (remediation developer)</li>
@@ -1394,18 +1414,18 @@
<h2 id="CVE-2026-41084">API authorization bypass: bulk TaskInstances allows cross-DAG mutation</h2>
<p>CVE-2026-41084 <a href="https://cve.org/CVERecord?id=CVE-2026-41084">[CVE]</a> <a href="./CVE-2026-41084.cve.json">[CVE json]</a> <a href="./CVE-2026-41084.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:51:55.264Z</em></p>
-<h3 id="affected-65">Affected</h3>
+<h3 id="affected-66">Affected</h3>
<ul>
<li>Apache Airflow from 3.2.0 before 3.2.2</li>
</ul>
-<h3 id="description-65">Description</h3>
+<h3 id="description-66">Description</h3>
<p>A bug in Apache Airflow's bulk Task Instances API (<code>PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances</code>) evaluated authorization against the <code>dag_id</code> resolved from the URL path while operating on the <code>dag_id</code> / <code>dag_run_id</code> extracted from request-body entity fields. An authenticated UI/API user with edit permission on one Dag could mutate Task Instance state in any other Dag by keeping the authorized Dag's ID in the URL pa [...]
-<h3 id="references-65">References</h3>
+<h3 id="references-66">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/64288">https://github.com/apache/airflow/pull/64288</a></li>
<li><a href="https://lists.apache.org/thread/w0hdcqfr71hf9rl1bwvpjs7q9yp1bldk">https://lists.apache.org/thread/w0hdcqfr71hf9rl1bwvpjs7q9yp1bldk</a></li>
</ul>
-<h3 id="credits-65">Credits</h3>
+<h3 id="credits-66">Credits</h3>
<ul>
<li>Pirikara (finder)</li>
<li>GPK (gopidesupavan) (remediation developer)</li>
@@ -1413,18 +1433,18 @@
<h2 id="CVE-2026-41018">Elasticsearch task-log handler leaks credentials embedded in the host URL</h2>
<p>CVE-2026-41018 <a href="https://cve.org/CVERecord?id=CVE-2026-41018">[CVE]</a> <a href="./CVE-2026-41018.cve.json">[CVE json]</a> <a href="./CVE-2026-41018.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-10T20:38:57.776Z</em></p>
-<h3 id="affected-66">Affected</h3>
+<h3 id="affected-67">Affected</h3>
<ul>
<li>Apache Airflow Providers Elasticsearch before 6.5.3</li>
</ul>
-<h3 id="description-66">Description</h3>
+<h3 id="description-67">Description</h3>
<p>The Elasticsearch logging provider, when configured with a <code>host</code> URL that embeds credentials (for example <code>https://user:password@server.example.com:9200</code>), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to <code>apache-airflow-providers-elasticsearch</code> 6.5.3 or later and, as a defense-in-depth measure, configure the back [...]
-<h3 id="references-66">References</h3>
+<h3 id="references-67">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65349">https://github.com/apache/airflow/pull/65349</a></li>
<li><a href="https://lists.apache.org/thread/wz5l58drprmwlv6jxnq466x24jqbbhp7">https://lists.apache.org/thread/wz5l58drprmwlv6jxnq466x24jqbbhp7</a></li>
</ul>
-<h3 id="credits-66">Credits</h3>
+<h3 id="credits-67">Credits</h3>
<ul>
<li>Aleksandr Sozinov (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -1432,18 +1452,18 @@
<h2 id="CVE-2026-41017">JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy</h2>
<p>CVE-2026-41017 <a href="https://cve.org/CVERecord?id=CVE-2026-41017">[CVE]</a> <a href="./CVE-2026-41017.cve.json">[CVE json]</a> <a href="./CVE-2026-41017.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:52:32.340Z</em></p>
-<h3 id="affected-67">Affected</h3>
+<h3 id="affected-68">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.2</li>
</ul>
-<h3 id="description-67">Description</h3>
+<h3 id="description-68">Description</h3>
<p>Apache Airflow's <code>JWTRefreshMiddleware</code> set the JWT auth cookie without the <code>Secure</code> flag, so deployments running the Airflow API server behind an HTTPS-terminating reverse proxy (e.g. nginx / Envoy / a managed load balancer that terminates TLS and forwards plaintext to the API server, the default cloud-native topology) would have the user's session JWT replayed over any cleartext HTTP request to the same host. A network-positioned attacker (Wi-Fi MITM, hostile L [...]
-<h3 id="references-67">References</h3>
+<h3 id="references-68">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65348">https://github.com/apache/airflow/pull/65348</a></li>
<li><a href="https://lists.apache.org/thread/9jx0sk49c1250zflx0q3clc717qgjdch">https://lists.apache.org/thread/9jx0sk49c1250zflx0q3clc717qgjdch</a></li>
</ul>
-<h3 id="credits-67">Credits</h3>
+<h3 id="credits-68">Credits</h3>
<ul>
<li>Ran (@eddieran) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -1451,18 +1471,18 @@
<h2 id="CVE-2026-41016">No certificate validation on SMTP STARTTLS connections (SMTP provider — split from #265) ##</h2>
<p>CVE-2026-41016 <a href="https://cve.org/CVERecord?id=CVE-2026-41016">[CVE]</a> <a href="./CVE-2026-41016.cve.json">[CVE json]</a> <a href="./CVE-2026-41016.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-29T08:45:19.890Z</em></p>
-<h3 id="affected-68">Affected</h3>
+<h3 id="affected-69">Affected</h3>
<ul>
<li>Apache Airflow Providers SMTP from 2.0.0 before 3.0.0</li>
</ul>
-<h3 id="description-68">Description</h3>
+<h3 id="description-69">Description</h3>
<p>Apache Airflow's SMTP provider <code>SmtpHook</code> called Python's <code>smtplib.SMTP.starttls()</code> without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS upgrade, and capture the SMTP credentials sent during the subsequent <code>login()</code> call. Users are advised to upgrade to the <code>apache-airflow-providers-smt [...]
-<h3 id="references-68">References</h3>
+<h3 id="references-69">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65346">https://github.com/apache/airflow/pull/65346</a></li>
<li><a href="https://lists.apache.org/thread/gb202qy5r31bgdd3d51d7s5o1jh40kc4">https://lists.apache.org/thread/gb202qy5r31bgdd3d51d7s5o1jh40kc4</a></li>
</ul>
-<h3 id="credits-68">Credits</h3>
+<h3 id="credits-69">Credits</h3>
<ul>
<li>Francis Bergin (@francisbergin) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -1470,18 +1490,18 @@
<h2 id="CVE-2026-41014">per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints</h2>
<p>CVE-2026-41014 <a href="https://cve.org/CVERecord?id=CVE-2026-41014">[CVE]</a> <a href="./CVE-2026-41014.cve.json">[CVE json]</a> <a href="./CVE-2026-41014.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:53:50.879Z</em></p>
-<h3 id="affected-69">Affected</h3>
+<h3 id="affected-70">Affected</h3>
<ul>
<li>Apache Airflow from 3.2.0 before 3.2.2</li>
</ul>
-<h3 id="description-69">Description</h3>
+<h3 id="description-70">Description</h3>
<p>The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization. An authenticated UI/API user with global Asset:read permission could enumerate partition run state, schedule configuration, and asset wiring for Dags they were not authorized to read. Affects deployments that rely on per-Dag read scoping while granting users broader Asset access. Users are advised to upgrade to <code>apache-airflow</code> 3.2.2 or later.</p>
-<h3 id="references-69">References</h3>
+<h3 id="references-70">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65344">https://github.com/apache/airflow/pull/65344</a></li>
<li><a href="https://lists.apache.org/thread/12nbzwwby7g883w2j13gn7ny1545xob9">https://lists.apache.org/thread/12nbzwwby7g883w2j13gn7ny1545xob9</a></li>
</ul>
-<h3 id="credits-69">Credits</h3>
+<h3 id="credits-70">Credits</h3>
<ul>
<li>Yalguun Tumenkhuu (fg0x0) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -1489,18 +1509,18 @@
<h2 id="CVE-2026-40963">DAG authorization bypass on /ui/structure/structure_data</h2>
<p>CVE-2026-40963 <a href="https://cve.org/CVERecord?id=CVE-2026-40963">[CVE]</a> <a href="./CVE-2026-40963.cve.json">[CVE json]</a> <a href="./CVE-2026-40963.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:54:32.443Z</em></p>
-<h3 id="affected-70">Affected</h3>
+<h3 id="affected-71">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.2</li>
</ul>
-<h3 id="description-70">Description</h3>
+<h3 id="description-71">Description</h3>
<p>The structure_data endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking whether the caller had read permission on those linked Dags. An authenticated UI/API user authorized for one Dag could enumerate linked Dag IDs and dependency metadata for other Dags they were not authorized to read. Affects deployments that rely on per-Dag read scoping to keep Dag dependency topology private across teams. Users are advised to upgrade to <code>apache [...]
-<h3 id="references-70">References</h3>
+<h3 id="references-71">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65342">https://github.com/apache/airflow/pull/65342</a></li>
<li><a href="https://lists.apache.org/thread/s907bhsksc37m59f0loqjcp1ryobrr60">https://lists.apache.org/thread/s907bhsksc37m59f0loqjcp1ryobrr60</a></li>
</ul>
-<h3 id="credits-70">Credits</h3>
+<h3 id="credits-71">Credits</h3>
<ul>
<li>Masamune - Unit515 OPSWAT (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -1508,18 +1528,18 @@
<h2 id="CVE-2026-40961">Open Redirect Bypass Vulnerability</h2>
<p>CVE-2026-40961 <a href="https://cve.org/CVERecord?id=CVE-2026-40961">[CVE]</a> <a href="./CVE-2026-40961.cve.json">[CVE json]</a> <a href="./CVE-2026-40961.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:55:03.222Z</em></p>
-<h3 id="affected-71">Affected</h3>
+<h3 id="affected-72">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.2</li>
</ul>
-<h3 id="description-71">Description</h3>
+<h3 id="description-72">Description</h3>
<p>A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the <code>is_safe_url</code> check, enabling redirection from a trusted Airflow domain to an attacker-controlled origin. Users are advised to upgrade to <code>apache-airflow</code> 3.2.2 or later. As a defense-in-depth mitigation, deployment operators can place Airflow behind a reverse proxy that strips off-domain <code>next=</code> query parameters before they reach the login e [...]
-<h3 id="references-71">References</h3>
+<h3 id="references-72">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65557">https://github.com/apache/airflow/pull/65557</a></li>
<li><a href="https://lists.apache.org/thread/qmt8ksh7gty6b8hr9w294t94j36jdv1q">https://lists.apache.org/thread/qmt8ksh7gty6b8hr9w294t94j36jdv1q</a></li>
</ul>
-<h3 id="credits-71">Credits</h3>
+<h3 id="credits-72">Credits</h3>
<ul>
<li>Fushuling@secsys (finder)</li>
<li>RacerZ@secsys (finder)</li>
@@ -1528,36 +1548,36 @@
<h2 id="CVE-2026-40948">OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager</h2>
<p>CVE-2026-40948 <a href="https://cve.org/CVERecord?id=CVE-2026-40948">[CVE]</a> <a href="./CVE-2026-40948.cve.json">[CVE json]</a> <a href="./CVE-2026-40948.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-19T23:44:07.936Z</em></p>
-<h3 id="affected-72">Affected</h3>
+<h3 id="affected-73">Affected</h3>
<ul>
<li>Apache Airflow Providers Keycloak from 0.0.1 before 0.7.0</li>
</ul>
-<h3 id="description-72">Description</h3>
+<h3 id="description-73">Description</h3>
<p>The Keycloak authentication manager in <code>apache-airflow-providers-keycloak</code> did not generate or validate the OAuth 2.0 <code>state</code> parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim’s browser and cause the victim to be logged into the attacker’s Airflow session (login-CSRF / session fixation), where any credentials the victim subsequently [...]
-<h3 id="references-72">References</h3>
+<h3 id="references-73">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/64114">https://github.com/apache/airflow/pull/64114</a></li>
<li><a href="https://lists.apache.org/thread/kc0odpr70hbqhdb9ksnz42fkqz2xld9q">https://lists.apache.org/thread/kc0odpr70hbqhdb9ksnz42fkqz2xld9q</a></li>
</ul>
-<h3 id="credits-72">Credits</h3>
+<h3 id="credits-73">Credits</h3>
<ul>
<li>Haruki Oyama (Waseda University) (finder)</li>
</ul>
<h2 id="CVE-2026-40861">Arbitrary File Read via Log Symlink following in FileTaskHandler</h2>
<p>CVE-2026-40861 <a href="https://cve.org/CVERecord?id=CVE-2026-40861">[CVE]</a> <a href="./CVE-2026-40861.cve.json">[CVE json]</a> <a href="./CVE-2026-40861.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:55:36.142Z</em></p>
-<h3 id="affected-73">Affected</h3>
+<h3 id="affected-74">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.2</li>
</ul>
-<h3 id="description-73">Description</h3>
+<h3 id="description-74">Description</h3>
<p>A Dag author could either (a) create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process (read-path attack — e.g. <code>/etc/passwd</code> or <code>airflow.cfg</code>) or (b) supply a <code>task_id</code> containing <code>..</code> sequences accepted by the Task SDK's <code>KEY_REGEX</code> (write-path attack), and in both cases the FileTaskHandler resolves the log path outside the configured <code>base_log_folder</code>, leaking [...]
-<h3 id="references-73">References</h3>
+<h3 id="references-74">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65325">https://github.com/apache/airflow/pull/65325</a></li>
<li><a href="https://lists.apache.org/thread/823334db2559xjlwt59gpzjz47thnscl">https://lists.apache.org/thread/823334db2559xjlwt59gpzjz47thnscl</a></li>
</ul>
-<h3 id="credits-73">Credits</h3>
+<h3 id="credits-74">Credits</h3>
<ul>
<li>Silas Boch (finder)</li>
<li>Lakshmikanthan K (letchupkt) (finder)</li>
@@ -1566,18 +1586,18 @@
<h2 id="CVE-2026-40690">Assets graph view bypasses DAG level access control displaying unrelated topologies and all DAGs names to unauthorized users</h2>
<p>CVE-2026-40690 <a href="https://cve.org/CVERecord?id=CVE-2026-40690">[CVE]</a> <a href="./CVE-2026-40690.cve.json">[CVE json]</a> <a href="./CVE-2026-40690.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-24T12:35:28.702Z</em></p>
-<h3 id="affected-74">Affected</h3>
+<h3 id="affected-75">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.1</li>
</ul>
-<h3 id="description-74">Description</h3>
+<h3 id="description-75">Description</h3>
<p>The asset dependency graph did not restrict nodes by the viewer’s DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment and learn the existence and names of DAGs and assets outside their authorized scope.<br><br>Users are recommended to upgrade to version 3.2.1, which fixes this issue.<br></p>
-<h3 id="references-74">References</h3>
+<h3 id="references-75">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65273">https://github.com/apache/airflow/pull/65273</a></li>
<li><a href="https://lists.apache.org/thread/bqt7y4g2cpj396b0sd20lv510ff19ndl">https://lists.apache.org/thread/bqt7y4g2cpj396b0sd20lv510ff19ndl</a></li>
</ul>
-<h3 id="credits-74">Credits</h3>
+<h3 id="credits-75">Credits</h3>
<ul>
<li>Saurabh (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -1585,18 +1605,18 @@
<h2 id="CVE-2026-38743">Dags endpoint might provide access to otherwise inaccessible entities</h2>
<p>CVE-2026-38743 <a href="https://cve.org/CVERecord?id=CVE-2026-38743">[CVE]</a> <a href="./CVE-2026-38743.cve.json">[CVE json]</a> <a href="./CVE-2026-38743.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-24T12:36:37.917Z</em></p>
-<h3 id="affected-75">Affected</h3>
+<h3 id="affected-76">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.1</li>
</ul>
-<h3 id="description-75">Description</h3>
+<h3 id="description-76">Description</h3>
<p></p><span style="background-color: rgb(255, 255, 255);">The authenticated </span><code>/ui/dags</code><span style="background-color: rgb(255, 255, 255);"> endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance records: a logged-in Airflow user with read access to at least one DAG could retrieve HITL prompts (including their request parameters) and full TaskInstance details for DAGs outside their authorized scope. Because HITL prompts [...]
-<h3 id="references-75">References</h3>
+<h3 id="references-76">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/64822">https://github.com/apache/airflow/pull/64822</a></li>
<li><a href="https://lists.apache.org/thread/sk2wj0x48o8qb4p7c47gvnhjbm0mg396">https://lists.apache.org/thread/sk2wj0x48o8qb4p7c47gvnhjbm0mg396</a></li>
</ul>
-<h3 id="credits-75">Credits</h3>
+<h3 id="credits-76">Credits</h3>
<ul>
<li>Jed Cunningham (finder)</li>
<li>Kevin Yang (remediation developer)</li>
@@ -1604,18 +1624,18 @@
<h2 id="CVE-2026-34538">Authorization bypass in DagRun wait endpoint (XCom exposure)</h2>
<p>CVE-2026-34538 <a href="https://cve.org/CVERecord?id=CVE-2026-34538">[CVE]</a> <a href="./CVE-2026-34538.cve.json">[CVE json]</a> <a href="./CVE-2026-34538.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-09T09:09:19.260Z</em></p>
-<h3 id="affected-76">Affected</h3>
+<h3 id="affected-77">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.0</li>
</ul>
-<h3 id="description-76">Description</h3>
+<h3 id="description-77">Description</h3>
<p>Apache Airflow versions 3.0.0 through 3.1.8 <span style="background-color: rgb(255, 255, 255);">DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.<span style="background-color: rgb(255, 255, 255);">This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security model documentation that defines the Viewer role as read-only.</span><br></span><br><span st [...]
-<h3 id="references-76">References</h3>
+<h3 id="references-77">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/64415">https://github.com/apache/airflow/pull/64415</a></li>
<li><a href="https://lists.apache.org/thread/9mq3msqhmgjwdzbr6bgthj4brb3oz9fl">https://lists.apache.org/thread/9mq3msqhmgjwdzbr6bgthj4brb3oz9fl</a></li>
</ul>
-<h3 id="credits-76">Credits</h3>
+<h3 id="credits-77">Credits</h3>
<ul>
<li>selen (finder)</li>
<li>Kevin Yang (remediation developer)</li>
@@ -1623,18 +1643,18 @@
<h2 id="CVE-2026-33858">Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API</h2>
<p>CVE-2026-33858 <a href="https://cve.org/CVERecord?id=CVE-2026-33858">[CVE]</a> <a href="./CVE-2026-33858.cve.json">[CVE json]</a> <a href="./CVE-2026-33858.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-13T14:36:29.251Z</em></p>
-<h3 id="affected-77">Affected</h3>
+<h3 id="affected-78">Affected</h3>
<ul>
<li>Apache Airflow from 3.1.8 before 3.2.0</li>
</ul>
-<h3 id="description-77">Description</h3>
+<h3 id="description-78">Description</h3>
<p>Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low.</p><br>Users are recommended to upgrade to Apache Airflow 3.2.0, which resolves this issue.<br><br><br><br>
-<h3 id="references-77">References</h3>
+<h3 id="references-78">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/64148">https://github.com/apache/airflow/pull/64148</a></li>
<li><a href="https://lists.apache.org/thread/1npt3o2x81s0gw9tmfcv4n7p1z9hdmy0">https://lists.apache.org/thread/1npt3o2x81s0gw9tmfcv4n7p1z9hdmy0</a></li>
</ul>
-<h3 id="credits-77">Credits</h3>
+<h3 id="credits-78">Credits</h3>
<ul>
<li>wooseokdotkim (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -1642,19 +1662,19 @@
<h2 id="CVE-2026-33264">DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()</h2>
<p>CVE-2026-33264 <a href="https://cve.org/CVERecord?id=CVE-2026-33264">[CVE]</a> <a href="./CVE-2026-33264.cve.json">[CVE json]</a> <a href="./CVE-2026-33264.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-07-07T12:25:55.676Z</em></p>
-<h3 id="affected-78">Affected</h3>
+<h3 id="affected-79">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.0</li>
</ul>
-<h3 id="description-78">Description</h3>
+<h3 id="description-79">Description</h3>
<p>A bug in <code>BaseSerialization.deserialize()</code> allowed unrestricted <code>import_string()</code> of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Users are advised to upgrade to <code>apache-airflow</code> 3.3.0 or [...]
-<h3 id="references-78">References</h3>
+<h3 id="references-79">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/66002">https://github.com/apache/airflow/pull/66002</a></li>
<li><a href="https://github.com/apache/airflow/pull/68528">https://github.com/apache/airflow/pull/68528</a></li>
<li><a href="https://lists.apache.org/thread/otvdw8qt2y7xy2n5nq9xby9ky4rf5ltj">https://lists.apache.org/thread/otvdw8qt2y7xy2n5nq9xby9ky4rf5ltj</a></li>
</ul>
-<h3 id="credits-78">Credits</h3>
+<h3 id="credits-79">Credits</h3>
<ul>
<li>Ziyu Lin (finder)</li>
<li>bugbunny.ai (tool)</li>
@@ -1666,18 +1686,18 @@
<h2 id="CVE-2026-32794">TLS Certificate Verification Disabled in Databricks Provider K8s Token Exchange</h2>
<p>CVE-2026-32794 <a href="https://cve.org/CVERecord?id=CVE-2026-32794">[CVE]</a> <a href="./CVE-2026-32794.cve.json">[CVE json]</a> <a href="./CVE-2026-32794.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-30T21:43:36.022Z</em></p>
-<h3 id="affected-79">Affected</h3>
+<h3 id="affected-80">Affected</h3>
<ul>
<li>Apache Airflow Provider for Databricks from 1.10.0 before 1.12.0</li>
</ul>
-<h3 id="description-79">Description</h3>
+<h3 id="description-80">Description</h3>
<p>Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o notice.</p><p>This issue affects Apache Airflow Provider for Databricks: from 1.10.0 before 1.12.0.</p><p>Users are recommended to upgrade to version 1.12.0, which fixes the issue.</p>
-<h3 id="references-79">References</h3>
+<h3 id="references-80">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/63704">https://github.com/apache/airflow/pull/63704</a></li>
<li><a href="https://lists.apache.org/thread/hn17yqsgsdtl81llvhf80rkp53hnz5nb">https://lists.apache.org/thread/hn17yqsgsdtl81llvhf80rkp53hnz5nb</a></li>
</ul>
-<h3 id="credits-79">Credits</h3>
+<h3 id="credits-80">Credits</h3>
<ul>
<li>Kai Aizen (reporter)</li>
<li>Marcin Wojtyczka (remediation developer)</li>
@@ -1685,18 +1705,18 @@
<h2 id="CVE-2026-32690">3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1</h2>
<p>CVE-2026-32690 <a href="https://cve.org/CVERecord?id=CVE-2026-32690">[CVE]</a> <a href="./CVE-2026-32690.cve.json">[CVE json]</a> <a href="./CVE-2026-32690.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-18T02:36:09.517Z</em></p>
-<h3 id="affected-80">Affected</h3>
+<h3 id="affected-81">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.0</li>
</ul>
-<h3 id="description-80">Description</h3>
+<h3 id="description-81">Description</h3>
<p>Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked.<br><br>If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to Apache Airflow 3.2.0 that has the fix implemented<br><br></p>
-<h3 id="references-80">References</h3>
+<h3 id="references-81">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/63480">https://github.com/apache/airflow/pull/63480</a></li>
<li><a href="https://lists.apache.org/thread/7rnzxofntcznqxnhsmjvvlvygwph7rn5">https://lists.apache.org/thread/7rnzxofntcznqxnhsmjvvlvygwph7rn5</a></li>
</ul>
-<h3 id="credits-80">Credits</h3>
+<h3 id="credits-81">Credits</h3>
<ul>
<li>Nguyen Anh Binh [IA Lab – FPT University] (finder)</li>
<li>Kevin Yang (remediation developer)</li>
@@ -1704,18 +1724,18 @@
<h2 id="CVE-2026-32228">Users with asset materialization permisssions could trigger Dags they had no access to</h2>
<p>CVE-2026-32228 <a href="https://cve.org/CVERecord?id=CVE-2026-32228">[CVE]</a> <a href="./CVE-2026-32228.cve.json">[CVE json]</a> <a href="./CVE-2026-32228.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-18T02:42:30.328Z</em></p>
-<h3 id="affected-81">Affected</h3>
+<h3 id="affected-82">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.0</li>
</ul>
-<h3 id="description-81">Description</h3>
+<h3 id="description-82">Description</h3>
<p>UI / API User with asset materialize permission could trigger dags they had no access to.<br>Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.</p>
-<h3 id="references-81">References</h3>
+<h3 id="references-82">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/63338">https://github.com/apache/airflow/pull/63338</a></li>
<li><a href="https://lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0nj">https://lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0nj</a></li>
</ul>
-<h3 id="credits-81">Credits</h3>
+<h3 id="credits-82">Credits</h3>
<ul>
<li>Masamune - Unit515 OPSWAT (finder)</li>
<li>Ahmad Abuzaid (finder)</li>
@@ -1724,20 +1744,20 @@
<h2 id="CVE-2026-31987">JWT token appearing in logs</h2>
<p>CVE-2026-31987 <a href="https://cve.org/CVERecord?id=CVE-2026-31987">[CVE]</a> <a href="./CVE-2026-31987.cve.json">[CVE json]</a> <a href="./CVE-2026-31987.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-16T17:49:35.608Z</em></p>
-<h3 id="affected-82">Affected</h3>
+<h3 id="affected-83">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.0</li>
</ul>
-<h3 id="description-82">Description</h3>
+<h3 id="description-83">Description</h3>
<p>JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. <br>Users are advised to upgrade to Airflow version that contains fix.<br><br>Users are recommended to upgrade to version 3.2.0, which fixes this issue. <br><br></p>
-<h3 id="references-82">References</h3>
+<h3 id="references-83">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/62964">https://github.com/apache/airflow/pull/62964</a></li>
<li><a href="https://github.com/apache/airflow/issues/62428">https://github.com/apache/airflow/issues/62428</a></li>
<li><a href="https://github.com/apache/airflow/issues/62773">https://github.com/apache/airflow/issues/62773</a></li>
<li><a href="https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g">https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g</a></li>
</ul>
-<h3 id="credits-82">Credits</h3>
+<h3 id="credits-83">Credits</h3>
<ul>
<li>unixengineer (finder)</li>
<li>Jason Imison (finder)</li>
@@ -1746,18 +1766,18 @@
<h2 id="CVE-2026-30912">Exposing stack trace in case of constraint error</h2>
<p>CVE-2026-30912 <a href="https://cve.org/CVERecord?id=CVE-2026-30912">[CVE]</a> <a href="./CVE-2026-30912.cve.json">[CVE json]</a> <a href="./CVE-2026-30912.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-18T02:41:53.492Z</em></p>
-<h3 id="affected-83">Affected</h3>
+<h3 id="affected-84">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.0</li>
</ul>
-<h3 id="description-83">Description</h3>
+<h3 id="description-84">Description</h3>
<p>In case of SQL errors, exception/stack trace of errors was exposed in API even if “api/expose_stack_traces” was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.</p>
-<h3 id="references-83">References</h3>
+<h3 id="references-84">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/63028">https://github.com/apache/airflow/pull/63028</a></li>
<li><a href="https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9">https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9</a></li>
</ul>
-<h3 id="credits-83">Credits</h3>
+<h3 id="credits-84">Credits</h3>
<ul>
<li>Masamune - Unit515 OPSWAT (finder)</li>
<li>Jason(Zhe-You) Liu (remediation developer)</li>
@@ -1765,18 +1785,18 @@
<h2 id="CVE-2026-30911">Execution API HITL Endpoints Missing Per-Task Authorization</h2>
<p>CVE-2026-30911 <a href="https://cve.org/CVERecord?id=CVE-2026-30911">[CVE]</a> <a href="./CVE-2026-30911.cve.json">[CVE json]</a> <a href="./CVE-2026-30911.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-17T10:53:00.535Z</em></p>
-<h3 id="affected-84">Affected</h3>
+<h3 id="affected-85">Affected</h3>
<ul>
<li>Apache Airflow from 3.1.0 before 3.1.8</li>
</ul>
-<h3 id="description-84">Description</h3>
+<h3 id="description-85">Description</h3>
<p>Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API’s Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance.<br><br><br>Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.<br><br></p>
-<h3 id="references-84">References</h3>
+<h3 id="references-85">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/62886">https://github.com/apache/airflow/pull/62886</a></li>
<li><a href="https://lists.apache.org/thread/1rs2v7fcko2otl6n9ytthcj87cmsgx51">https://lists.apache.org/thread/1rs2v7fcko2otl6n9ytthcj87cmsgx51</a></li>
</ul>
-<h3 id="credits-84">Credits</h3>
+<h3 id="credits-85">Credits</h3>
<ul>
<li>Kai Aizen (finder)</li>
<li>Aritra Basu (remediation developer)</li>
@@ -1784,18 +1804,18 @@
<h2 id="CVE-2026-30898">Bad example of BashOperator shell injection via dag_run.conf</h2>
<p>CVE-2026-30898 <a href="https://cve.org/CVERecord?id=CVE-2026-30898">[CVE]</a> <a href="./CVE-2026-30898.cve.json">[CVE json]</a> <a href="./CVE-2026-30898.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-18T02:40:37.049Z</em></p>
-<h3 id="affected-85">Affected</h3>
+<h3 id="affected-86">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.0</li>
</ul>
-<h3 id="description-85">Description</h3>
+<h3 id="description-86">Description</h3>
<p>An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker. Users should review if any of their own DAGs have adopted this incorrect advice.<br></p>
-<h3 id="references-85">References</h3>
+<h3 id="references-86">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/64129">https://github.com/apache/airflow/pull/64129</a></li>
<li><a href="https://lists.apache.org/thread/26zmhfj1t95c1hld2r14ho81nzh1bdc8">https://lists.apache.org/thread/26zmhfj1t95c1hld2r14ho81nzh1bdc8</a></li>
</ul>
-<h3 id="credits-85">Credits</h3>
+<h3 id="credits-86">Credits</h3>
<ul>
<li>Peyton Kennedy (p80n-sec) from Endor Labs (finder)</li>
<li>Kevin Yang (remediation developer)</li>
@@ -1803,18 +1823,18 @@
<h2 id="CVE-2026-28779">Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications</h2>
<p>CVE-2026-28779 <a href="https://cve.org/CVERecord?id=CVE-2026-28779">[CVE]</a> <a href="./CVE-2026-28779.cve.json">[CVE json]</a> <a href="./CVE-2026-28779.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-17T10:43:18.236Z</em></p>
-<h3 id="affected-86">Affected</h3>
+<h3 id="affected-87">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.1.8</li>
</ul>
-<h3 id="description-86">Description</h3>
+<h3 id="description-87">Description</h3>
<p>Apache Airflow versions 3.1.0 through 3.1.7 <span style="background-color: rgb(255, 255, 255);">session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.<br><p>This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itself.</p></span>Users are recommended to upgrade to Apache Airflow 3.1.8 or later [...]
-<h3 id="references-86">References</h3>
+<h3 id="references-87">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/62771">https://github.com/apache/airflow/pull/62771</a></li>
<li><a href="https://lists.apache.org/thread/r4n5znb8mcq14wo9v8ndml36nxlksdqb">https://lists.apache.org/thread/r4n5znb8mcq14wo9v8ndml36nxlksdqb</a></li>
</ul>
-<h3 id="credits-86">Credits</h3>
+<h3 id="credits-87">Credits</h3>
<ul>
<li>Daniel Wolf (finder)</li>
<li>Daniel Wolf (remediation developer)</li>
@@ -1822,18 +1842,18 @@
<h2 id="CVE-2026-28563">DAG authorization bypass</h2>
<p>CVE-2026-28563 <a href="https://cve.org/CVERecord?id=CVE-2026-28563">[CVE]</a> <a href="./CVE-2026-28563.cve.json">[CVE json]</a> <a href="./CVE-2026-28563.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-17T10:54:55.864Z</em></p>
-<h3 id="affected-87">Affected</h3>
+<h3 id="affected-88">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.1.8</li>
</ul>
-<h3 id="description-87">Description</h3>
+<h3 id="description-88">Description</h3>
<p>Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authorized to view.<br><br><br>Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.<br><br><br></p>
-<h3 id="references-87">References</h3>
+<h3 id="references-88">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/62046">https://github.com/apache/airflow/pull/62046</a></li>
<li><a href="https://lists.apache.org/thread/dwzf62qg9z8wvfsjknpfd8bvtwghd49s">https://lists.apache.org/thread/dwzf62qg9z8wvfsjknpfd8bvtwghd49s</a></li>
</ul>
-<h3 id="credits-87">Credits</h3>
+<h3 id="credits-88">Credits</h3>
<ul>
<li>Masamune - Unit515 OPSWAT (finder)</li>
<li>Shubham Raj (remediation developer)</li>
@@ -1841,18 +1861,18 @@
<h2 id="CVE-2026-27173">JWT Token Exposure in KubernetesExecutor Command-Line Arguments</h2>
<p>CVE-2026-27173 <a href="https://cve.org/CVERecord?id=CVE-2026-27173">[CVE]</a> <a href="./CVE-2026-27173.cve.json">[CVE json]</a> <a href="./CVE-2026-27173.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-22T18:42:19.144Z</em></p>
-<h3 id="affected-88">Affected</h3>
+<h3 id="affected-89">Affected</h3>
<ul>
<li>Apache Airflow CNCF Kubernetes provider before 10.17.0</li>
</ul>
-<h3 id="description-88">Description</h3>
+<h3 id="description-89">Description</h3>
<p>JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform actions that were only available to running tasks via Task SDK and potentially allow to modify state of Airflow Database for tasks.</p>
-<h3 id="references-88">References</h3>
+<h3 id="references-89">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/60108">https://github.com/apache/airflow/pull/60108</a></li>
<li><a href="https://lists.apache.org/thread/pk3m2z4s2rkmc0v6gh9hnch9spc6stqw">https://lists.apache.org/thread/pk3m2z4s2rkmc0v6gh9hnch9spc6stqw</a></li>
</ul>
-<h3 id="credits-88">Credits</h3>
+<h3 id="credits-89">Credits</h3>
<ul>
<li>Nikolai Dvoinishnikov, Welltory (finder)</li>
<li>Anton Kuznetsov, Welltory (finder)</li>
@@ -1861,36 +1881,36 @@
<h2 id="CVE-2026-26929">Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata</h2>
<p>CVE-2026-26929 <a href="https://cve.org/CVERecord?id=CVE-2026-26929">[CVE]</a> <a href="./CVE-2026-26929.cve.json">[CVE json]</a> <a href="./CVE-2026-26929.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-17T10:54:03.388Z</em></p>
-<h3 id="affected-89">Affected</h3>
+<h3 id="affected-90">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.1.8</li>
</ul>
-<h3 id="description-89">Description</h3>
+<h3 id="description-90">Description</h3>
<p>Apache Airflow versions 3.0.0 through 3.1.7<span style="background-color: rgb(255, 255, 255);"> FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to “~” (wildcard for all DAGs). As a result, version metadata of DAGs that the requester is not authorized to access is returned.</span><br><br><br>Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.<br><br><br></p>
-<h3 id="references-89">References</h3>
+<h3 id="references-90">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/61675">https://github.com/apache/airflow/pull/61675</a></li>
<li><a href="https://lists.apache.org/thread/g5o6khx83jwqvdyn0mlyb0krt35cs9ss">https://lists.apache.org/thread/g5o6khx83jwqvdyn0mlyb0krt35cs9ss</a></li>
</ul>
-<h3 id="credits-89">Credits</h3>
+<h3 id="credits-90">Credits</h3>
<ul>
<li>Pierre Jeambrun (remediation developer)</li>
</ul>
<h2 id="CVE-2026-25917">API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)</h2>
<p>CVE-2026-25917 <a href="https://cve.org/CVERecord?id=CVE-2026-25917">[CVE]</a> <a href="./CVE-2026-25917.cve.json">[CVE json]</a> <a href="./CVE-2026-25917.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-17T20:19:53.511Z</em></p>
-<h3 id="affected-90">Affected</h3>
+<h3 id="affected-91">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.0</li>
</ul>
-<h3 id="description-90">Description</h3>
+<h3 id="description-91">Description</h3>
<p>Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low.<br><br>Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.<br></p>
-<h3 id="references-90">References</h3>
+<h3 id="references-91">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/61641">https://github.com/apache/airflow/pull/61641</a></li>
<li><a href="https://lists.apache.org/thread/6whgpkqbh12rvpfmvcg8b0vwlv4hq3po">https://lists.apache.org/thread/6whgpkqbh12rvpfmvcg8b0vwlv4hq3po</a></li>
</ul>
-<h3 id="credits-90">Credits</h3>
+<h3 id="credits-91">Credits</h3>
<ul>
<li>Mahammad Huseynkhanli (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -1898,73 +1918,73 @@
<h2 id="CVE-2026-25604">Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass</h2>
<p>CVE-2026-25604 <a href="https://cve.org/CVERecord?id=CVE-2026-25604">[CVE]</a> <a href="./CVE-2026-25604.cve.json">[CVE json]</a> <a href="./CVE-2026-25604.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-09T10:39:37.628Z</em></p>
-<h3 id="affected-91">Affected</h3>
+<h3 id="affected-92">Affected</h3>
<ul>
<li>Apache Airflow Providers Amazon from 8.0.0 before 9.22.0</li>
</ul>
-<h3 id="description-91">Description</h3>
+<h3 id="description-92">Description</h3>
<p>In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. <br>This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.</p>You should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.<br><br>
-<h3 id="references-91">References</h3>
+<h3 id="references-92">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/61368">https://github.com/apache/airflow/pull/61368</a></li>
<li><a href="https://lists.apache.org/thread/spwwrsmwxod7fpttcd7n7zs46j839l77">https://lists.apache.org/thread/spwwrsmwxod7fpttcd7n7zs46j839l77</a></li>
</ul>
-<h3 id="credits-91">Credits</h3>
+<h3 id="credits-92">Credits</h3>
<ul>
<li>Sungwuk Jung (finder)</li>
</ul>
<h2 id="CVE-2026-25219">Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access</h2>
<p>CVE-2026-25219 <a href="https://cve.org/CVERecord?id=CVE-2026-25219">[CVE]</a> <a href="./CVE-2026-25219.cve.json">[CVE json]</a> <a href="./CVE-2026-25219.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-15T13:14:51.470Z</em></p>
-<h3 id="affected-92">Affected</h3>
+<h3 id="affected-93">Affected</h3>
<ul>
<li>Apache Airflow before 3.1.8</li>
</ul>
-<h3 id="description-92">Description</h3>
+<h3 id="description-93">Description</h3>
<p>The <code>access_key</code> and <code>connection_string</code> connection properties were not marked as sensitive names in secrets masker. This means that user with read permission could see the values in Connection UI, as well as when Connection was accidentaly logged to logs, those values could be seen in the logs. Azure Service Bus used those properties to store sensitive values. Possibly other providers could be also affected if they used the same fields to store sensitive data.<b [...]
-<h3 id="references-92">References</h3>
+<h3 id="references-93">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/61580">https://github.com/apache/airflow/pull/61580</a></li>
<li><a href="https://github.com/apache/airflow/pull/61582">https://github.com/apache/airflow/pull/61582</a></li>
<li><a href="https://lists.apache.org/thread/t4dlmqkn0njz4chk3g7mdgzb96y4ttqh">https://lists.apache.org/thread/t4dlmqkn0njz4chk3g7mdgzb96y4ttqh</a></li>
</ul>
-<h3 id="credits-92">Credits</h3>
+<h3 id="credits-93">Credits</h3>
<ul>
<li>Saurabh Banawar (finder)</li>
</ul>
<h2 id="CVE-2026-24098">Assigning single DAG permission leaked all DAGs Import Errors</h2>
<p>CVE-2026-24098 <a href="https://cve.org/CVERecord?id=CVE-2026-24098">[CVE]</a> <a href="./CVE-2026-24098.cve.json">[CVE json]</a> <a href="./CVE-2026-24098.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-10T18:13:52.941Z</em></p>
-<h3 id="affected-93">Affected</h3>
+<h3 id="affected-94">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.1.7</li>
</ul>
-<h3 id="description-93">Description</h3>
+<h3 id="description-94">Description</h3>
<p>Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. <br><br>Users are advised to upgrade to 3.1.7 or later, which resolves this issue</p>
-<h3 id="references-93">References</h3>
+<h3 id="references-94">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/60801">https://github.com/apache/airflow/pull/60801</a></li>
<li><a href="https://lists.apache.org/thread/nx96435v77xdst7ls5lk57kqvqyj095x">https://lists.apache.org/thread/nx96435v77xdst7ls5lk57kqvqyj095x</a></li>
</ul>
-<h3 id="credits-93">Credits</h3>
+<h3 id="credits-94">Credits</h3>
<ul>
<li>Saurabh (finder)</li>
</ul>
<h2 id="CVE-2026-22922">Airflow externalLogUrl Permission Bypass</h2>
<p>CVE-2026-22922 <a href="https://cve.org/CVERecord?id=CVE-2026-22922">[CVE]</a> <a href="./CVE-2026-22922.cve.json">[CVE json]</a> <a href="./CVE-2026-22922.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-02-09T10:33:48.256Z</em></p>
-<h3 id="affected-94">Affected</h3>
+<h3 id="affected-95">Affected</h3>
<ul>
<li>Apache Airflow from 3.1.0 before 3.1.7</li>
</ul>
-<h3 id="description-94">Description</h3>
+<h3 id="description-95">Description</h3>
<p>Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. <br><br>Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.<br></p>
-<h3 id="references-94">References</h3>
+<h3 id="references-95">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/60412">https://github.com/apache/airflow/pull/60412</a></li>
<li><a href="https://lists.apache.org/thread/gdb7vffhpmrj5hp1j0oj1j13o4vmsq40">https://lists.apache.org/thread/gdb7vffhpmrj5hp1j0oj1j13o4vmsq40</a></li>
</ul>
-<h3 id="credits-94">Credits</h3>
+<h3 id="credits-95">Credits</h3>
<ul>
<li>34selen (finder)</li>
<li>Shubham Raj (remediation developer)</li>
@@ -1972,18 +1992,18 @@
<h2 id="CVE-2025-69219">Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperator</h2>
<p>CVE-2025-69219 <a href="https://cve.org/CVERecord?id=CVE-2025-69219">[CVE]</a> <a href="./CVE-2025-69219.cve.json">[CVE json]</a> <a href="./CVE-2025-69219.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-09T10:19:56.479Z</em></p>
-<h3 id="affected-95">Affected</h3>
+<h3 id="affected-96">Affected</h3>
<ul>
<li>Apache Airflow Providers Http from 5.1.0 before 6.0.0</li>
</ul>
-<h3 id="description-95">Description</h3>
+<h3 id="description-96">Description</h3>
<p>A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same permissions as Dag Author. Since direct DB access is not usual and recommended for Airflow, the likelihood of it making any damage is low.<br><br>You should upgrade to version 6.0.0 of the provider to avoid even that risk.</p>
-<h3 id="references-95">References</h3>
+<h3 id="references-96">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/61662">https://github.com/apache/airflow/pull/61662</a></li>
<li><a href="https://lists.apache.org/thread/zjkfb2njklro68tqzym092r4w65m5dq0">https://lists.apache.org/thread/zjkfb2njklro68tqzym092r4w65m5dq0</a></li>
</ul>
-<h3 id="credits-95">Credits</h3>
+<h3 id="credits-96">Credits</h3>
<ul>
<li>skypher (finder)</li>
<li>Shauryae1337 (GitHub: <a href="https://github.com/Shauryae1337">https://github.com/Shauryae1337</a>) (finder)</li>
@@ -1992,19 +2012,19 @@
<h2 id="CVE-2025-68675">proxy credentials for various providers might leak in task logs</h2>
<p>CVE-2025-68675 <a href="https://cve.org/CVERecord?id=CVE-2025-68675">[CVE]</a> <a href="./CVE-2025-68675.cve.json">[CVE json]</a> <a href="./CVE-2025-68675.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-02-24T05:48:09.000Z</em></p>
-<h3 id="affected-96">Affected</h3>
+<h3 id="affected-97">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.1.6</li>
<li>Apache Airflow before 2.11.1</li>
</ul>
-<h3 id="description-96">Description</h3>
+<h3 id="description-97">Description</h3>
<p>In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result, when such connections are rendered or printed to logs, proxy credentials embedded in these fields could be exposed.<br><br>Users are recommended to upgrade to 3.1.6 or later for Airflow 3, an [...]
-<h3 id="references-96">References</h3>
+<h3 id="references-97">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/x6kply4nqd4vc4wgxtm6g9r2tt63s8c5">https://lists.apache.org/thread/x6kply4nqd4vc4wgxtm6g9r2tt63s8c5</a></li>
<li><a href="https://github.com/apache/airflow/pull/59688">https://github.com/apache/airflow/pull/59688</a></li>
</ul>
-<h3 id="credits-96">Credits</h3>
+<h3 id="credits-97">Credits</h3>
<ul>
<li>lwlkr <a href="https://github.com/kwkr">https://github.com/kwkr</a> (finder)</li>
<li>Ankit Chaurasia (remediation developer)</li>
@@ -2012,17 +2032,17 @@
<h2 id="CVE-2025-68438">Secrets in rendered templates could contain parts of sensitive values when truncated</h2>
<p>CVE-2025-68438 <a href="https://cve.org/CVERecord?id=CVE-2025-68438">[CVE]</a> <a href="./CVE-2025-68438.cve.json">[CVE json]</a> <a href="./CVE-2025-68438.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-01-16T10:06:05.336Z</em></p>
-<h3 id="affected-97">Affected</h3>
+<h3 id="affected-98">Affected</h3>
<ul>
<li>Apache Airflow from 3.1.0 before 3.1.6</li>
</ul>
-<h3 id="description-97">Description</h3>
+<h3 id="description-98">Description</h3>
<p>In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] <code>max_templated_field_length</code>, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include user-registered <code>mask_secret()</code> patterns, so secrets were not reliably masked before truncation and display.<br><br>Users are recommended to upgrade to 3.1.6 or l [...]
-<h3 id="references-97">References</h3>
+<h3 id="references-98">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/55n7b4nlsz3vo5n4h5lrj9bfsk8ctyff">https://lists.apache.org/thread/55n7b4nlsz3vo5n4h5lrj9bfsk8ctyff</a></li>
</ul>
-<h3 id="credits-97">Credits</h3>
+<h3 id="credits-98">Credits</h3>
<ul>
<li>William Ashe (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -2030,36 +2050,36 @@
<h2 id="CVE-2025-67895">Edge3 Worker RPC RCE on Airflow 2</h2>
<p>CVE-2025-67895 <a href="https://cve.org/CVERecord?id=CVE-2025-67895">[CVE]</a> <a href="./CVE-2025-67895.cve.json">[CVE json]</a> <a href="./CVE-2025-67895.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-12-17T11:48:30.034Z</em></p>
-<h3 id="affected-98">Affected</h3>
+<h3 id="affected-99">Affected</h3>
<ul>
<li>Apache Airflow Providers Edge3 before 2.0.0</li>
</ul>
-<h3 id="description-98">Description</h3>
+<h3 id="description-99">Description</h3>
<p>Edge3 Worker RPC RCE on Airflow 2.</p><p>This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if you installed and configured it on Airflow 2.</p><p></p><p>The Edge3 provider support in Airflow 2 has been always development-only and not officially released, however if you installed and configured Edge3 provider in Airflow 2, it implicitly enabled non-public (normally) API which was used to test Edge Provider in Airflow 2 during the development. This API allowed D [...]
-<h3 id="references-98">References</h3>
+<h3 id="references-99">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/59143">https://github.com/apache/airflow/pull/59143</a></li>
<li><a href="https://lists.apache.org/thread/hhnmmzkj5qx5gbk6pdkh8tcsx5oj1nqs">https://lists.apache.org/thread/hhnmmzkj5qx5gbk6pdkh8tcsx5oj1nqs</a></li>
</ul>
-<h3 id="credits-98">Credits</h3>
+<h3 id="credits-99">Credits</h3>
<ul>
<li>Lee (finder)</li>
</ul>
<h2 id="CVE-2025-66388">Secrets in rendered templates not redacted properly and exposed in the UI</h2>
<p>CVE-2025-66388 <a href="https://cve.org/CVERecord?id=CVE-2025-66388">[CVE]</a> <a href="./CVE-2025-66388.cve.json">[CVE json]</a> <a href="./CVE-2025-66388.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-12-15T11:30:42.649Z</em></p>
-<h3 id="affected-99">Affected</h3>
+<h3 id="affected-100">Affected</h3>
<ul>
<li>Apache Airflow from 3.1.0 before 3.1.4</li>
</ul>
-<h3 id="description-99">Description</h3>
+<h3 id="description-100">Description</h3>
<p>A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without the appropriate authorization.<br><br>Users are recommended to upgrade to version 3.1.4, which fixes this issue.</p>
-<h3 id="references-99">References</h3>
+<h3 id="references-100">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/58772">https://github.com/apache/airflow/pull/58772</a></li>
<li><a href="https://lists.apache.org/thread/mv9hzsx8grjf7gdlkxwppnpbtogtls2g">https://lists.apache.org/thread/mv9hzsx8grjf7gdlkxwppnpbtogtls2g</a></li>
</ul>
-<h3 id="credits-99">Credits</h3>
+<h3 id="credits-100">Credits</h3>
<ul>
<li>William Ashe (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -2067,18 +2087,18 @@
<h2 id="CVE-2025-66236">Secrets from Airflow config file logged in plain text in DAG run logs UI</h2>
<p>CVE-2025-66236 <a href="https://cve.org/CVERecord?id=CVE-2025-66236">[CVE]</a> <a href="./CVE-2025-66236.cve.json">[CVE json]</a> <a href="./CVE-2025-66236.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-13T14:20:35.201Z</em></p>
-<h3 id="affected-100">Affected</h3>
+<h3 id="affected-101">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.0</li>
</ul>
-<h3 id="description-100">Description</h3>
+<h3 id="description-101">Description</h3>
<p>Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay attention to security details and security model of Airflow. Some assumptions the Deployment Manager could make were not clear or explicit enough, even though Airflow's intentions and security model of Airflow did not suggest different assumptions. The overall security model [1], workload isolation [2], and JWT authentication details [3] are now descr [...]
-<h3 id="references-100">References</h3>
+<h3 id="references-101">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/58662">https://github.com/apache/airflow/pull/58662</a></li>
<li><a href="https://lists.apache.org/thread/g8fyy1tkmxkkfk7tx2v6h8mvwzpyykbo">https://lists.apache.org/thread/g8fyy1tkmxkkfk7tx2v6h8mvwzpyykbo</a></li>
</ul>
-<h3 id="credits-100">Credits</h3>
+<h3 id="credits-101">Credits</h3>
<ul>
<li>Saurabh Banawar (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -2086,20 +2106,20 @@
<h2 id="CVE-2025-65995">Disclosure of secrets to UI via kwargs</h2>
<p>CVE-2025-65995 <a href="https://cve.org/CVERecord?id=CVE-2025-65995">[CVE]</a> <a href="./CVE-2025-65995.cve.json">[CVE json]</a> <a href="./CVE-2025-65995.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-08T19:08:56.440Z</em></p>
-<h3 id="affected-101">Affected</h3>
+<h3 id="affected-102">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.1.4</li>
<li>Apache Airflow before 2.11.1</li>
</ul>
-<h3 id="description-101">Description</h3>
+<h3 id="description-102">Description</h3>
<p>When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG. <br><br>The issue has been fixed in Airflow 3.1.4 and 2.11.1, and users are strongly advised to upgrade to prevent potential disclosure of sensitive information.</p>
-<h3 id="references-101">References</h3>
+<h3 id="references-102">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/58252">https://github.com/apache/airflow/pull/58252</a></li>
<li><a href="https://lists.apache.org/thread/1qzlrjo2wmlzs0rrgzgslj2pzkor0dr2">https://lists.apache.org/thread/1qzlrjo2wmlzs0rrgzgslj2pzkor0dr2</a></li>
<li><a href="https://github.com/apache/airflow/pull/61883">https://github.com/apache/airflow/pull/61883</a></li>
</ul>
-<h3 id="credits-101">Credits</h3>
+<h3 id="credits-102">Credits</h3>
<ul>
<li>Frieder Gottman (Cariad) (finder)</li>
<li>Jens Scheffler (Bosch) (reporter)</li>
@@ -2108,53 +2128,53 @@
<h2 id="CVE-2025-62503">Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)</h2>
<p>CVE-2025-62503 <a href="https://cve.org/CVERecord?id=CVE-2025-62503">[CVE]</a> <a href="./CVE-2025-62503.cve.json">[CVE json]</a> <a href="./CVE-2025-62503.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-10-30T09:11:15.486Z</em></p>
-<h3 id="affected-102">Affected</h3>
+<h3 id="affected-103">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.1.1</li>
</ul>
-<h3 id="description-102">Description</h3>
+<h3 id="description-103">Description</h3>
<p>User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.<br><br><br></p>
-<h3 id="references-102">References</h3>
+<h3 id="references-103">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/3v58249qscyn1hg240gh8hqg9pb4okcr">https://lists.apache.org/thread/3v58249qscyn1hg240gh8hqg9pb4okcr</a></li>
</ul>
-<h3 id="credits-102">Credits</h3>
+<h3 id="credits-103">Credits</h3>
<ul>
<li>Maciej Kawka (finder)</li>
</ul>
<h2 id="CVE-2025-62402">Airflow 3 API: /api/v2/dagReports executes DAG Python in API</h2>
<p>CVE-2025-62402 <a href="https://cve.org/CVERecord?id=CVE-2025-62402">[CVE]</a> <a href="./CVE-2025-62402.cve.json">[CVE json]</a> <a href="./CVE-2025-62402.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-10-30T09:14:24.818Z</em></p>
-<h3 id="affected-103">Affected</h3>
+<h3 id="affected-104">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.1.1</li>
</ul>
-<h3 id="description-103">Description</h3>
+<h3 id="description-104">Description</h3>
<p>API users via <code>/api/v2/dagReports</code> could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.<br></p>
-<h3 id="references-103">References</h3>
+<h3 id="references-104">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/vbzxnxn031wb998hsd7vqnvh4z8nx6rs">https://lists.apache.org/thread/vbzxnxn031wb998hsd7vqnvh4z8nx6rs</a></li>
</ul>
-<h3 id="credits-103">Credits</h3>
+<h3 id="credits-104">Credits</h3>
<ul>
<li>kwkr (<a href="https://github.com/kwkr">https://github.com/kwkr</a>) (reporter)</li>
</ul>
<h2 id="CVE-2025-57735">Airflow Logout Not Invalidating JWT</h2>
<p>CVE-2025-57735 <a href="https://cve.org/CVERecord?id=CVE-2025-57735">[CVE]</a> <a href="./CVE-2025-57735.cve.json">[CVE json]</a> <a href="./CVE-2025-57735.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-09T11:12:40.266Z</em></p>
-<h3 id="affected-104">Affected</h3>
+<h3 id="affected-105">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.0</li>
</ul>
-<h3 id="description-104">Description</h3>
+<h3 id="description-105">Description</h3>
<p>When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+</p><br><br>Users are recommended to upgrade to version 3.2.0, which fixes this issue.
-<h3 id="references-104">References</h3>
+<h3 id="references-105">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/61339">https://github.com/apache/airflow/pull/61339</a></li>
<li><a href="https://github.com/apache/airflow/pull/56633">https://github.com/apache/airflow/pull/56633</a></li>
<li><a href="https://lists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98">https://lists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98</a></li>
</ul>
-<h3 id="credits-104">Credits</h3>
+<h3 id="credits-105">Credits</h3>
<ul>
<li>Saurabh Banawar (finder)</li>
<li>Anish Giri (remediation developer)</li>
@@ -2163,159 +2183,159 @@
<h2 id="CVE-2025-54941">Command injection in “example_dag_decorator”</h2>
<p>CVE-2025-54941 <a href="https://cve.org/CVERecord?id=CVE-2025-54941">[CVE]</a> <a href="./CVE-2025-54941.cve.json">[CVE json]</a> <a href="./CVE-2025-54941.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-10-30T09:45:25.170Z</em></p>
-<h3 id="affected-105">Affected</h3>
+<h3 id="affected-106">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before < 3.0.5</li>
</ul>
-<h3 id="description-105">Description</h3>
+<h3 id="description-106">Description</h3>
<p>An example dag <code>example_dag_decorator</code> had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on worker. This however required that the example dags are enabled in production (not default) or the example dag code copied to build your own similar dag. If you used the <code>example_dag_decorator</code> please review it and apply the changes implemented in Airflow 3.0.5 accordingly.<br><br><br></p>
-<h3 id="references-105">References</h3>
+<h3 id="references-106">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/c6q6nofc6xl5bms039ks9b34v0v36df1">https://lists.apache.org/thread/c6q6nofc6xl5bms039ks9b34v0v36df1</a></li>
</ul>
-<h3 id="credits-105">Credits</h3>
+<h3 id="credits-106">Credits</h3>
<ul>
<li>Nacl (reporter)</li>
</ul>
<h2 id="CVE-2025-54831">Connection sensitive details exposed to users with READ permissions</h2>
<p>CVE-2025-54831 <a href="https://cve.org/CVERecord?id=CVE-2025-54831">[CVE]</a> <a href="./CVE-2025-54831.cve.json">[CVE json]</a> <a href="./CVE-2025-54831.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-09-26T07:28:57.402Z</em></p>
-<h3 id="affected-106">Affected</h3>
+<h3 id="affected-107">Affected</h3>
<ul>
<li>Apache Airflow at 3.0.3</li>
</ul>
-<h3 id="description-106">Description</h3>
+<h3 id="description-107">Description</h3>
<p></p><p>Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to <em>Connection Editing Users</em>, effectively applying a "write-only" model for sensitive values.</p>
<p>In Airflow 3.0.3, this model was unintentionally violated: sensitive connection information could be viewed by users with READ permissions through both the API and the UI. This behavior also bypassed the `<code>AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS`</code> configuration option.</p>
<p>This issue does not affect Airflow 2.x, where exposing sensitive information to connection editors was the intended and documented behavior.</p><p></p><p><br></p><p>Users of Airflow 3.0.3 are advised to upgrade Airflow to >=3.0.4.</p>
-<h3 id="references-106">References</h3>
+<h3 id="references-107">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/vblmfqtydrp5zgn2q8tj3slk5podxspf">https://lists.apache.org/thread/vblmfqtydrp5zgn2q8tj3slk5podxspf</a></li>
</ul>
<h2 id="CVE-2025-54550">RCE by race condition in example_xcom dag</h2>
<p>CVE-2025-54550 <a href="https://cve.org/CVERecord?id=CVE-2025-54550">[CVE]</a> <a href="./CVE-2025-54550.cve.json">[CVE json]</a> <a href="./CVE-2025-54550.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-19T23:47:06.426Z</em></p>
-<h3 id="affected-107">Affected</h3>
+<h3 id="affected-108">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.0</li>
</ul>
-<h3 id="description-107">Description</h3>
+<h3 id="description-108">Description</h3>
<p>The example <code>example_xcom</code> that was included in airflow documentation implemented unsafe pattern of reading value<br>from xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary<br>execution of code on the worker. Since the UI users are already highly trusted, this is a Low severity vulnerability.</p><p>It does not affect Airflow release - example_dags are not supposed to be enabled in production environment, however [...]
-<h3 id="references-107">References</h3>
+<h3 id="references-108">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/3mf4cfx070ofsnf9qy0s2v5gqb5sc2g1">https://lists.apache.org/thread/3mf4cfx070ofsnf9qy0s2v5gqb5sc2g1</a></li>
<li><a href="https://github.com/apache/airflow/pull/63200">https://github.com/apache/airflow/pull/63200</a></li>
</ul>
-<h3 id="credits-106">Credits</h3>
+<h3 id="credits-107">Credits</h3>
<ul>
<li>Vincent55 Yang (finder)</li>
</ul>
<h2 id="CVE-2025-50213">Potential SQL injection in CopyFromExternalStageToSnowflakeOperator</h2>
<p>CVE-2025-50213 <a href="https://cve.org/CVERecord?id=CVE-2025-50213">[CVE]</a> <a href="./CVE-2025-50213.cve.json">[CVE json]</a> <a href="./CVE-2025-50213.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-06-24T07:06:50.934Z</em></p>
-<h3 id="affected-108">Affected</h3>
+<h3 id="affected-109">Affected</h3>
<ul>
<li>Apache Airflow Providers Snowflake before 6.4.0</li>
</ul>
-<h3 id="description-108">Description</h3>
+<h3 id="description-109">Description</h3>
<p>Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.</p><p>This issue affects Apache Airflow Providers Snowflake: before 6.4.0.</p><span style="background-color: rgb(255, 255, 255);"><span style="background-color: rgb(255, 255, 255);">Sanitation of table and stage parameters were added in</span> CopyFromExternalStageToSnowflakeOperator <span style="background-color: rgb(255, 255, 255);">t [...]
-<h3 id="references-108">References</h3>
+<h3 id="references-109">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/51734">https://github.com/apache/airflow/pull/51734</a></li>
<li><a href="https://lists.apache.org/thread/2kqfmyt2pghg5f6797g8hzvq331v8qx3">https://lists.apache.org/thread/2kqfmyt2pghg5f6797g8hzvq331v8qx3</a></li>
</ul>
-<h3 id="credits-107">Credits</h3>
+<h3 id="credits-108">Credits</h3>
<ul>
<li>Nhien Pham (@nhienit) at Galaxy One (finder)</li>
</ul>
<h2 id="CVE-2025-30473">Remote Code Execution via Sql Injection</h2>
<p>CVE-2025-30473 <a href="https://cve.org/CVERecord?id=CVE-2025-30473">[CVE]</a> <a href="./CVE-2025-30473.cve.json">[CVE json]</a> <a href="./CVE-2025-30473.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-04-07T08:31:55.441Z</em></p>
-<h3 id="affected-109">Affected</h3>
+<h3 id="affected-110">Affected</h3>
<ul>
<li>Apache Airflow Common SQL Provider before 1.24.1</li>
</ul>
-<h3 id="description-109">Description</h3>
+<h3 id="description-110">Description</h3>
<p>Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow Common SQL Provider.<br><br><span style="background-color: rgb(255, 255, 255);">When using the partition clause in SQLTableCheckOperator as parameter (which was a recommended pattern), Authenticated UI User could inject arbitrary SQL command when triggering DAG exposing partition_clause to the user.<br></span><span style="background-color: rgb(255, 255, 255);">This allo [...]
-<h3 id="references-109">References</h3>
+<h3 id="references-110">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/48098">https://github.com/apache/airflow/pull/48098</a></li>
<li><a href="https://lists.apache.org/thread/53klkv790cylqcop0350w7nfq1y6h0t2">https://lists.apache.org/thread/53klkv790cylqcop0350w7nfq1y6h0t2</a></li>
</ul>
-<h3 id="credits-108">Credits</h3>
+<h3 id="credits-109">Credits</h3>
<ul>
<li>nxczje (reporter)</li>
</ul>
<h2 id="CVE-2025-27555">Connection Secrets not masked in UI when Connection are added via Airflow cli</h2>
<p>CVE-2025-27555 <a href="https://cve.org/CVERecord?id=CVE-2025-27555">[CVE]</a> <a href="./CVE-2025-27555.cve.json">[CVE json]</a> <a href="./CVE-2025-27555.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-11T15:10:00.713Z</em></p>
-<h3 id="affected-110">Affected</h3>
+<h3 id="affected-111">Affected</h3>
<ul>
<li>Apache Airflow before 2.11.1</li>
</ul>
-<h3 id="description-110">Description</h3>
+<h3 id="description-111">Description</h3>
<p>Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive connection parameters were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow database. While this risk is limited to users with audit log access, it is recommended to upgrade to Airflow 2.11.1 or a later version, which addresses this iss [...]
-<h3 id="references-110">References</h3>
+<h3 id="references-111">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/61882">https://github.com/apache/airflow/pull/61882</a></li>
<li><a href="https://lists.apache.org/thread/nxovkp319jo8vg498gql1yswtb2frbkw">https://lists.apache.org/thread/nxovkp319jo8vg498gql1yswtb2frbkw</a></li>
</ul>
-<h3 id="credits-109">Credits</h3>
+<h3 id="credits-110">Credits</h3>
<ul>
<li>sw0rd1ight (finder)</li>
</ul>
<h2 id="CVE-2025-27018">SQL injection in MySQL provider core function</h2>
<p>CVE-2025-27018 <a href="https://cve.org/CVERecord?id=CVE-2025-27018">[CVE]</a> <a href="./CVE-2025-27018.cve.json">[CVE json]</a> <a href="./CVE-2025-27018.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-03-19T09:06:05.242Z</em></p>
-<h3 id="affected-111">Affected</h3>
+<h3 id="affected-112">Affected</h3>
<ul>
<li>Apache Airflow MySQL Provider before 6.2.0</li>
</ul>
-<h3 id="description-111">Description</h3>
+<h3 id="description-112">Description</h3>
<p>Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow MySQL Provider.</p><span style="background-color: rgb(255, 255, 255);">When user triggered a DAG with dump_sql or load_sql functions they could pass a table parameter from a UI, that could cause SQL injection by running SQL that was not intended.<br>It could lead to data corruption, modification and others.</span><br><p>This issue affects Apache Airflow MySQL Provider: [...]
-<h3 id="references-111">References</h3>
+<h3 id="references-112">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/47254">https://github.com/apache/airflow/pull/47254</a></li>
<li><a href="https://github.com/apache/airflow/pull/47255">https://github.com/apache/airflow/pull/47255</a></li>
<li><a href="https://lists.apache.org/thread/m8ohgkwz4mq9njohf66sjwqjdy28gvzf">https://lists.apache.org/thread/m8ohgkwz4mq9njohf66sjwqjdy28gvzf</a></li>
</ul>
-<h3 id="credits-110">Credits</h3>
+<h3 id="credits-111">Credits</h3>
<ul>
<li>Vincent55 (DEVCORE Internship Program) (finder)</li>
</ul>
<h2 id="CVE-2024-56373">SSTI to Code Execution in Airflow through Shared DB Information</h2>
<p>CVE-2024-56373 <a href="https://cve.org/CVERecord?id=CVE-2024-56373">[CVE]</a> <a href="./CVE-2024-56373.cve.json">[CVE json]</a> <a href="./CVE-2024-56373.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-02-24T10:06:39.270Z</em></p>
-<h3 id="affected-112">Affected</h3>
+<h3 id="affected-113">Affected</h3>
<ul>
<li>Apache Airflow before 2.11.1</li>
</ul>
-<h3 id="description-112">Description</h3>
+<h3 id="description-113">Description</h3>
<p>DAG Author (who already has quite a lot of permissions) could manipulate database of Airflow 2 in the way to execute arbitrary code in the web-server context, which they should normally not be able to do, leading to potentially remote code execution in the context of web-server (server-side) as a result of a user viewing historical task information.</p>The functionality responsible for that (log template history) has been disabled by default in 2.11.1 and users should upgrade to Airfl [...]
-<h3 id="references-112">References</h3>
+<h3 id="references-113">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/61880">https://github.com/apache/airflow/pull/61880</a></li>
<li><a href="https://lists.apache.org/thread/2vrmrhcht6g7cp5yjxpnrk2wtrncm6cy">https://lists.apache.org/thread/2vrmrhcht6g7cp5yjxpnrk2wtrncm6cy</a></li>
</ul>
-<h3 id="credits-111">Credits</h3>
+<h3 id="credits-112">Credits</h3>
<ul>
<li>Seokchan Yoon. (finder)</li>
</ul>
<h2 id="CVE-2024-50378">Secrets not masked in UI when sensitive variables are set via Airflow cli</h2>
<p>CVE-2024-50378 <a href="https://cve.org/CVERecord?id=CVE-2024-50378">[CVE]</a> <a href="./CVE-2024-50378.cve.json">[CVE json]</a> <a href="./CVE-2024-50378.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-11-08T14:37:07.862Z</em></p>
-<h3 id="affected-113">Affected</h3>
+<h3 id="affected-114">Affected</h3>
<ul>
<li>Apache Airflow before 2.10.3</li>
</ul>
-<h3 id="description-113">Description</h3>
+<h3 id="description-114">Description</h3>
<p>Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive variables were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow database. While this risk is limited to users with audit log access, it is recommended to upgrade to Airflow 2.10.3 or a later version, which addresses this issue. Users wh [...]
-<h3 id="references-113">References</h3>
+<h3 id="references-114">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/43123">https://github.com/apache/airflow/pull/43123</a></li>
<li><a href="https://lists.apache.org/thread/17rxys384lzfd6nhm3fztzgvk47zy7jb">https://lists.apache.org/thread/17rxys384lzfd6nhm3fztzgvk47zy7jb</a></li>
</ul>
-<h3 id="credits-112">Credits</h3>
+<h3 id="credits-113">Credits</h3>
<ul>
<li>Saurabh Banawar (finder)</li>
<li>Shubham Raj (remediation developer)</li>
@@ -2323,18 +2343,18 @@
<h2 id="CVE-2024-45784">Sensitive configuration values are not masked in the logs by default</h2>
<p>CVE-2024-45784 <a href="https://cve.org/CVERecord?id=CVE-2024-45784">[CVE]</a> <a href="./CVE-2024-45784.cve.json">[CVE json]</a> <a href="./CVE-2024-45784.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-11-15T08:20:02.608Z</em></p>
-<h3 id="affected-114">Affected</h3>
+<h3 id="affected-115">Affected</h3>
<ul>
<li>Apache Airflow before 2.10.3</li>
</ul>
-<h3 id="description-114">Description</h3>
+<h3 id="description-115">Description</h3>
<p>Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG authors to unintentionally or intentionally log sensitive configuration variables. Unauthorized users could access these logs, potentially exposing critical data that could be exploited to compromise the security of the Airflow deployment. In version 2.10.3, secrets are now masked in task logs to prevent sensitive configuration v [...]
-<h3 id="references-114">References</h3>
+<h3 id="references-115">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/43040">https://github.com/apache/airflow/pull/43040</a></li>
<li><a href="https://lists.apache.org/thread/k2jm55jztlbmk4zrlh10syvq3n57hl4h">https://lists.apache.org/thread/k2jm55jztlbmk4zrlh10syvq3n57hl4h</a></li>
</ul>
-<h3 id="credits-113">Credits</h3>
+<h3 id="credits-114">Credits</h3>
<ul>
<li>Saurabh Banawar (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -2342,18 +2362,18 @@
<h2 id="CVE-2024-45498">Command Injection in an example DAG</h2>
<p>CVE-2024-45498 <a href="https://cve.org/CVERecord?id=CVE-2024-45498">[CVE]</a> <a href="./CVE-2024-45498.cve.json">[CVE json]</a> <a href="./CVE-2024-45498.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-09-07T07:43:42.216Z</em></p>
-<h3 id="affected-115">Affected</h3>
+<h3 id="affected-116">Affected</h3>
<ul>
<li>Apache Airflow at 2.10.0</li>
</ul>
-<h3 id="description-115">Description</h3>
+<h3 id="description-116">Description</h3>
<p>Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the dangerous example; see <a target="_blank" rel="nofollow" href="https://github.com/apache/airflow/pull/41873"><a href="https://github.com/apache/airflow/pull/41873">https://github.com/apache [...]
-<h3 id="references-115">References</h3>
+<h3 id="references-116">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/41873">https://github.com/apache/airflow/pull/41873</a></li>
<li><a href="https://lists.apache.org/thread/tl7lzczcqdmqj2pcpbvtjdpd2tb9561n">https://lists.apache.org/thread/tl7lzczcqdmqj2pcpbvtjdpd2tb9561n</a></li>
</ul>
-<h3 id="credits-114">Credits</h3>
+<h3 id="credits-115">Credits</h3>
<ul>
<li>Nhien Pham (aka nhienit) at Galaxy One (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -2361,18 +2381,18 @@
<h2 id="CVE-2024-45034">Authenticated DAG authors could execute code on scheduler nodes</h2>
<p>CVE-2024-45034 <a href="https://cve.org/CVERecord?id=CVE-2024-45034">[CVE]</a> <a href="./CVE-2024-45034.cve.json">[CVE json]</a> <a href="./CVE-2024-45034.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-09-07T07:45:26.032Z</em></p>
-<h3 id="affected-116">Affected</h3>
+<h3 id="affected-117">Affected</h3>
<ul>
<li>Apache Airflow before 2.10.1</li>
</ul>
-<h3 id="description-116">Description</h3>
+<h3 id="description-117">Description</h3>
<p>Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. <br>Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.</p>
-<h3 id="references-116">References</h3>
+<h3 id="references-117">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/41672">https://github.com/apache/airflow/pull/41672</a></li>
<li><a href="https://lists.apache.org/thread/b4fcw33vh60yfg9990n5vmc7sy2dcgjx">https://lists.apache.org/thread/b4fcw33vh60yfg9990n5vmc7sy2dcgjx</a></li>
</ul>
-<h3 id="credits-115">Credits</h3>
+<h3 id="credits-116">Credits</h3>
<ul>
<li>Seokchan Yoon: <a href="https://github.com/ch4n3-yoon">https://github.com/ch4n3-yoon</a> (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -2380,31 +2400,31 @@
<h2 id="CVE-2024-45033">Application does not invalidate session after password change via Airflow cli</h2>
<p>CVE-2024-45033 <a href="https://cve.org/CVERecord?id=CVE-2024-45033">[CVE]</a> <a href="./CVE-2024-45033.cve.json">[CVE json]</a> <a href="./CVE-2024-45033.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-01-08T08:41:37.392Z</em></p>
-<h3 id="affected-117">Affected</h3>
+<h3 id="affected-118">Affected</h3>
<ul>
<li>Apache Airflow Fab Provider before 1.5.2</li>
</ul>
-<h3 id="description-117">Description</h3>
+<h3 id="description-118">Description</h3>
<p>Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider.</p><p>This issue affects Apache Airflow Fab Provider: before 1.5.2.<br><br><span style="background-color: rgb(255, 255, 255);">When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password was changed. This only happened when the password was changed wit [...]
-<h3 id="references-117">References</h3>
+<h3 id="references-118">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/45139">https://github.com/apache/airflow/pull/45139</a></li>
<li><a href="https://lists.apache.org/thread/yw535346rk766ybzpqtvrl36sjj789st">https://lists.apache.org/thread/yw535346rk766ybzpqtvrl36sjj789st</a></li>
</ul>
-<h3 id="credits-116">Credits</h3>
+<h3 id="credits-117">Credits</h3>
<ul>
<li>Saurabh Banawar (reporter)</li>
</ul>
<h2 id="CVE-2024-42447">FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow</h2>
<p>CVE-2024-42447 <a href="https://cve.org/CVERecord?id=CVE-2024-42447">[CVE]</a> <a href="./CVE-2024-42447.cve.json">[CVE json]</a> <a href="./CVE-2024-42447.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-08-04T20:03:30.234Z</em></p>
-<h3 id="affected-118">Affected</h3>
+<h3 id="affected-119">Affected</h3>
<ul>
<li>Apache Airflow Providers FAB from 1.2.0 through 1.2.1</li>
</ul>
-<h3 id="description-118">Description</h3>
+<h3 id="description-119">Description</h3>
<p>Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB.</p><p>This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out. </p><p>* FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected)</p><p>* FAB provider 1.2.0 affected all versions of Airflow.<br></p><p><span style="backgroun [...]
-<h3 id="references-118">References</h3>
+<h3 id="references-119">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/40784">https://github.com/apache/airflow/pull/40784</a></li>
<li><a href="https://lists.apache.org/thread/2zoo8cjlwfjhbfdxfgltcm0hnc0qmc52">https://lists.apache.org/thread/2zoo8cjlwfjhbfdxfgltcm0hnc0qmc52</a></li>
@@ -2412,18 +2432,18 @@
<h2 id="CVE-2024-41937">Stored XSS Vulnerability on provider link</h2>
<p>CVE-2024-41937 <a href="https://cve.org/CVERecord?id=CVE-2024-41937">[CVE]</a> <a href="./CVE-2024-41937.cve.json">[CVE json]</a> <a href="./CVE-2024-41937.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-08-21T15:31:11.725Z</em></p>
-<h3 id="affected-119">Affected</h3>
+<h3 id="affected-120">Affected</h3>
<ul>
<li>Apache Airflow before 2.10.0</li>
</ul>
-<h3 id="description-119">Description</h3>
+<h3 id="description-120">Description</h3>
<p>Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This would require the provider to be installed on the web server and the user to click the provider link.<br>Users should upgrade to 2.10.0 or later, which fixes this vulnerability.</p>
-<h3 id="references-119">References</h3>
+<h3 id="references-120">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/40933">https://github.com/apache/airflow/pull/40933</a></li>
<li><a href="https://lists.apache.org/thread/lwlmgg6hqfmkpvw5py4w53hxyl37jl6d">https://lists.apache.org/thread/lwlmgg6hqfmkpvw5py4w53hxyl37jl6d</a></li>
</ul>
-<h3 id="credits-117">Credits</h3>
+<h3 id="credits-118">Credits</h3>
<ul>
<li>sw0rd1ight (<a href="https://github.com/sw0rd1ight">https://github.com/sw0rd1ight</a>) (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -2431,18 +2451,18 @@
<h2 id="CVE-2024-39877">DAG Author Code Execution possibility in airflow-scheduler</h2>
<p>CVE-2024-39877 <a href="https://cve.org/CVERecord?id=CVE-2024-39877">[CVE]</a> <a href="./CVE-2024-39877.cve.json">[CVE json]</a> <a href="./CVE-2024-39877.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-07-17T07:54:23.158Z</em></p>
-<h3 id="affected-120">Affected</h3>
+<h3 id="affected-121">Affected</h3>
<ul>
<li>Apache Airflow from 2.4.0 before 2.9.3</li>
</ul>
-<h3 id="description-120">Description</h3>
+<h3 id="description-121">Description</h3>
<p>Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability.</p>
-<h3 id="references-120">References</h3>
+<h3 id="references-121">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/40522">https://github.com/apache/airflow/pull/40522</a></li>
<li><a href="https://lists.apache.org/thread/1xhj9dkp37d6pzn24ll2mf94wbqnb2y1">https://lists.apache.org/thread/1xhj9dkp37d6pzn24ll2mf94wbqnb2y1</a></li>
</ul>
-<h3 id="credits-118">Credits</h3>
+<h3 id="credits-119">Credits</h3>
<ul>
<li>Seokchan Yoon (<a href="https://github.com/ch4n3-yoon">https://github.com/ch4n3-yoon</a>) (finder)</li>
<li>Wei Lee (remediation developer)</li>
@@ -2450,18 +2470,18 @@
<h2 id="CVE-2024-39863">Potential XSS Vulnerability</h2>
<p>CVE-2024-39863 <a href="https://cve.org/CVERecord?id=CVE-2024-39863">[CVE]</a> <a href="./CVE-2024-39863.cve.json">[CVE json]</a> <a href="./CVE-2024-39863.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-07-22T08:50:05.686Z</em></p>
-<h3 id="affected-121">Affected</h3>
+<h3 id="affected-122">Affected</h3>
<ul>
<li>Apache Airflow before 2.9.3</li>
</ul>
-<h3 id="description-121">Description</h3>
+<h3 id="description-122">Description</h3>
<p>Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue.<br></p>
-<h3 id="references-121">References</h3>
+<h3 id="references-122">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/40475">https://github.com/apache/airflow/pull/40475</a></li>
<li><a href="https://lists.apache.org/thread/gxkvs279f1mbvckv5q65worr6how20o3">https://lists.apache.org/thread/gxkvs279f1mbvckv5q65worr6how20o3</a></li>
</ul>
-<h3 id="credits-119">Credits</h3>
+<h3 id="credits-120">Credits</h3>
<ul>
<li>Seokchan Yoon (<a href="https://github.com/ch4n3-yoon">https://github.com/ch4n3-yoon</a>) (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -2469,18 +2489,18 @@
<h2 id="CVE-2024-32077">XSS vulnerability in Task Instance Log/Log Details</h2>
<p>CVE-2024-32077 <a href="https://cve.org/CVERecord?id=CVE-2024-32077">[CVE]</a> <a href="./CVE-2024-32077.cve.json">[CVE json]</a> <a href="./CVE-2024-32077.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-05-14T10:43:17.698Z</em></p>
-<h3 id="affected-122">Affected</h3>
+<h3 id="affected-123">Affected</h3>
<ul>
<li>Apache Airflow from 2.9.0 before 2.9.1</li>
</ul>
-<h3 id="description-122">Description</h3>
+<h3 id="description-123">Description</h3>
<p>Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs. <br>Users are recommended to upgrade to version 2.9.1, which fixes this issue.<br></p>
-<h3 id="references-122">References</h3>
+<h3 id="references-123">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/38882">https://github.com/apache/airflow/pull/38882</a></li>
<li><a href="https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77">https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77</a></li>
</ul>
-<h3 id="credits-120">Credits</h3>
+<h3 id="credits-121">Credits</h3>
<ul>
<li>Ming (finder)</li>
<li>Jens Scheffler (remediation developer)</li>
@@ -2488,18 +2508,18 @@
<h2 id="CVE-2024-31869">Sensitive configuration for providers displayed when “non-sensitive-only” config used</h2>
<p>CVE-2024-31869 <a href="https://cve.org/CVERecord?id=CVE-2024-31869">[CVE]</a> <a href="./CVE-2024-31869.cve.json">[CVE json]</a> <a href="./CVE-2024-31869.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-04-18T07:18:58.062Z</em></p>
-<h3 id="affected-123">Affected</h3>
+<h3 id="affected-124">Affected</h3>
<ul>
<li>Apache Airflow from 2.7.0 through 2.8.4</li>
</ul>
-<h3 id="description-123">Description</h3>
+<h3 id="description-124">Description</h3>
<p>Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration <span style="background-color: rgb(255, 255, 255);">via the “configuration” UI page </span>when “non-sensitive-only” was set as “webserver.expose_config” configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your &ldquo [...]
-<h3 id="references-123">References</h3>
+<h3 id="references-124">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/38795">https://github.com/apache/airflow/pull/38795</a></li>
<li><a href="https://lists.apache.org/thread/pz6vg7wcjk901rmsgt86h76g6kfcgtk3">https://lists.apache.org/thread/pz6vg7wcjk901rmsgt86h76g6kfcgtk3</a></li>
</ul>
-<h3 id="credits-121">Credits</h3>
+<h3 id="credits-122">Credits</h3>
<ul>
<li>Manmeet Rangoola (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -2507,56 +2527,56 @@
<h2 id="CVE-2024-29735">Potentially harmful permission changing by log task handler</h2>
<p>CVE-2024-29735 <a href="https://cve.org/CVERecord?id=CVE-2024-29735">[CVE]</a> <a href="./CVE-2024-29735.cve.json">[CVE json]</a> <a href="./CVE-2024-29735.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-03-26T16:52:39.118Z</em></p>
-<h3 id="affected-124">Affected</h3>
+<h3 id="affected-125">Affected</h3>
<ul>
<li>Apache Airflow from 2.8.2 through 2.8.3</li>
</ul>
-<h3 id="description-124">Description</h3>
+<h3 id="description-125">Description</h3>
<p>Improper Preservation of Permissions vulnerability in Apache Airflow.<p>This issue affects Apache Airflow from 2.8.2 through 2.8.3.</p><p></p><p>Airflow’s local file task handler in Airflow incorrectly set permissions for all parent folders of log folder, in default configuration adding write access to Unix <code>group</code> of the folders. In the case Airflow is run with the root user (not recommended) it added group write permission to all folders up to the root of the filesy [...]
-<h3 id="references-124">References</h3>
+<h3 id="references-125">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/37310">https://github.com/apache/airflow/pull/37310</a></li>
<li><a href="https://lists.apache.org/thread/8khb1rtbznh100o325fb8xw5wjvtv536">https://lists.apache.org/thread/8khb1rtbznh100o325fb8xw5wjvtv536</a></li>
</ul>
-<h3 id="credits-122">Credits</h3>
+<h3 id="credits-123">Credits</h3>
<ul>
<li>Matej Murin (finder)</li>
</ul>
<h2 id="CVE-2024-29733">FTP_TLS instance with unverified SSL context</h2>
<p>CVE-2024-29733 <a href="https://cve.org/CVERecord?id=CVE-2024-29733">[CVE]</a> <a href="./CVE-2024-29733.cve.json">[CVE json]</a> <a href="./CVE-2024-29733.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-04-21T17:21:52.458Z</em></p>
-<h3 id="affected-125">Affected</h3>
+<h3 id="affected-126">Affected</h3>
<ul>
<li>Apache Airflow FTP Provider before 3.7.0</li>
</ul>
-<h3 id="description-125">Description</h3>
+<h3 id="description-126">Description</h3>
<p>Improper Certificate Validation vulnerability in Apache Airflow FTP Provider.<br><br><p>The FTP hook lacks complete certificate validation in FTP_TLS connections, which can potentially be leveraged. Implementing proper certificate validation by passing context=ssl.create_default_context() during FTP_TLS instantiation is used as mitigation to validate the certificates properly.</p><p><span style="background-color: var(--wht);">This issue affects Apache Airflow FTP Provider: before 3.7. [...]
-<h3 id="references-125">References</h3>
+<h3 id="references-126">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/38266">https://github.com/apache/airflow/pull/38266</a></li>
<li><a href="https://github.com/apache/airflow/blob/95e26118b828c364755f3a8c96870f3591b01c31/airflow/providers/ftp/hooks/ftp.py#L280">https://github.com/apache/airflow/blob/95e26118b828c364755f3a8c96870f3591b01c31/airflow/providers/ftp/hooks/ftp.py#L280</a></li>
<li><a href="https://docs.python.org/3/library/ssl.html#best-defaults">https://docs.python.org/3/library/ssl.html#best-defaults</a></li>
<li><a href="https://lists.apache.org/thread/265t5zbmtjs6h9fkw52wtp03nsbplky2">https://lists.apache.org/thread/265t5zbmtjs6h9fkw52wtp03nsbplky2</a></li>
</ul>
-<h3 id="credits-123">Credits</h3>
+<h3 id="credits-124">Credits</h3>
<ul>
<li>Eric Brown of Secure Sauce LLC (finder)</li>
</ul>
<h2 id="CVE-2024-28746">Ignored Airflow Permissions</h2>
<p>CVE-2024-28746 <a href="https://cve.org/CVERecord?id=CVE-2024-28746">[CVE]</a> <a href="./CVE-2024-28746.cve.json">[CVE json]</a> <a href="./CVE-2024-28746.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-03-14T08:40:55.534Z</em></p>
-<h3 id="affected-126">Affected</h3>
+<h3 id="affected-127">Affected</h3>
<ul>
<li>Apache Airflow from 2.8.0 before 2.8.3</li>
</ul>
-<h3 id="description-126">Description</h3>
+<h3 id="description-127">Description</h3>
<p>Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access. <br><br>Users of Apache Airflow are recommended to upgrade to version 2.8.3 or newer to mitigate the risk associated with this vulnerability<br></p>
-<h3 id="references-126">References</h3>
+<h3 id="references-127">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/37881">https://github.com/apache/airflow/pull/37881</a></li>
<li><a href="https://lists.apache.org/thread/b4pffc7w7do6qgk4jjbyxvdz5odrvny7">https://lists.apache.org/thread/b4pffc7w7do6qgk4jjbyxvdz5odrvny7</a></li>
</ul>
-<h3 id="credits-124">Credits</h3>
+<h3 id="credits-125">Credits</h3>
<ul>
<li>Alex Liotta (finder)</li>
<li>Vincent(Vincbeck) (remediation developer)</li>
@@ -2564,19 +2584,19 @@
<h2 id="CVE-2024-27906">Dag Code and Import Error Permissions Ignored</h2>
<p>CVE-2024-27906 <a href="https://cve.org/CVERecord?id=CVE-2024-27906">[CVE]</a> <a href="./CVE-2024-27906.cve.json">[CVE json]</a> <a href="./CVE-2024-27906.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-05-06T13:12:04.279Z</em></p>
-<h3 id="affected-127">Affected</h3>
+<h3 id="affected-128">Affected</h3>
<ul>
<li>Apache Airflow before 2.8.2</li>
</ul>
-<h3 id="description-127">Description</h3>
+<h3 id="description-128">Description</h3>
<p>Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI.<br><br>Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability<br></p>
-<h3 id="references-127">References</h3>
+<h3 id="references-128">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/37290">https://github.com/apache/airflow/pull/37290</a></li>
<li><a href="https://github.com/apache/airflow/pull/37468">https://github.com/apache/airflow/pull/37468</a></li>
<li><a href="https://lists.apache.org/thread/on4f7t5sqr3vfgp1pvkck79wv7mq9st5">https://lists.apache.org/thread/on4f7t5sqr3vfgp1pvkck79wv7mq9st5</a></li>
</ul>
-<h3 id="credits-125">Credits</h3>
+<h3 id="credits-126">Credits</h3>
<ul>
<li>Alex Liotta (finder)</li>
<li>Sreenivasulu Suuda (finder)</li>
@@ -2586,75 +2606,75 @@
<h2 id="CVE-2024-26280">Overly broad default permissions for Viewer/Ops (audit logs)</h2>
<p>CVE-2024-26280 <a href="https://cve.org/CVERecord?id=CVE-2024-26280">[CVE]</a> <a href="./CVE-2024-26280.cve.json">[CVE json]</a> <a href="./CVE-2024-26280.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-03-01T11:05:52.165Z</em></p>
-<h3 id="affected-128">Affected</h3>
+<h3 id="affected-129">Affected</h3>
<ul>
<li>Apache Airflow before 2.8.2</li>
</ul>
-<h3 id="description-128">Description</h3>
+<h3 id="description-129">Description</h3>
<p>Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by default, they need to be explicitly granted permissions to see the logs. Only admin users have audit log permission by default.<br><br>Users of Apache Airflow are recommended to upgrade to version [...]
-<h3 id="references-128">References</h3>
+<h3 id="references-129">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/37501">https://github.com/apache/airflow/pull/37501</a></li>
<li><a href="https://lists.apache.org/thread/knskxxxml95091rsnpxkpo1jjp8rj0fh">https://lists.apache.org/thread/knskxxxml95091rsnpxkpo1jjp8rj0fh</a></li>
</ul>
-<h3 id="credits-126">Credits</h3>
+<h3 id="credits-127">Credits</h3>
<ul>
<li>Yusuf AYDIN (@h1_yusuf) (finder)</li>
</ul>
<h2 id="CVE-2024-25142">Cache Control - Storage of Sensitive Data in Browser Cache </h2>
<p>CVE-2024-25142 <a href="https://cve.org/CVERecord?id=CVE-2024-25142">[CVE]</a> <a href="./CVE-2024-25142.cve.json">[CVE json]</a> <a href="./CVE-2024-25142.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-06-14T08:25:32.229Z</em></p>
-<h3 id="affected-129">Affected</h3>
+<h3 id="affected-130">Affected</h3>
<ul>
<li>Apache Airflow before 2.9.2</li>
</ul>
-<h3 id="description-129">Description</h3>
+<h3 id="description-130">Description</h3>
<p>Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. </p><p>Airflow did not return "Cache-Control" header for dynamic content, which in case of some browsers could result in potentially storing sensitive data in local cache of the browser.</p><p>This issue affects Apache Airflow: before 2.9.2.</p><p>Users are recommended to upgrade to version 2.9.2, which fixes the issue.</p>
-<h3 id="references-129">References</h3>
+<h3 id="references-130">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/39550">https://github.com/apache/airflow/pull/39550</a></li>
<li><a href="https://lists.apache.org/thread/cg1j28lk0fhzthk0of1g7vy7p2n1j7nr">https://lists.apache.org/thread/cg1j28lk0fhzthk0of1g7vy7p2n1j7nr</a></li>
</ul>
-<h3 id="credits-127">Credits</h3>
+<h3 id="credits-128">Credits</h3>
<ul>
<li>Jens Scheffler (reporter)</li>
</ul>
<h2 id="CVE-2024-25141">Certificate validation isn’t respected even if SSL is enabled for apache-airflow-providers-mongo </h2>
<p>CVE-2024-25141 <a href="https://cve.org/CVERecord?id=CVE-2024-25141">[CVE]</a> <a href="./CVE-2024-25141.cve.json">[CVE json]</a> <a href="./CVE-2024-25141.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-02-20T20:30:25.779Z</em></p>
-<h3 id="affected-130">Affected</h3>
+<h3 id="affected-131">Affected</h3>
<ul>
<li>Apache Airflow Mongo Provider from 1.0.0 before 4.0.0</li>
</ul>
-<h3 id="description-130">Description</h3>
+<h3 id="description-131">Description</h3>
<p><span style="background-color: rgb(255, 255, 255);">When </span><code>ssl</code><span style="background-color: rgb(255, 255, 255);"> was enabled for Mongo Hook, default settings included “allow_insecure” which caused that certificates were not validated. This was unexpected and undocumented.</span><br>Users are recommended to upgrade to version 4.0.0, which fixes this issue.</p>
-<h3 id="references-130">References</h3>
+<h3 id="references-131">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/37214">https://github.com/apache/airflow/pull/37214</a></li>
<li><a href="https://lists.apache.org/thread/sqgbfqngjmn45ommmrgj7hvs7fgspsgm">https://lists.apache.org/thread/sqgbfqngjmn45ommmrgj7hvs7fgspsgm</a></li>
</ul>
-<h3 id="credits-128">Credits</h3>
+<h3 id="credits-129">Credits</h3>
<ul>
<li>Noah Stapp (reporter)</li>
</ul>
<h2 id="CVE-2023-51702">Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service</h2>
<p>CVE-2023-51702 <a href="https://cve.org/CVERecord?id=CVE-2023-51702">[CVE]</a> <a href="./CVE-2023-51702.cve.json">[CVE json]</a> <a href="./CVE-2023-51702.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-01-24T12:56:15.440Z</em></p>
-<h3 id="affected-131">Affected</h3>
+<h3 id="affected-132">Affected</h3>
<ul>
<li>Apache Airflow CNCF Kubernetes provider from 5.2.0 before 7.0.0</li>
<li>Apache Airflow from 2.3.0 before 2.6.1</li>
</ul>
-<h3 id="description-131">Description</h3>
+<h3 id="description-132">Description</h3>
<p>Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an Airflow version between 2.3.0 and 2.6.0, the configuration dictionary will be logged as plain text in the triggerer service without masking. This allows anyone with access to the metadata or t [...]
-<h3 id="references-131">References</h3>
+<h3 id="references-132">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29498">https://github.com/apache/airflow/pull/29498</a></li>
<li><a href="https://github.com/apache/airflow/pull/30110">https://github.com/apache/airflow/pull/30110</a></li>
<li><a href="https://github.com/apache/airflow/pull/36492">https://github.com/apache/airflow/pull/36492</a></li>
<li><a href="https://lists.apache.org/thread/89x3q6lz5pykrkr1fkr04k4rfn9pvnv9">https://lists.apache.org/thread/89x3q6lz5pykrkr1fkr04k4rfn9pvnv9</a></li>
</ul>
-<h3 id="credits-129">Credits</h3>
+<h3 id="credits-130">Credits</h3>
<ul>
<li>Hussein Awala (finder)</li>
<li>Hussein Awala (remediation developer)</li>
@@ -2662,36 +2682,36 @@
<h2 id="CVE-2023-50944">Bypass permission verification to read code of other dags</h2>
<p>CVE-2023-50944 <a href="https://cve.org/CVERecord?id=CVE-2023-50944">[CVE]</a> <a href="./CVE-2023-50944.cve.json">[CVE json]</a> <a href="./CVE-2023-50944.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-01-24T12:58:17.032Z</em></p>
-<h3 id="affected-132">Affected</h3>
+<h3 id="affected-133">Affected</h3>
<ul>
<li>Apache Airflow before 2.8.1</li>
</ul>
-<h3 id="description-132">Description</h3>
+<h3 id="description-133">Description</h3>
<p>Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don’t have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue.<br></p>
-<h3 id="references-132">References</h3>
+<h3 id="references-133">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/36257">https://github.com/apache/airflow/pull/36257</a></li>
<li><a href="https://lists.apache.org/thread/92krb5mpcq8qrw4t4j5oooqw7hgd8q7h">https://lists.apache.org/thread/92krb5mpcq8qrw4t4j5oooqw7hgd8q7h</a></li>
</ul>
-<h3 id="credits-130">Credits</h3>
+<h3 id="credits-131">Credits</h3>
<ul>
<li>Timon8 Zhang (finder)</li>
</ul>
<h2 id="CVE-2023-50943">Potential pickle deserialization vulnerability in XComs</h2>
<p>CVE-2023-50943 <a href="https://cve.org/CVERecord?id=CVE-2023-50943">[CVE]</a> <a href="./CVE-2023-50943.cve.json">[CVE json]</a> <a href="./CVE-2023-50943.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-01-24T12:57:05.049Z</em></p>
-<h3 id="affected-133">Affected</h3>
+<h3 id="affected-134">Affected</h3>
<ul>
<li>Apache Airflow before 2.8.1</li>
</ul>
-<h3 id="description-133">Description</h3>
+<h3 id="description-134">Description</h3>
<p>Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of “enable_xcom_pickling=False” configuration setting resulting in poisoned data after XCom deserialization. This vulnerability is considered low since it requires a DAG author to exploit it. Users are recommended to upgrade to version 2.8.1 or later, which fixes this issue.<br></p>
-<h3 id="references-133">References</h3>
+<h3 id="references-134">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/36255">https://github.com/apache/airflow/pull/36255</a></li>
<li><a href="https://lists.apache.org/thread/fx278v0twqzxkcts70tc04cp3f8p56pn">https://lists.apache.org/thread/fx278v0twqzxkcts70tc04cp3f8p56pn</a></li>
</ul>
-<h3 id="credits-131">Credits</h3>
+<h3 id="credits-132">Credits</h3>
<ul>
<li>Peng Zhou (<a href="mailto:zpbrent@gmail.com">zpbrent@gmail.com</a>) (finder)</li>
<li>Hussein Awala (remediation developer)</li>
@@ -2699,18 +2719,18 @@
<h2 id="CVE-2023-50783">Improper access control vulnerability on the “varimport” endpoint</h2>
<p>CVE-2023-50783 <a href="https://cve.org/CVERecord?id=CVE-2023-50783">[CVE]</a> <a href="./CVE-2023-50783.cve.json">[CVE json]</a> <a href="./CVE-2023-50783.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-12-21T09:28:46.089Z</em></p>
-<h3 id="affected-134">Affected</h3>
+<h3 id="affected-135">Affected</h3>
<ul>
<li>Apache Airflow before 2.8.0</li>
</ul>
-<h3 id="description-134">Description</h3>
+<h3 id="description-135">Description</h3>
<p>Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable.<br>This flaw compromises the integrity of variable management, potentially leading to unauthorized data modification.<br>Users are recommended to upgrade to 2.8.0, which fixes this issue</p>
-<h3 id="references-134">References</h3>
+<h3 id="references-135">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33932">https://github.com/apache/airflow/pull/33932</a></li>
<li><a href="https://lists.apache.org/thread/rs7cr3yp726mb89s1m844hy9pq7frgcn">https://lists.apache.org/thread/rs7cr3yp726mb89s1m844hy9pq7frgcn</a></li>
</ul>
-<h3 id="credits-132">Credits</h3>
+<h3 id="credits-133">Credits</h3>
<ul>
<li>balis0ng (finder)</li>
<li>Ephraim Anierobi (remediation developer)</li>
@@ -2718,18 +2738,18 @@
<h2 id="CVE-2023-49920">Missing CSRF protection on DAG/trigger</h2>
<p>CVE-2023-49920 <a href="https://cve.org/CVERecord?id=CVE-2023-49920">[CVE]</a> <a href="./CVE-2023-49920.cve.json">[CVE json]</a> <a href="./CVE-2023-49920.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-12-21T09:27:07.715Z</em></p>
-<h3 id="affected-135">Affected</h3>
+<h3 id="affected-136">Affected</h3>
<ul>
<li>Apache Airflow from 2.7.0 before 2.8.0</li>
</ul>
-<h3 id="description-135">Description</h3>
+<h3 id="description-136">Description</h3>
<p>Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user’s consent.<br>Users are advised to upgrade to version 2.8.0 or later which is not affected</p>
-<h3 id="references-135">References</h3>
+<h3 id="references-136">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/36026">https://github.com/apache/airflow/pull/36026</a></li>
<li><a href="https://lists.apache.org/thread/mnwd2vcfw3gms6ft6kl951vfbqrxsnjq">https://lists.apache.org/thread/mnwd2vcfw3gms6ft6kl951vfbqrxsnjq</a></li>
</ul>
-<h3 id="credits-133">Credits</h3>
+<h3 id="credits-134">Credits</h3>
<ul>
<li>Tareq Ahamed ( 0xt4req) (finder)</li>
<li>Jens Scheffler (remediation developer)</li>
@@ -2737,18 +2757,18 @@
<h2 id="CVE-2023-48291">Improper access control to DAG resources</h2>
<p>CVE-2023-48291 <a href="https://cve.org/CVERecord?id=CVE-2023-48291">[CVE]</a> <a href="./CVE-2023-48291.cve.json">[CVE json]</a> <a href="./CVE-2023-48291.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-12-21T09:30:40.260Z</em></p>
-<h3 id="affected-136">Affected</h3>
+<h3 id="affected-137">Affected</h3>
<ul>
<li>Apache Airflow before 2.8.0</li>
</ul>
-<h3 id="description-136">Description</h3>
+<h3 id="description-137">Description</h3>
<p>Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn’t.<br><br>This is a missing fix for CVE-2023-42792 in Apache Airflow 2.7.2 <br><br>Users of Apache Airflow are strongly advised to upgrade to version 2.8.0 or newe [...]
-<h3 id="references-136">References</h3>
+<h3 id="references-137">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/34366">https://github.com/apache/airflow/pull/34366</a></li>
<li><a href="https://lists.apache.org/thread/3nl0h014274yjlt1hd02z0q78ftyz0z3">https://lists.apache.org/thread/3nl0h014274yjlt1hd02z0q78ftyz0z3</a></li>
</ul>
-<h3 id="credits-134">Credits</h3>
+<h3 id="credits-135">Credits</h3>
<ul>
<li>balis0ng (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -2756,18 +2776,18 @@
<h2 id="CVE-2023-47265">DAG Params alllow to embed unchecked Javascript</h2>
<p>CVE-2023-47265 <a href="https://cve.org/CVERecord?id=CVE-2023-47265">[CVE]</a> <a href="./CVE-2023-47265.cve.json">[CVE json]</a> <a href="./CVE-2023-47265.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-12-21T09:28:05.966Z</em></p>
-<h3 id="affected-137">Affected</h3>
+<h3 id="affected-138">Affected</h3>
<ul>
<li>Apache Airflow from 2.6.0 before 2.8.0</li>
</ul>
-<h3 id="description-137">Description</h3>
+<h3 id="description-138">Description</h3>
<p>Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG. This Javascript can be executed on the client side of any of the user who looks at the tasks in the browser sandbox. While this issue does not allow to exit the browser sandbox or manipulation of the server-side data - more than the DAG author already has, it allows to modify what the user l [...]
-<h3 id="references-137">References</h3>
+<h3 id="references-138">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/35460">https://github.com/apache/airflow/pull/35460</a></li>
<li><a href="https://lists.apache.org/thread/128f3zl375vb1qv93k82zhnwkpl233pr">https://lists.apache.org/thread/128f3zl375vb1qv93k82zhnwkpl233pr</a></li>
</ul>
-<h3 id="credits-135">Credits</h3>
+<h3 id="credits-136">Credits</h3>
<ul>
<li>Jens Scheffler (finder)</li>
<li>Andrey Anshin (finder)</li>
@@ -2776,18 +2796,18 @@
<h2 id="CVE-2023-47037">Apache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access)</h2>
<p>CVE-2023-47037 <a href="https://cve.org/CVERecord?id=CVE-2023-47037">[CVE]</a> <a href="./CVE-2023-47037.cve.json">[CVE json]</a> <a href="./CVE-2023-47037.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-11-12T13:12:20.076Z</em></p>
-<h3 id="affected-138">Affected</h3>
+<h3 id="affected-139">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.3</li>
</ul>
-<h3 id="description-138">Description</h3>
+<h3 id="description-139">Description</h3>
<p><span style="background-color: rgb(255, 255, 255);">We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then. </span></p><p><span style="background-color: rgb(255, 255, 255);">Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, et [...]
-<h3 id="references-138">References</h3>
+<h3 id="references-139">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33413">https://github.com/apache/airflow/pull/33413</a></li>
<li><a href="https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0">https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0</a></li>
</ul>
-<h3 id="credits-136">Credits</h3>
+<h3 id="credits-137">Credits</h3>
<ul>
<li>Tareq Ahamed from Hackerone (reporter)</li>
<li>Augusto Hidalgo (remediation developer)</li>
@@ -2795,18 +2815,18 @@
<h2 id="CVE-2023-46288">Sensitive parameters exposed in API when “non-sensitive-only” configuration is set</h2>
<p>CVE-2023-46288 <a href="https://cve.org/CVERecord?id=CVE-2023-46288">[CVE]</a> <a href="./CVE-2023-46288.cve.json">[CVE json]</a> <a href="./CVE-2023-46288.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-10-23T18:13:01.162Z</em></p>
-<h3 id="affected-139">Affected</h3>
+<h3 id="affected-140">Affected</h3>
<ul>
<li>Apache Airflow from 2.4.0 before 2.7.0</li>
</ul>
-<h3 id="description-139">Description</h3>
+<h3 id="description-140">Description</h3>
<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.<p>This issue affects Apache Airflow from 2.4.0 to 2.7.0.</p><p>Sensitive configuration information has been exposed to authenticated users with the ability to read configuration via Airflow REST API for configuration even when the <code>expose_config</code> option is set to <code>non-sensitive-only</code>. The expose_config option is False by default. It is recommended to upgrade to a version t [...]
-<h3 id="references-139">References</h3>
+<h3 id="references-140">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/32261">https://github.com/apache/airflow/pull/32261</a></li>
<li><a href="https://lists.apache.org/thread/yw4vzm0c5lqkwm0bxv6qy03yfd1od4nw">https://lists.apache.org/thread/yw4vzm0c5lqkwm0bxv6qy03yfd1od4nw</a></li>
</ul>
-<h3 id="credits-137">Credits</h3>
+<h3 id="credits-138">Credits</h3>
<ul>
<li>id_No2015429 of 3H Secruity Team (finder)</li>
<li>Lee, Wei (finder)</li>
@@ -2815,37 +2835,37 @@
<h2 id="CVE-2023-46215">Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend</h2>
<p>CVE-2023-46215 <a href="https://cve.org/CVERecord?id=CVE-2023-46215">[CVE]</a> <a href="./CVE-2023-46215.cve.json">[CVE json]</a> <a href="./CVE-2023-46215.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-10-28T07:10:54.392Z</em></p>
-<h3 id="affected-140">Affected</h3>
+<h3 id="affected-141">Affected</h3>
<ul>
<li>Apache Airflow Celery provider from 3.3.0 through 3.4.0</li>
<li>Apache Airflow from 1.10.0 before 2.7.0</li>
</ul>
-<h3 id="description-140">Description</h3>
+<h3 id="description-141">Description</h3>
<p>Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow.<br><br><p>Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend<br>Note: the vulnerability is about the information exposed in the logs not about accessing the logs.</p><p>This issue affects Apache Airflow Celery provider: from 3.3.0 through 3.4.0; Apache Airflow: from 1.10.0 through 2.6.3.</p><p>Users are recommended [...]
-<h3 id="references-140">References</h3>
+<h3 id="references-141">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/34954">https://github.com/apache/airflow/pull/34954</a></li>
<li><a href="https://lists.apache.org/thread/wm1jfmks7r6m7bj0mq4lmw3998svn46n">https://lists.apache.org/thread/wm1jfmks7r6m7bj0mq4lmw3998svn46n</a></li>
</ul>
-<h3 id="credits-138">Credits</h3>
+<h3 id="credits-139">Credits</h3>
<ul>
<li>husseinawala (finder)</li>
</ul>
<h2 id="CVE-2023-45348">Configuration information leakage vulnerability</h2>
<p>CVE-2023-45348 <a href="https://cve.org/CVERecord?id=CVE-2023-45348">[CVE]</a> <a href="./CVE-2023-45348.cve.json">[CVE json]</a> <a href="./CVE-2023-45348.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-10-14T09:46:37.359Z</em></p>
-<h3 id="affected-141">Affected</h3>
+<h3 id="affected-142">Affected</h3>
<ul>
<li>Apache Airflow from 2.7.0 before 2.7.2</li>
</ul>
-<h3 id="description-141">Description</h3>
+<h3 id="description-142">Description</h3>
<p>Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when the “expose_config” option is set to “non-sensitive-only”. The <code>expose_config</code> option is False by default.<br>It is recommended to upgrade to a version that is not affected.</p>
-<h3 id="references-141">References</h3>
+<h3 id="references-142">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/34712">https://github.com/apache/airflow/pull/34712</a></li>
<li><a href="https://lists.apache.org/thread/sy4l5d6tn58hr8r61r2fkt1f0qock9z9">https://lists.apache.org/thread/sy4l5d6tn58hr8r61r2fkt1f0qock9z9</a></li>
</ul>
-<h3 id="credits-139">Credits</h3>
+<h3 id="credits-140">Credits</h3>
<ul>
<li>L3yx of Syclover Security Team (finder)</li>
<li>Hussein Awala (remediation developer)</li>
@@ -2853,18 +2873,18 @@
<h2 id="CVE-2023-42792">Improper access control to DAG resources</h2>
<p>CVE-2023-42792 <a href="https://cve.org/CVERecord?id=CVE-2023-42792">[CVE]</a> <a href="./CVE-2023-42792.cve.json">[CVE json]</a> <a href="./CVE-2023-42792.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-10-14T09:47:04.851Z</em></p>
-<h3 id="affected-142">Affected</h3>
+<h3 id="affected-143">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.2</li>
</ul>
-<h3 id="description-142">Description</h3>
+<h3 id="description-143">Description</h3>
<p>Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn’t.<br><br>Users of Apache Airflow are strongly advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.<br></p>
-<h3 id="references-142">References</h3>
+<h3 id="references-143">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/34366">https://github.com/apache/airflow/pull/34366</a></li>
<li><a href="https://lists.apache.org/thread/1spbo9nkn49fc2hnxqm9tf6mgqwp9tjq">https://lists.apache.org/thread/1spbo9nkn49fc2hnxqm9tf6mgqwp9tjq</a></li>
</ul>
-<h3 id="credits-140">Credits</h3>
+<h3 id="credits-141">Credits</h3>
<ul>
<li>balis0ng (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -2872,18 +2892,18 @@
<h2 id="CVE-2023-42781">Permission verification bypass allows viewing dagruns of other dags</h2>
<p>CVE-2023-42781 <a href="https://cve.org/CVERecord?id=CVE-2023-42781">[CVE]</a> <a href="./CVE-2023-42781.cve.json">[CVE json]</a> <a href="./CVE-2023-42781.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-11-12T13:14:05.928Z</em></p>
-<h3 id="affected-143">Affected</h3>
+<h3 id="affected-144">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.3</li>
</ul>
-<h3 id="description-143">Description</h3>
+<h3 id="description-144">Description</h3>
<p>Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. This is a different issue than CVE-2023-42663 but leading to similar outcome.<br>Users of Apache Airflow are advised to upgrade to version 2.7.3 or newer to mitigate the risk associated with this vulnerability.</p>
-<h3 id="references-143">References</h3>
+<h3 id="references-144">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/34939">https://github.com/apache/airflow/pull/34939</a></li>
<li><a href="https://lists.apache.org/thread/7dnl8nszdxqyns57f3dw0sloy5dfl9o1">https://lists.apache.org/thread/7dnl8nszdxqyns57f3dw0sloy5dfl9o1</a></li>
</ul>
-<h3 id="credits-141">Credits</h3>
+<h3 id="credits-142">Credits</h3>
<ul>
<li>balis0ng (finder)</li>
<li>Hussein Awala (remediation developer)</li>
@@ -2891,18 +2911,18 @@
<h2 id="CVE-2023-42780">Improper access control vulnerability in the “List dag warnings” feature</h2>
<p>CVE-2023-42780 <a href="https://cve.org/CVERecord?id=CVE-2023-42780">[CVE]</a> <a href="./CVE-2023-42780.cve.json">[CVE json]</a> <a href="./CVE-2023-42780.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-10-14T09:46:05.032Z</em></p>
-<h3 id="affected-144">Affected</h3>
+<h3 id="affected-145">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.2</li>
</ul>
-<h3 id="description-144">Description</h3>
+<h3 id="description-145">Description</h3>
<p>Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAGs. It would reveal the dag_ids and the stack-traces of import errors for those DAGs with import errors.<br>Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.<br><br></p>
-<h3 id="references-144">References</h3>
+<h3 id="references-145">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/34355">https://github.com/apache/airflow/pull/34355</a></li>
<li><a href="https://lists.apache.org/thread/h5tvsvov8j55wojt5sojdprs05oby34d">https://lists.apache.org/thread/h5tvsvov8j55wojt5sojdprs05oby34d</a></li>
</ul>
-<h3 id="credits-142">Credits</h3>
+<h3 id="credits-143">Credits</h3>
<ul>
<li>balis0ng (finder)</li>
<li>Hussein Awala (remediation developer)</li>
@@ -2910,18 +2930,18 @@
<h2 id="CVE-2023-42663">Bypass permission verification to view task instances of other dags</h2>
<p>CVE-2023-42663 <a href="https://cve.org/CVERecord?id=CVE-2023-42663">[CVE]</a> <a href="./CVE-2023-42663.cve.json">[CVE json]</a> <a href="./CVE-2023-42663.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-10-14T09:47:24.055Z</em></p>
-<h3 id="affected-145">Affected</h3>
+<h3 id="affected-146">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.2</li>
</ul>
-<h3 id="description-145">Description</h3>
+<h3 id="description-146">Description</h3>
<p>Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs.<br>Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.<br></p>
-<h3 id="references-145">References</h3>
+<h3 id="references-146">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/34315">https://github.com/apache/airflow/pull/34315</a></li>
<li><a href="https://lists.apache.org/thread/xj86cvfkxgd0cyqfmz6mh1bsfc61c6o9">https://lists.apache.org/thread/xj86cvfkxgd0cyqfmz6mh1bsfc61c6o9</a></li>
</ul>
-<h3 id="credits-143">Credits</h3>
+<h3 id="credits-144">Credits</h3>
<ul>
<li>balis0ng (finder)</li>
<li>Ephraim Anierobi (remediation developer)</li>
@@ -2929,74 +2949,74 @@
<h2 id="CVE-2023-41267">Apache HDFS Provider error message suggested installation of incorrect pip package</h2>
<p>CVE-2023-41267 <a href="https://cve.org/CVERecord?id=CVE-2023-41267">[CVE]</a> <a href="./CVE-2023-41267.cve.json">[CVE json]</a> <a href="./CVE-2023-41267.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-09-14T07:46:36.891Z</em></p>
-<h3 id="affected-146">Affected</h3>
+<h3 id="affected-147">Affected</h3>
<ul>
<li>Apache Airflow HDFS Provider before 4.1.1</li>
</ul>
-<h3 id="description-146">Description</h3>
+<h3 id="description-147">Description</h3>
<p><span style="background-color: rgb(255, 255, 255);">In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The Airflow team has since taken ownership of the package (neutralizing the risk), and fixed the doc strings in version 4.1.1</span><br></p>
-<h3 id="references-146">References</h3>
+<h3 id="references-147">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33813">https://github.com/apache/airflow/pull/33813</a></li>
<li><a href="https://lists.apache.org/thread/ggthr5pn42bn6wcr25hxnykjzh4ntw7z">https://lists.apache.org/thread/ggthr5pn42bn6wcr25hxnykjzh4ntw7z</a></li>
</ul>
-<h3 id="credits-144">Credits</h3>
+<h3 id="credits-145">Credits</h3>
<ul>
<li>AnupamAs01 (finder)</li>
</ul>
<h2 id="CVE-2023-40712">Secrets can be unmasked in the “Rendered Template” </h2>
<p>CVE-2023-40712 <a href="https://cve.org/CVERecord?id=CVE-2023-40712">[CVE]</a> <a href="./CVE-2023-40712.cve.json">[CVE json]</a> <a href="./CVE-2023-40712.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-09-12T11:05:46.999Z</em></p>
-<h3 id="affected-147">Affected</h3>
+<h3 id="affected-148">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.1</li>
</ul>
-<h3 id="description-147">Description</h3>
+<h3 id="description-148">Description</h3>
<p>Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI.<br><br>Users are strongly advised to upgrade to version 2.7.1 or later which has removed the vulnerability.</p>
-<h3 id="references-147">References</h3>
+<h3 id="references-148">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33512">https://github.com/apache/airflow/pull/33512</a></li>
<li><a href="https://github.com/apache/airflow/pull/33516">https://github.com/apache/airflow/pull/33516</a></li>
<li><a href="https://lists.apache.org/thread/jw1yv4lt6hpowqbb0x4o3tdp0jhx2bts">https://lists.apache.org/thread/jw1yv4lt6hpowqbb0x4o3tdp0jhx2bts</a></li>
</ul>
-<h3 id="credits-145">Credits</h3>
+<h3 id="credits-146">Credits</h3>
<ul>
<li>klexadoc (finder)</li>
</ul>
<h2 id="CVE-2023-40611">Apache Airflow Dag Runs Broken Access Control Vulnerability</h2>
<p>CVE-2023-40611 <a href="https://cve.org/CVERecord?id=CVE-2023-40611">[CVE]</a> <a href="./CVE-2023-40611.cve.json">[CVE json]</a> <a href="./CVE-2023-40611.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-09-12T11:05:20.884Z</em></p>
-<h3 id="affected-148">Affected</h3>
+<h3 id="affected-149">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.1</li>
</ul>
-<h3 id="description-148">Description</h3>
+<h3 id="description-149">Description</h3>
<p>Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.<br><br>Users should upgrade to version 2.7.1 or later which has removed the vulnerability.<br></p>
-<h3 id="references-148">References</h3>
+<h3 id="references-149">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33413">https://github.com/apache/airflow/pull/33413</a></li>
<li><a href="https://lists.apache.org/thread/8y9xk1s3j4qr36yzqn8ogbn9fl7pxrn0">https://lists.apache.org/thread/8y9xk1s3j4qr36yzqn8ogbn9fl7pxrn0</a></li>
</ul>
-<h3 id="credits-146">Credits</h3>
+<h3 id="credits-147">Credits</h3>
<ul>
<li>happyhacking (finder)</li>
</ul>
<h2 id="CVE-2023-40273">Session fixation in Apache Airflow web interface</h2>
<p>CVE-2023-40273 <a href="https://cve.org/CVERecord?id=CVE-2023-40273">[CVE]</a> <a href="./CVE-2023-40273.cve.json">[CVE json]</a> <a href="./CVE-2023-40273.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-09-12T06:41:25.454Z</em></p>
-<h3 id="affected-149">Affected</h3>
+<h3 id="affected-150">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.0</li>
</ul>
-<h3 id="description-149">Description</h3>
+<h3 id="description-150">Description</h3>
<p>The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database (for <code>database</code> session backend), or changing the secure_key and restarting the webserver, there were no mechanisms to force-logout the user (and all other users with that).</p><p>With this fix implement [...]
-<h3 id="references-149">References</h3>
+<h3 id="references-150">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33347">https://github.com/apache/airflow/pull/33347</a></li>
<li><a href="https://lists.apache.org/thread/9rdmv8ln4y4ncbyrlmjrsj903x4l80nj">https://lists.apache.org/thread/9rdmv8ln4y4ncbyrlmjrsj903x4l80nj</a></li>
<li><a href="https://www.openwall.com/lists/oss-security/2023/08/23/1">https://www.openwall.com/lists/oss-security/2023/08/23/1</a></li>
</ul>
-<h3 id="credits-147">Credits</h3>
+<h3 id="credits-148">Credits</h3>
<ul>
<li>Yusuf AYDIN (@h1_yusuf) (finder)</li>
<li>L3yx of Syclover Security Team. (finder)</li>
@@ -3006,53 +3026,53 @@
<h2 id="CVE-2023-40272">Apache Airflow Spark Provider Arbitrary File Read via JDBC</h2>
<p>CVE-2023-40272 <a href="https://cve.org/CVERecord?id=CVE-2023-40272">[CVE]</a> <a href="./CVE-2023-40272.cve.json">[CVE json]</a> <a href="./CVE-2023-40272.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-08-17T13:52:26.145Z</em></p>
-<h3 id="affected-150">Affected</h3>
+<h3 id="affected-151">Affected</h3>
<ul>
<li>Apache Airflow Spark Provider before 4.1.3</li>
</ul>
-<h3 id="description-150">Description</h3>
+<h3 id="description-151">Description</h3>
<p>Apache Airflow Spark Provider, versions before 4.1.3, is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection giving an opportunity to read files on the Airflow server.<br>It is recommended to upgrade to a version that is not affected.</p><p></p>
-<h3 id="references-150">References</h3>
+<h3 id="references-151">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/t03gktyzyor20rh06okd91jtqmw6k1l7">https://lists.apache.org/thread/t03gktyzyor20rh06okd91jtqmw6k1l7</a></li>
</ul>
-<h3 id="credits-148">Credits</h3>
+<h3 id="credits-149">Credits</h3>
<ul>
<li>sw0rd1ight (finder)</li>
</ul>
<h2 id="CVE-2023-40195">Apache Airflow Spark Provider Deserialization Vulnerability RCE</h2>
<p>CVE-2023-40195 <a href="https://cve.org/CVERecord?id=CVE-2023-40195">[CVE]</a> <a href="./CVE-2023-40195.cve.json">[CVE json]</a> <a href="./CVE-2023-40195.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-08-28T07:49:59.173Z</em></p>
-<h3 id="affected-151">Affected</h3>
+<h3 id="affected-152">Affected</h3>
<ul>
<li>Apache Airflow Spark Provider before 4.1.3</li>
</ul>
-<h3 id="description-151">Description</h3>
+<h3 id="description-152">Description</h3>
<p>Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Software Foundation Apache Airflow Spark Provider.<br><br><br><span style="background-color: rgb(255, 255, 255);">When the Apache Spark provider is installed on an Airflow deployment, an Airflow user that is authorized to configure Spark hooks can effectively run arbitrary code on the Airflow node by pointing it at a malicious Spark server. Prior to version 4.1.3, this w [...]
-<h3 id="references-151">References</h3>
+<h3 id="references-152">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33233">https://github.com/apache/airflow/pull/33233</a></li>
<li><a href="https://lists.apache.org/thread/fzy95b1d6zv31j5wrx3znhzcscck2o24">https://lists.apache.org/thread/fzy95b1d6zv31j5wrx3znhzcscck2o24</a></li>
</ul>
-<h3 id="credits-149">Credits</h3>
+<h3 id="credits-150">Credits</h3>
<ul>
<li>happyhacking-k (finder)</li>
</ul>
<h2 id="CVE-2023-39553">Apache Airflow Drill Provider Arbitrary File Read Vulnerability</h2>
<p>CVE-2023-39553 <a href="https://cve.org/CVERecord?id=CVE-2023-39553">[CVE]</a> <a href="./CVE-2023-39553.cve.json">[CVE json]</a> <a href="./CVE-2023-39553.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-08-11T18:42:20.040Z</em></p>
-<h3 id="affected-152">Affected</h3>
+<h3 id="affected-153">Affected</h3>
<ul>
<li>Apache Airflow Drill Provider before 2.4.3</li>
</ul>
-<h3 id="description-152">Description</h3>
+<h3 id="description-153">Description</h3>
<p>Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.<br><br><span style="background-color: rgb(255, 255, 255);">Apache Airflow Drill Provider is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection with DrillHook giving an opportunity to read files on the Airflow server.</span><br><p>This issue affects Apache Airflow Drill Provider: before 2.4.3.<br><span style="background-col [...]
-<h3 id="references-152">References</h3>
+<h3 id="references-153">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33074">https://github.com/apache/airflow/pull/33074</a></li>
<li><a href="https://lists.apache.org/thread/ozpl0opmob49rkcz8svo8wkxyw1395sf">https://lists.apache.org/thread/ozpl0opmob49rkcz8svo8wkxyw1395sf</a></li>
</ul>
-<h3 id="credits-150">Credits</h3>
+<h3 id="credits-151">Credits</h3>
<ul>
<li>sw0rd1ight of Caiji Sec Team and 4ra1n of Chaitin Tech (finder)</li>
<li>happyhacking (finder)</li>
@@ -3060,75 +3080,75 @@
<h2 id="CVE-2023-39508">Airflow “Run task” feature allows execution with unnecessary priviledges</h2>
<p>CVE-2023-39508 <a href="https://cve.org/CVERecord?id=CVE-2023-39508">[CVE]</a> <a href="./CVE-2023-39508.cve.json">[CVE json]</a> <a href="./CVE-2023-39508.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-08-05T06:47:11.955Z</em></p>
-<h3 id="affected-153">Affected</h3>
+<h3 id="affected-154">Affected</h3>
<ul>
<li>Apache Airflow before 2.6.0</li>
</ul>
-<h3 id="description-153">Description</h3>
+<h3 id="description-154">Description</h3>
<p>Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.<p>The “Run Task” feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the webserver context as well as allows to bypas limitation of access the user has to certain DAGs. The “Run Task” feature is considered dangerous and it has been removed enti [...]
-<h3 id="references-153">References</h3>
+<h3 id="references-154">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29706">https://github.com/apache/airflow/pull/29706</a></li>
<li><a href="https://lists.apache.org/thread/j2nkjd0zqvtqk85s6ywpx3c35pvzyx15">https://lists.apache.org/thread/j2nkjd0zqvtqk85s6ywpx3c35pvzyx15</a></li>
</ul>
-<h3 id="credits-151">Credits</h3>
+<h3 id="credits-152">Credits</h3>
<ul>
<li>balis0ng (finder)</li>
</ul>
<h2 id="CVE-2023-39441">SMTP/IMAP client components allowed MITM due to missing Certificate Validation</h2>
<p>CVE-2023-39441 <a href="https://cve.org/CVERecord?id=CVE-2023-39441">[CVE]</a> <a href="./CVE-2023-39441.cve.json">[CVE json]</a> <a href="./CVE-2023-39441.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-08-23T15:39:49.970Z</em></p>
-<h3 id="affected-154">Affected</h3>
+<h3 id="affected-155">Affected</h3>
<ul>
<li>Apache Airflow SMTP Provider before 1.30</li>
<li>Apache Airflow IMAP Provider before 3.3.0</li>
<li>Apache Airflow before 2.7.0</li>
</ul>
-<h3 id="description-154">Description</h3>
+<h3 id="description-155">Description</h3>
<p><span style="background-color: rgb(255, 255, 255);">Apache Airflow SMTP Provider </span><span style="background-color: rgb(255, 255, 255);">before 1.3.0</span><span style="background-color: rgb(255, 255, 255);">, Apache Airflow IMAP Provider </span><span style="background-color: rgb(255, 255, 255);">before 3.3.0, and</span><span style="background-color: rgb(255, 255, 255);"> Apache Airflow </span><span style="background-color: rgb(255, 255, 255);">before 2.7.0 are affected by the </sp [...]
-<h3 id="references-154">References</h3>
+<h3 id="references-155">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33075">https://github.com/apache/airflow/pull/33075</a></li>
<li><a href="https://github.com/apache/airflow/pull/33108">https://github.com/apache/airflow/pull/33108</a></li>
<li><a href="https://github.com/apache/airflow/pull/33070">https://github.com/apache/airflow/pull/33070</a></li>
<li><a href="https://lists.apache.org/thread/xzp4wgjg2b1o6ylk2595df8bstlbo1lb">https://lists.apache.org/thread/xzp4wgjg2b1o6ylk2595df8bstlbo1lb</a></li>
</ul>
-<h3 id="credits-152">Credits</h3>
+<h3 id="credits-153">Credits</h3>
<ul>
<li>Martin Schobert, Pentagrid AG (finder)</li>
</ul>
<h2 id="CVE-2023-37415">Improper Input Validation in Hive Provider with proxy_user</h2>
<p>CVE-2023-37415 <a href="https://cve.org/CVERecord?id=CVE-2023-37415">[CVE]</a> <a href="./CVE-2023-37415.cve.json">[CVE json]</a> <a href="./CVE-2023-37415.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-07-13T07:35:30.726Z</em></p>
-<h3 id="affected-155">Affected</h3>
+<h3 id="affected-156">Affected</h3>
<ul>
<li>Apache Airflow Apache Hive Provider before 6.1.2</li>
</ul>
-<h3 id="description-155">Description</h3>
+<h3 id="description-156">Description</h3>
<p>Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider.<br><br>Patching on top of CVE-2023-35797<br><p>Before 6.1.2<span style="background-color: rgb(255, 255, 255);"> the proxy_user option can also inject semicolon.<br></span><br>This issue affects Apache Airflow Apache Hive Provider: before 6.1.2.<br><br></p><p>It is recommended updating provider version to 6.1.2 in order to avoid this vulnerability.</p><p></p></p>
-<h3 id="references-155">References</h3>
+<h3 id="references-156">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/9wx0jlckbnycjh8nj5qfwxo423zvm41k">https://lists.apache.org/thread/9wx0jlckbnycjh8nj5qfwxo423zvm41k</a></li>
</ul>
-<h3 id="credits-153">Credits</h3>
+<h3 id="credits-154">Credits</h3>
<ul>
<li>Son Tran from VNPT - VCI (reporter)</li>
</ul>
<h2 id="CVE-2023-37379">Exposure of sensitive connection information, DOS and SSRF on “test connection” feature</h2>
<p>CVE-2023-37379 <a href="https://cve.org/CVERecord?id=CVE-2023-37379">[CVE]</a> <a href="./CVE-2023-37379.cve.json">[CVE json]</a> <a href="./CVE-2023-37379.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-08-23T15:38:53.691Z</em></p>
-<h3 id="affected-156">Affected</h3>
+<h3 id="affected-157">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.0</li>
</ul>
-<h3 id="description-156">Description</h3>
+<h3 id="description-157">Description</h3>
<p>Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connection feature by sending many requests, leading to a denial of service (DoS) condition on the server. Furthermore, malicious actors can leverage this vulnerability to establish harmful connections with the server.</p><p>Users of Ap [...]
-<h3 id="references-156">References</h3>
+<h3 id="references-157">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/32052">https://github.com/apache/airflow/pull/32052</a></li>
<li><a href="https://lists.apache.org/thread/g5c9vcn27lr14go48thrjpo6f4vw571r">https://lists.apache.org/thread/g5c9vcn27lr14go48thrjpo6f4vw571r</a></li>
</ul>
-<h3 id="credits-154">Credits</h3>
+<h3 id="credits-155">Credits</h3>
<ul>
<li>kuteminh11 (finder)</li>
<li>khoabda of Zalo Security Team (finder)</li>
@@ -3139,18 +3159,18 @@
<h2 id="CVE-2023-36543">ReDoS via dags function</h2>
<p>CVE-2023-36543 <a href="https://cve.org/CVERecord?id=CVE-2023-36543">[CVE]</a> <a href="./CVE-2023-36543.cve.json">[CVE json]</a> <a href="./CVE-2023-36543.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-07-21T10:49:41.270Z</em></p>
-<h3 id="affected-157">Affected</h3>
+<h3 id="affected-158">Affected</h3>
<ul>
<li>Apache Airflow before 2.6.3</li>
</ul>
-<h3 id="description-157">Description</h3>
+<h3 id="description-158">Description</h3>
<p>Apache Airflow, versions before 2.6.3, has a vulnerability where an authenticated user can use crafted input to make the current request hang. It is recommended to upgrade to a version that is not affected</p>
-<h3 id="references-157">References</h3>
+<h3 id="references-158">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/32060">https://github.com/apache/airflow/pull/32060</a></li>
<li><a href="https://lists.apache.org/thread/tokfs980504ylgk3cv3hjlnrtbv4tng4">https://lists.apache.org/thread/tokfs980504ylgk3cv3hjlnrtbv4tng4</a></li>
</ul>
-<h3 id="credits-155">Credits</h3>
+<h3 id="credits-156">Credits</h3>
<ul>
<li>National Cyber Security VietNam (NCS VietNam) (finder)</li>
<li>hungtd (finder)</li>
@@ -3158,124 +3178,124 @@
<h2 id="CVE-2023-35908">Access to DAGs without relevant permission</h2>
<p>CVE-2023-35908 <a href="https://cve.org/CVERecord?id=CVE-2023-35908">[CVE]</a> <a href="./CVE-2023-35908.cve.json">[CVE json]</a> <a href="./CVE-2023-35908.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-07-12T09:14:08.022Z</em></p>
-<h3 id="affected-158">Affected</h3>
+<h3 id="affected-159">Affected</h3>
<ul>
<li>Apache Airflow before 2.6.3</li>
</ul>
-<h3 id="description-158">Description</h3>
+<h3 id="description-159">Description</h3>
<p>Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL. It is recommended to upgrade to a version that is not affected</p>
-<h3 id="references-158">References</h3>
+<h3 id="references-159">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/32014">https://github.com/apache/airflow/pull/32014</a></li>
<li><a href="https://lists.apache.org/thread/vsflptk5dt30vrfggn96nx87d7zr6yvw">https://lists.apache.org/thread/vsflptk5dt30vrfggn96nx87d7zr6yvw</a></li>
</ul>
-<h3 id="credits-156">Credits</h3>
+<h3 id="credits-157">Credits</h3>
<ul>
<li>Name : Karthikeyan Singaravelan Employer : Visa (finder)</li>
</ul>
<h2 id="CVE-2023-35798">Airflow Apache ODBC and MSSQL Providers Arbitrary File Read Vulnerability</h2>
<p>CVE-2023-35798 <a href="https://cve.org/CVERecord?id=CVE-2023-35798">[CVE]</a> <a href="./CVE-2023-35798.cve.json">[CVE json]</a> <a href="./CVE-2023-35798.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-06-27T11:39:49.794Z</em></p>
-<h3 id="affected-159">Affected</h3>
+<h3 id="affected-160">Affected</h3>
<ul>
<li>Apache Airflow ODBC Provider before 4.0.0</li>
<li>Apache Airflow MSSQL Provider before 3.4.1</li>
</ul>
-<h3 id="description-159">Description</h3>
+<h3 id="description-160">Description</h3>
<p>Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.<p>This vulnerability is considered low since it requires DAG code to use <code><span style="background-color: rgb(255, 255, 255);">get_sqlalchemy_connection</code> and someone with access to connection resources specifically updating the connection to <span style="background-color: rgb(255, 255, 255);">exploit it.</span><b [...]
-<h3 id="references-159">References</h3>
+<h3 id="references-160">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/31984">https://github.com/apache/airflow/pull/31984</a></li>
<li><a href="https://lists.apache.org/thread/951rb9m7wwox5p30tdvcfjxq8j1mp4pj">https://lists.apache.org/thread/951rb9m7wwox5p30tdvcfjxq8j1mp4pj</a></li>
</ul>
-<h3 id="credits-157">Credits</h3>
+<h3 id="credits-158">Credits</h3>
<ul>
<li>id_No2015429 of 3H Secruity Team (finder)</li>
</ul>
<h2 id="CVE-2023-35797">Apache Airflow Hive Provider Beeline RCE with Principal</h2>
<p>CVE-2023-35797 <a href="https://cve.org/CVERecord?id=CVE-2023-35797">[CVE]</a> <a href="./CVE-2023-35797.cve.json">[CVE json]</a> <a href="./CVE-2023-35797.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-07-03T09:08:49.038Z</em></p>
-<h3 id="affected-160">Affected</h3>
+<h3 id="affected-161">Affected</h3>
<ul>
<li>Apache Airflow Apache Hive Provider before 6.1.1</li>
</ul>
-<h3 id="description-160">Description</h3>
+<h3 id="description-161">Description</h3>
<p>Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider.<br><p>This issue affects Apache Airflow Apache Hive Provider: before 6.1.1.<br><br><span style="background-color: rgb(255, 255, 255);">Before version 6.1.1 it was </span><span style="background-color: rgb(255, 255, 255);">possible to bypass the security check to RCE via</span><br><span style="background-color: rgb(255, 255, 255);">principal parameter. For this to be <span style="backgro [...]
-<h3 id="references-160">References</h3>
+<h3 id="references-161">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/31983">https://github.com/apache/airflow/pull/31983</a></li>
<li><a href="https://lists.apache.org/thread/30y19ok07fw52x5hnkbhwqo3ho0wwc1y">https://lists.apache.org/thread/30y19ok07fw52x5hnkbhwqo3ho0wwc1y</a></li>
</ul>
-<h3 id="credits-158">Credits</h3>
+<h3 id="credits-159">Credits</h3>
<ul>
<li>id_No2015429 of 3H Secruity Team (reporter)</li>
</ul>
<h2 id="CVE-2023-35005">Information disclosure on configuration view</h2>
<p>CVE-2023-35005 <a href="https://cve.org/CVERecord?id=CVE-2023-35005">[CVE]</a> <a href="./CVE-2023-35005.cve.json">[CVE json]</a> <a href="./CVE-2023-35005.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-06-19T08:15:11.464Z</em></p>
-<h3 id="affected-161">Affected</h3>
+<h3 id="affected-162">Affected</h3>
<ul>
<li>Apache Airflow from 2.5.0 before 2.6.2</li>
</ul>
-<h3 id="description-161">Description</h3>
+<h3 id="description-162">Description</h3>
<div>In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations.</div><div>This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all uncensored values are actually sentitive.</div><br><div>This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are recommended to update to version 2.6.2 or later.<br></div>
-<h3 id="references-161">References</h3>
+<h3 id="references-162">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/31788">https://github.com/apache/airflow/pull/31788</a></li>
<li><a href="https://github.com/apache/airflow/pull/31820">https://github.com/apache/airflow/pull/31820</a></li>
<li><a href="https://lists.apache.org/thread/o4f2cxh0054m9tlxpb81c1yhylor5gjd">https://lists.apache.org/thread/o4f2cxh0054m9tlxpb81c1yhylor5gjd</a></li>
</ul>
-<h3 id="credits-159">Credits</h3>
+<h3 id="credits-160">Credits</h3>
<ul>
<li>Piotr Chomiak from Astro product security team (finder)</li>
</ul>
<h2 id="CVE-2023-34395">Remote code execution vulnerability</h2>
<p>CVE-2023-34395 <a href="https://cve.org/CVERecord?id=CVE-2023-34395">[CVE]</a> <a href="./CVE-2023-34395.cve.json">[CVE json]</a> <a href="./CVE-2023-34395.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-06-27T11:36:51.331Z</em></p>
-<h3 id="affected-162">Affected</h3>
+<h3 id="affected-163">Affected</h3>
<ul>
<li>Apache Airflow ODBC Provider before 4.0.0</li>
</ul>
-<h3 id="description-162">Description</h3>
+<h3 id="description-163">Description</h3>
<p>Improper Neutralization of Argument Delimiters in a Command (‘Argument Injection’) vulnerability in Apache Software Foundation Apache Airflow ODBC Provider.<br><span style="background-color: rgb(255, 255, 255);">In OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution.<br></span>Starting version 4.0.0 driver can be set only from [...]
-<h3 id="references-162">References</h3>
+<h3 id="references-163">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/31713">https://github.com/apache/airflow/pull/31713</a></li>
<li><a href="https://lists.apache.org/thread/l26yykftzbhc9tgcph8cso88bc2lqwwd">https://lists.apache.org/thread/l26yykftzbhc9tgcph8cso88bc2lqwwd</a></li>
</ul>
-<h3 id="credits-160">Credits</h3>
+<h3 id="credits-161">Credits</h3>
<ul>
<li>KmhlYXJ0 (finder)</li>
</ul>
<h2 id="CVE-2023-33234">KubernetesPodOperator RCE via connection configuration</h2>
<p>CVE-2023-33234 <a href="https://cve.org/CVERecord?id=CVE-2023-33234">[CVE]</a> <a href="./CVE-2023-33234.cve.json">[CVE json]</a> <a href="./CVE-2023-33234.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-05-30T10:56:52.167Z</em></p>
-<h3 id="affected-163">Affected</h3>
+<h3 id="affected-164">Affected</h3>
<ul>
<li>Apache Airflow CNCF Kubernetes Provider from 5.0.0 through 6.1.0</li>
</ul>
-<h3 id="description-163">Description</h3>
+<h3 id="description-164">Description</h3>
<p>Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection.<br><br>In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner. Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.<br><br></p>
-<h3 id="references-163">References</h3>
+<h3 id="references-164">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/n1vpgl6h2qsdm52o9m2tx1oo86tl4gnq">https://lists.apache.org/thread/n1vpgl6h2qsdm52o9m2tx1oo86tl4gnq</a></li>
</ul>
<h2 id="CVE-2023-29247">Stored XSS on Apache Airflow</h2>
<p>CVE-2023-29247 <a href="https://cve.org/CVERecord?id=CVE-2023-29247">[CVE]</a> <a href="./CVE-2023-29247.cve.json">[CVE json]</a> <a href="./CVE-2023-29247.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-05-08T09:01:33.604Z</em></p>
-<h3 id="affected-164">Affected</h3>
+<h3 id="affected-165">Affected</h3>
<ul>
<li>Apache Airflow before 2.6.0</li>
</ul>
-<h3 id="description-164">Description</h3>
+<h3 id="description-165">Description</h3>
<p>Task instance details page in the UI is vulnerable to a stored XSS.<p>This issue affects Apache Airflow: before 2.6.0.</p><br></p>
-<h3 id="references-164">References</h3>
+<h3 id="references-165">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/30447">https://github.com/apache/airflow/pull/30447</a></li>
<li><a href="https://github.com/apache/airflow/pull/30779">https://github.com/apache/airflow/pull/30779</a></li>
<li><a href="https://lists.apache.org/thread/kqf5lxmko133780clsp827xfsh4xd3fl">https://lists.apache.org/thread/kqf5lxmko133780clsp827xfsh4xd3fl</a></li>
</ul>
-<h3 id="credits-161">Credits</h3>
+<h3 id="credits-162">Credits</h3>
<ul>
<li>taidh from VNPT - VCI (finder)</li>
<li>kuteminh11 (finder)</li>
@@ -3283,72 +3303,72 @@
<h2 id="CVE-2023-28710">Apache Airflow Spark Provider Arbitrary File Read via JDBC</h2>
<p>CVE-2023-28710 <a href="https://cve.org/CVERecord?id=CVE-2023-28710">[CVE]</a> <a href="./CVE-2023-28710.cve.json">[CVE json]</a> <a href="./CVE-2023-28710.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-04-07T14:55:42.112Z</em></p>
-<h3 id="affected-165">Affected</h3>
+<h3 id="affected-166">Affected</h3>
<ul>
<li>Apache Airflow Spark Provider before 4.0.1</li>
</ul>
-<h3 id="description-165">Description</h3>
+<h3 id="description-166">Description</h3>
<p>Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Spark Provider.<p>This issue affects Apache Airflow Spark Provider: before 4.0.1.</p></p>
-<h3 id="references-165">References</h3>
+<h3 id="references-166">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/30223">https://github.com/apache/airflow/pull/30223</a></li>
<li><a href="https://lists.apache.org/thread/lb9w9114ow00h2nkn8bjm106v5x1p1d2">https://lists.apache.org/thread/lb9w9114ow00h2nkn8bjm106v5x1p1d2</a></li>
</ul>
-<h3 id="credits-162">Credits</h3>
+<h3 id="credits-163">Credits</h3>
<ul>
<li>Xie Jianming of Nsfocus (finder)</li>
</ul>
<h2 id="CVE-2023-28707">Airflow Apache Drill Provider Arbitrary File Read Vulnerability</h2>
<p>CVE-2023-28707 <a href="https://cve.org/CVERecord?id=CVE-2023-28707">[CVE]</a> <a href="./CVE-2023-28707.cve.json">[CVE json]</a> <a href="./CVE-2023-28707.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-04-07T14:53:21.428Z</em></p>
-<h3 id="affected-166">Affected</h3>
+<h3 id="affected-167">Affected</h3>
<ul>
<li>Apache Airflow Drill Provider before 2.3.2</li>
</ul>
-<h3 id="description-166">Description</h3>
+<h3 id="description-167">Description</h3>
<p>Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.<p>This issue affects Apache Airflow Drill Provider: before 2.3.2.</p></p>
-<h3 id="references-166">References</h3>
+<h3 id="references-167">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/30215">https://github.com/apache/airflow/pull/30215</a></li>
<li><a href="https://lists.apache.org/thread/dfoj7q1nd0vhhsl8fjg63z4j6mfmdxtk">https://lists.apache.org/thread/dfoj7q1nd0vhhsl8fjg63z4j6mfmdxtk</a></li>
</ul>
-<h3 id="credits-163">Credits</h3>
+<h3 id="credits-164">Credits</h3>
<ul>
<li>Kai Zhao of 3H Secruity Team (finder)</li>
</ul>
<h2 id="CVE-2023-28706">Apache Airflow Hive Provider Beeline Remote Command Execution</h2>
<p>CVE-2023-28706 <a href="https://cve.org/CVERecord?id=CVE-2023-28706">[CVE]</a> <a href="./CVE-2023-28706.cve.json">[CVE json]</a> <a href="./CVE-2023-28706.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-04-07T14:54:35.049Z</em></p>
-<h3 id="affected-167">Affected</h3>
+<h3 id="affected-168">Affected</h3>
<ul>
<li>Apache Airflow Hive Provider before 6.0.0</li>
</ul>
-<h3 id="description-167">Description</h3>
+<h3 id="description-168">Description</h3>
<p>Improper Control of Generation of Code (‘Code Injection’) vulnerability in Apache Software Foundation Apache Airflow Hive Provider.<p>This issue affects Apache Airflow Hive Provider: before 6.0.0.</p></p>
-<h3 id="references-167">References</h3>
+<h3 id="references-168">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/30212">https://github.com/apache/airflow/pull/30212</a></li>
<li><a href="https://lists.apache.org/thread/dl20xxd51xvlx0zzc0wzgxfjwgtbbxo3">https://lists.apache.org/thread/dl20xxd51xvlx0zzc0wzgxfjwgtbbxo3</a></li>
</ul>
-<h3 id="credits-164">Credits</h3>
+<h3 id="credits-165">Credits</h3>
<ul>
<li>sw0rd1ight of Caiji Sec Team and 4ra1n of Chaitin Tech (finder)</li>
</ul>
<h2 id="CVE-2023-27604">Airflow Sqoop Provider RCE Vulnerability</h2>
<p>CVE-2023-27604 <a href="https://cve.org/CVERecord?id=CVE-2023-27604">[CVE]</a> <a href="./CVE-2023-27604.cve.json">[CVE json]</a> <a href="./CVE-2023-27604.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-08-28T07:47:27.394Z</em></p>
-<h3 id="affected-168">Affected</h3>
+<h3 id="affected-169">Affected</h3>
<ul>
<li>Apache Airflow Sqoop Provider before 4.0.0</li>
</ul>
-<h3 id="description-168">Description</h3>
+<h3 id="description-169">Description</h3>
<p>Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the connections, which makes it possible to implement RCE attacks via ‘sqoop import –connect’, obtain airflow server permissions, etc. T<span style="background-color: rgb(255, 255, 255);">he attacker needs to be logged in and have authorization (permissions) to create/edit connections.<br></span><br> It is recommended to upgrade to a version that is n [...]
-<h3 id="references-168">References</h3>
+<h3 id="references-169">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33039">https://github.com/apache/airflow/pull/33039</a></li>
<li><a href="https://lists.apache.org/thread/lswlxf11do51ob7f6xyyg8qp3n7wdrgd">https://lists.apache.org/thread/lswlxf11do51ob7f6xyyg8qp3n7wdrgd</a></li>
</ul>
-<h3 id="credits-165">Credits</h3>
+<h3 id="credits-166">Credits</h3>
<ul>
<li>happyhacking-k (finder)</li>
<li>Xie Jianming of Caiji Sec Team (finder)</li>
@@ -3357,18 +3377,18 @@
<h2 id="CVE-2023-25956">Arbitrary file read via AWS provider</h2>
<p>CVE-2023-25956 <a href="https://cve.org/CVERecord?id=CVE-2023-25956">[CVE]</a> <a href="./CVE-2023-25956.cve.json">[CVE json]</a> <a href="./CVE-2023-25956.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-03-07T08:23:39.736Z</em></p>
-<h3 id="affected-169">Affected</h3>
+<h3 id="affected-170">Affected</h3>
<ul>
<li>Apache Airflow AWS Provider before 7.2.1</li>
</ul>
-<h3 id="description-169">Description</h3>
+<h3 id="description-170">Description</h3>
<p>Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider.<br><br><p>This issue affects Apache Airflow AWS Provider versions before 7.2.1.</p></p>
-<h3 id="references-169">References</h3>
+<h3 id="references-170">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29587">https://github.com/apache/airflow/pull/29587</a></li>
<li><a href="https://lists.apache.org/thread/07pl9y4gdpw2c6rzqm77dvkm2z2kb5gv">https://lists.apache.org/thread/07pl9y4gdpw2c6rzqm77dvkm2z2kb5gv</a></li>
</ul>
-<h3 id="credits-166">Credits</h3>
+<h3 id="credits-167">Credits</h3>
<ul>
<li>Son Tran from VNPT - VCI (finder)</li>
<li>kuteminh11 (finder)</li>
@@ -3376,144 +3396,144 @@
<h2 id="CVE-2023-25754">Privilege escalation using airflow logs</h2>
<p>CVE-2023-25754 <a href="https://cve.org/CVERecord?id=CVE-2023-25754">[CVE]</a> <a href="./CVE-2023-25754.cve.json">[CVE json]</a> <a href="./CVE-2023-25754.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-05-08T11:57:41.997Z</em></p>
-<h3 id="affected-170">Affected</h3>
+<h3 id="affected-171">Affected</h3>
<ul>
<li>Apache Airflow before 2.6.0</li>
</ul>
-<h3 id="description-170">Description</h3>
+<h3 id="description-171">Description</h3>
<p>Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.<p>This issue affects Apache Airflow: before 2.6.0.</p></p>
-<h3 id="references-170">References</h3>
+<h3 id="references-171">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29506">https://github.com/apache/airflow/pull/29506</a></li>
<li><a href="https://lists.apache.org/thread/3y83gr0qb8t49ppfk4fb2yk7md8ltq4v">https://lists.apache.org/thread/3y83gr0qb8t49ppfk4fb2yk7md8ltq4v</a></li>
</ul>
-<h3 id="credits-167">Credits</h3>
+<h3 id="credits-168">Credits</h3>
<ul>
<li><a href="mailto:ksw9722@naver.com">ksw9722@naver.com</a> (finder)</li>
</ul>
<h2 id="CVE-2023-25696">Apache Airflow Hive Provider Beeline RCE</h2>
<p>CVE-2023-25696 <a href="https://cve.org/CVERecord?id=CVE-2023-25696">[CVE]</a> <a href="./CVE-2023-25696.cve.json">[CVE json]</a> <a href="./CVE-2023-25696.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-02-24T11:48:19.499Z</em></p>
-<h3 id="affected-171">Affected</h3>
+<h3 id="affected-172">Affected</h3>
<ul>
<li>Apache Airflow Hive Provider before 5.1.3</li>
</ul>
-<h3 id="description-171">Description</h3>
+<h3 id="description-172">Description</h3>
<p>Improper Input Validation vulnerability in the Apache Airflow Hive Provider.<br><br><p>This issue affects Apache Airflow Hive Provider versions before 5.1.3.</p></p>
-<h3 id="references-171">References</h3>
+<h3 id="references-172">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29502">https://github.com/apache/airflow/pull/29502</a></li>
<li><a href="https://lists.apache.org/thread/99g0qm56wmgdxmbtdsvhj4rdnxhpzpml">https://lists.apache.org/thread/99g0qm56wmgdxmbtdsvhj4rdnxhpzpml</a></li>
</ul>
-<h3 id="credits-168">Credits</h3>
+<h3 id="credits-169">Credits</h3>
<ul>
<li>id_No2015429 of 3H Secruity Team (finder)</li>
</ul>
<h2 id="CVE-2023-25695">Information disclosure in Apache Airflow</h2>
<p>CVE-2023-25695 <a href="https://cve.org/CVERecord?id=CVE-2023-25695">[CVE]</a> <a href="./CVE-2023-25695.cve.json">[CVE json]</a> <a href="./CVE-2023-25695.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-03-15T09:37:07.873Z</em></p>
-<h3 id="affected-172">Affected</h3>
+<h3 id="affected-173">Affected</h3>
<ul>
<li>Apache Airflow before 2.5.2</li>
</ul>
-<h3 id="description-172">Description</h3>
+<h3 id="description-173">Description</h3>
<p>Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.<p>This issue affects Apache Airflow: before 2.5.2.</p></p>
-<h3 id="references-172">References</h3>
+<h3 id="references-173">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29501">https://github.com/apache/airflow/pull/29501</a></li>
<li><a href="https://lists.apache.org/thread/z8w6ckzs61ql365tv4d19k82o67r15p2">https://lists.apache.org/thread/z8w6ckzs61ql365tv4d19k82o67r15p2</a></li>
</ul>
-<h3 id="credits-169">Credits</h3>
+<h3 id="credits-170">Credits</h3>
<ul>
<li>kuteminh11 (finder)</li>
</ul>
<h2 id="CVE-2023-25693">Sqoop Apache Airflow Provider Remote Code Execution Vulnerability</h2>
<p>CVE-2023-25693 <a href="https://cve.org/CVERecord?id=CVE-2023-25693">[CVE]</a> <a href="./CVE-2023-25693.cve.json">[CVE json]</a> <a href="./CVE-2023-25693.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-02-24T11:48:09.839Z</em></p>
-<h3 id="affected-173">Affected</h3>
+<h3 id="affected-174">Affected</h3>
<ul>
<li>Apache Airflow Sqoop Provider before 3.1.1</li>
</ul>
-<h3 id="description-173">Description</h3>
+<h3 id="description-174">Description</h3>
<p>Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider.<br><br><p>This issue affects Apache Airflow Sqoop Provider versions before 3.1.1.</p></p>
-<h3 id="references-173">References</h3>
+<h3 id="references-174">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29500">https://github.com/apache/airflow/pull/29500</a></li>
<li><a href="https://lists.apache.org/thread/79qn8g5xbq036f8crb115obvr22l52q4">https://lists.apache.org/thread/79qn8g5xbq036f8crb115obvr22l52q4</a></li>
</ul>
-<h3 id="credits-170">Credits</h3>
+<h3 id="credits-171">Credits</h3>
<ul>
<li>L3yx of Syclover Security Team (finder)</li>
</ul>
<h2 id="CVE-2023-25692">Google Cloud Sql Provider Denial Of Service</h2>
<p>CVE-2023-25692 <a href="https://cve.org/CVERecord?id=CVE-2023-25692">[CVE]</a> <a href="./CVE-2023-25692.cve.json">[CVE json]</a> <a href="./CVE-2023-25692.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-02-24T11:47:58.411Z</em></p>
-<h3 id="affected-174">Affected</h3>
+<h3 id="affected-175">Affected</h3>
<ul>
<li>Apache Airflow Google Provider before 8.10.0</li>
</ul>
-<h3 id="description-174">Description</h3>
+<h3 id="description-175">Description</h3>
<p>Improper Input Validation vulnerability in the Apache Airflow Google Provider.<br><br><p>This issue affects Apache Airflow Google Provider versions before 8.10.0.</p></p>
-<h3 id="references-174">References</h3>
+<h3 id="references-175">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29499">https://github.com/apache/airflow/pull/29499</a></li>
<li><a href="https://lists.apache.org/thread/ks4l78l5rwdpmvfn7y7yhs179nyxtlsh">https://lists.apache.org/thread/ks4l78l5rwdpmvfn7y7yhs179nyxtlsh</a></li>
</ul>
-<h3 id="credits-171">Credits</h3>
+<h3 id="credits-172">Credits</h3>
<ul>
<li>Xie Jianming of Caiji Sec Team (finder)</li>
</ul>
<h2 id="CVE-2023-25691">Google Cloud Sql Provider Remote Command Execution</h2>
<p>CVE-2023-25691 <a href="https://cve.org/CVERecord?id=CVE-2023-25691">[CVE]</a> <a href="./CVE-2023-25691.cve.json">[CVE json]</a> <a href="./CVE-2023-25691.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-02-24T11:35:47.925Z</em></p>
-<h3 id="affected-175">Affected</h3>
+<h3 id="affected-176">Affected</h3>
<ul>
<li>Apache Airflow Google Provider before 8.10.0</li>
</ul>
-<h3 id="description-175">Description</h3>
+<h3 id="description-176">Description</h3>
<p>Improper Input Validation vulnerability in the Apache Airflow Google Provider.<br><br><p>This issue affects Apache Airflow Google Provider versions before 8.10.0.</p></p>
-<h3 id="references-175">References</h3>
+<h3 id="references-176">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29497">https://github.com/apache/airflow/pull/29497</a></li>
<li><a href="https://lists.apache.org/thread/zdr8ovfttbh7kj0lydgcw88tbt2nmkcy">https://lists.apache.org/thread/zdr8ovfttbh7kj0lydgcw88tbt2nmkcy</a></li>
</ul>
-<h3 id="credits-172">Credits</h3>
+<h3 id="credits-173">Credits</h3>
<ul>
<li>Xie Jianming of Caiji Sec Team (finder)</li>
</ul>
<h2 id="CVE-2023-22888">Scheduler remote DoS</h2>
<p>CVE-2023-22888 <a href="https://cve.org/CVERecord?id=CVE-2023-22888">[CVE]</a> <a href="./CVE-2023-22888.cve.json">[CVE json]</a> <a href="./CVE-2023-22888.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-07-12T09:17:51.316Z</em></p>
-<h3 id="affected-176">Affected</h3>
+<h3 id="affected-177">Affected</h3>
<ul>
<li>Apache Airflow before 2.6.3</li>
</ul>
-<h3 id="description-176">Description</h3>
+<h3 id="description-177">Description</h3>
<p>Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to cause a service disruption by manipulating the run_id parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected</p>
-<h3 id="references-176">References</h3>
+<h3 id="references-177">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/32293">https://github.com/apache/airflow/pull/32293</a></li>
<li><a href="https://lists.apache.org/thread/dnlht2hvm7k81k5tgjtsfmk27c76kq7z">https://lists.apache.org/thread/dnlht2hvm7k81k5tgjtsfmk27c76kq7z</a></li>
</ul>
-<h3 id="credits-173">Credits</h3>
+<h3 id="credits-174">Credits</h3>
<ul>
<li>Zhipeng Zhang (@timon8) (finder)</li>
</ul>
<h2 id="CVE-2023-22887">Apache Airflow path traversal by authenticated user</h2>
<p>CVE-2023-22887 <a href="https://cve.org/CVERecord?id=CVE-2023-22887">[CVE]</a> <a href="./CVE-2023-22887.cve.json">[CVE json]</a> <a href="./CVE-2023-22887.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-07-13T10:31:08.518Z</em></p>
-<h3 id="affected-177">Affected</h3>
+<h3 id="affected-178">Affected</h3>
<ul>
<li>Apache Airflow before 2.6.3</li>
</ul>
-<h3 id="description-177">Description</h3>
+<h3 id="description-178">Description</h3>
<p>Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended directory structure by manipulating the run_id parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected</p>
-<h3 id="references-177">References</h3>
+<h3 id="references-178">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/32293">https://github.com/apache/airflow/pull/32293</a></li>
<li><a href="https://lists.apache.org/thread/rxddqs76r6rkxsg1n24d029zys67qwwo">https://lists.apache.org/thread/rxddqs76r6rkxsg1n24d029zys67qwwo</a></li>
</ul>
-<h3 id="credits-174">Credits</h3>
+<h3 id="credits-175">Credits</h3>
<ul>
<li>Zhipeng Zhang (@Timon8) (finder)</li>
<li>KietNA from National Cyber Security (NCS) (finder)</li>
@@ -3521,17 +3541,17 @@
<h2 id="CVE-2023-22886">RCE Vulnerability</h2>
<p>CVE-2023-22886 <a href="https://cve.org/CVERecord?id=CVE-2023-22886">[CVE]</a> <a href="./CVE-2023-22886.cve.json">[CVE json]</a> <a href="./CVE-2023-22886.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-06-29T09:40:58.058Z</em></p>
-<h3 id="affected-178">Affected</h3>
+<h3 id="affected-179">Affected</h3>
<ul>
<li>Apache Airflow JDBC Provider before 4.0.0</li>
</ul>
-<h3 id="description-178">Description</h3>
+<h3 id="description-179">Description</h3>
<p>Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider.<br><span style="background-color: rgb(255, 255, 255);">Airflow JDBC Provider Connection’s [Connection URL] parameters had no</span><br><span style="background-color: rgb(255, 255, 255);">restrictions, which made it possible to implement RCE attacks via</span><br><span style="background-color: rgb(255, 255, 255);">different type JDBC drivers, obtain airflow server permission.</span><br>< [...]
-<h3 id="references-178">References</h3>
+<h3 id="references-179">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/ynbjwp4n0vzql0xzhog1gkp1ovncf8j3">https://lists.apache.org/thread/ynbjwp4n0vzql0xzhog1gkp1ovncf8j3</a></li>
</ul>
-<h3 id="credits-175">Credits</h3>
+<h3 id="credits-176">Credits</h3>
<ul>
<li>heart Y (finder)</li>
<li>happyhacking (finder)</li>
@@ -3539,32 +3559,32 @@
<h2 id="CVE-2023-22884">Arbitrary file read via MySQL provider in Apache Airflow</h2>
<p>CVE-2023-22884 <a href="https://cve.org/CVERecord?id=CVE-2023-22884">[CVE]</a> <a href="./CVE-2023-22884.cve.json">[CVE json]</a> <a href="./CVE-2023-22884.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-01-21T13:02:09.736Z</em></p>
-<h3 id="affected-179">Affected</h3>
+<h3 id="affected-180">Affected</h3>
<ul>
<li>Apache Airflow before 2.5.1</li>
<li>Apache Airflow MySQL Provider before 4.0.0</li>
</ul>
-<h3 id="description-179">Description</h3>
+<h3 id="description-180">Description</h3>
<p>Improper Neutralization of Special Elements used in a Command (‘Command Injection’) vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.<p>This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL Provider: before 4.0.0.</p></p>
-<h3 id="references-179">References</h3>
+<h3 id="references-180">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/28811">https://github.com/apache/airflow/pull/28811</a></li>
<li><a href="https://lists.apache.org/thread/0l0j3nt0t7fzrcjl2ch0jgj6c58kxs5h">https://lists.apache.org/thread/0l0j3nt0t7fzrcjl2ch0jgj6c58kxs5h</a></li>
</ul>
-<h3 id="credits-176">Credits</h3>
+<h3 id="credits-177">Credits</h3>
<ul>
<li>Son Tran from VNPT - VCI (reporter)</li>
</ul>
<h2 id="CVE-2022-46651">Security vulnerability on AirFlow Connections</h2>
<p>CVE-2022-46651 <a href="https://cve.org/CVERecord?id=CVE-2022-46651">[CVE]</a> <a href="./CVE-2022-46651.cve.json">[CVE json]</a> <a href="./CVE-2022-46651.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-07-12T09:16:59.771Z</em></p>
-<h3 id="affected-180">Affected</h3>
+<h3 id="affected-181">Affected</h3>
<ul>
<li>Apache Airflow before 2.6.3</li>
</ul>
-<h3 id="description-180">Description</h3>
+<h3 id="description-181">Description</h3>
<p>Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability.<br></p>
-<h3 id="references-180">References</h3>
+<h3 id="references-181">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/32309">https://github.com/apache/airflow/pull/32309</a></li>
<li><a href="https://lists.apache.org/thread/n45h3y82og125rnlgt6rbm9szfb6q24d">https://lists.apache.org/thread/n45h3y82og125rnlgt6rbm9szfb6q24d</a></li>
@@ -3572,271 +3592,271 @@
<h2 id="CVE-2022-46421">Hive Provider RCE vulnerability with hive_cli_params</h2>
<p>CVE-2022-46421 <a href="https://cve.org/CVERecord?id=CVE-2022-46421">[CVE]</a> <a href="./CVE-2022-46421.cve.json">[CVE json]</a> <a href="./CVE-2022-46421.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-12-20T10:18:24.768Z</em></p>
-<h3 id="affected-181">Affected</h3>
+<h3 id="affected-182">Affected</h3>
<ul>
<li>Apache Airflow Hive Provider before 5.0.0</li>
</ul>
-<h3 id="description-181">Description</h3>
+<h3 id="description-182">Description</h3>
<p>Improper Neutralization of Special Elements used in a Command (‘Command Injection’) vulnerability in Apache Software Foundation Apache Airflow Hive Provider.<p>This issue affects Apache Airflow Hive Provider: before 5.0.0.</p></p>
-<h3 id="references-181">References</h3>
+<h3 id="references-182">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/28101">https://github.com/apache/airflow/pull/28101</a></li>
<li><a href="https://lists.apache.org/thread/09twdoyoybldlfj5gvk0qswtofh0rmp4">https://lists.apache.org/thread/09twdoyoybldlfj5gvk0qswtofh0rmp4</a></li>
</ul>
-<h3 id="credits-177">Credits</h3>
+<h3 id="credits-178">Credits</h3>
<ul>
<li>id_No2015429 of 3H Security Team (finder)</li>
</ul>
<h2 id="CVE-2022-45402">Apache Airflow: Open redirect during login</h2>
<p>CVE-2022-45402 <a href="https://cve.org/CVERecord?id=CVE-2022-45402">[CVE]</a> <a href="./CVE-2022-45402.cve.json">[CVE json]</a> <a href="./CVE-2022-45402.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-15T08:49:17.848Z</em></p>
-<h3 id="affected-182">Affected</h3>
+<h3 id="affected-183">Affected</h3>
<ul>
<li>Apache Airflow from unspecified before 2.4.3</li>
</ul>
-<h3 id="description-182">Description</h3>
+<h3 id="description-183">Description</h3>
<p>In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver’s <code>/login</code> endpoint.</p>
-<h3 id="references-182">References</h3>
+<h3 id="references-183">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/27576">https://github.com/apache/airflow/pull/27576</a></li>
<li><a href="https://lists.apache.org/thread/nf4xrkoo6c81g6fdn4vj8k9x2686o9nh">https://lists.apache.org/thread/nf4xrkoo6c81g6fdn4vj8k9x2686o9nh</a></li>
</ul>
-<h3 id="credits-178">Credits</h3>
+<h3 id="credits-179">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank Bugra Eskici for reporting this issue.</li>
</ul>
<h2 id="CVE-2022-43985">Apache Airflow prior to 2.4.2 has an open redirect</h2>
<p>CVE-2022-43985 <a href="https://cve.org/CVERecord?id=CVE-2022-43985">[CVE]</a> <a href="./CVE-2022-43985.cve.json">[CVE json]</a> <a href="./CVE-2022-43985.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-02T08:40:14.097Z</em></p>
-<h3 id="affected-183">Affected</h3>
+<h3 id="affected-184">Affected</h3>
<ul>
<li>Apache Airflow from unspecified before 2.4.2</li>
</ul>
-<h3 id="description-183">Description</h3>
+<h3 id="description-184">Description</h3>
<p>In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver’s <code>/confirm</code> endpoint.</p>
-<h3 id="references-183">References</h3>
+<h3 id="references-184">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/27143">https://github.com/apache/airflow/pull/27143</a></li>
<li><a href="https://lists.apache.org/thread/m13y9s5kw92fw9l8j4qd85h0txp4kfcq">https://lists.apache.org/thread/m13y9s5kw92fw9l8j4qd85h0txp4kfcq</a></li>
</ul>
-<h3 id="credits-179">Credits</h3>
+<h3 id="credits-180">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank Axel Chong (@Haxatron) [https://hackerone.com/haxatron1] for reporting this issue.</li>
</ul>
<h2 id="CVE-2022-43982">Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL</h2>
<p>CVE-2022-43982 <a href="https://cve.org/CVERecord?id=CVE-2022-43982">[CVE]</a> <a href="./CVE-2022-43982.cve.json">[CVE json]</a> <a href="./CVE-2022-43982.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-02T08:37:19.773Z</em></p>
-<h3 id="affected-184">Affected</h3>
+<h3 id="affected-185">Affected</h3>
<ul>
<li>Apache Airflow from unspecified before 2.4.2</li>
</ul>
-<h3 id="description-184">Description</h3>
+<h3 id="description-185">Description</h3>
<p>In Apache Airflow versions prior to 2.4.2, the “Trigger DAG with config” screen was susceptible to XSS attacks via the <code>origin</code> query argument.</p>
-<h3 id="references-184">References</h3>
+<h3 id="references-185">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/27143">https://github.com/apache/airflow/pull/27143</a></li>
<li><a href="https://lists.apache.org/thread/vqnvdrfsw9z7v7c46qh3psjgr7wy959l">https://lists.apache.org/thread/vqnvdrfsw9z7v7c46qh3psjgr7wy959l</a></li>
</ul>
-<h3 id="credits-180">Credits</h3>
+<h3 id="credits-181">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank id_No2015429 of 3H Security Team for reporting this issue.</li>
</ul>
<h2 id="CVE-2022-41672">Session still functional after user is deactivated</h2>
<p>CVE-2022-41672 <a href="https://cve.org/CVERecord?id=CVE-2022-41672">[CVE]</a> <a href="./CVE-2022-41672.cve.json">[CVE json]</a> <a href="./CVE-2022-41672.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-10-07T06:56:43.156Z</em></p>
-<h3 id="affected-185">Affected</h3>
+<h3 id="affected-186">Affected</h3>
<ul>
<li>Apache Airflow from unspecified through 2.4.0</li>
</ul>
-<h3 id="description-185">Description</h3>
+<h3 id="description-186">Description</h3>
<p>In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn’t prevent an already authenticated user from being able to continue using the UI or API.</p>
-<h3 id="references-185">References</h3>
+<h3 id="references-186">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/26635">https://github.com/apache/airflow/pull/26635</a></li>
<li><a href="https://lists.apache.org/thread/ohf3pvd3dftb8zb01yngbn1jtkq5m08y">https://lists.apache.org/thread/ohf3pvd3dftb8zb01yngbn1jtkq5m08y</a></li>
</ul>
-<h3 id="credits-181">Credits</h3>
+<h3 id="credits-182">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank Axel Chong (@Haxatron) for reporting this issue.</li>
</ul>
<h2 id="CVE-2022-41131">Apache Airflow Hive Provider vulnerability (command injection via hive_cli connection)</h2>
<p>CVE-2022-41131 <a href="https://cve.org/CVERecord?id=CVE-2022-41131">[CVE]</a> <a href="./CVE-2022-41131.cve.json">[CVE json]</a> <a href="./CVE-2022-41131.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-22T09:38:16.454Z</em></p>
-<h3 id="affected-186">Affected</h3>
+<h3 id="affected-187">Affected</h3>
<ul>
<li>Apache Airflow Hive Provider from unspecified before 4.1.0</li>
<li>Apache Airflow at 2.3.0</li>
</ul>
-<h3 id="description-186">Description</h3>
+<h3 id="description-187">Description</h3>
<p>Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG files. This issue affects Hive Provider versions prior to 4.1.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case HIve Provider is installed (Hive Provider 4.1.0 can only be installed for Airflow 2.3 [...]
-<h3 id="references-186">References</h3>
+<h3 id="references-187">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/27647">https://github.com/apache/airflow/pull/27647</a></li>
<li><a href="https://lists.apache.org/thread/wwo3qp0z8gv54yzn7hr04wy4n8gb0vhl">https://lists.apache.org/thread/wwo3qp0z8gv54yzn7hr04wy4n8gb0vhl</a></li>
</ul>
-<h3 id="credits-182">Credits</h3>
+<h3 id="credits-183">Credits</h3>
<ul>
<li>Apache Airflow PMC wants to thank id_No2015429 of 3H Security Team for reporting the issue.</li>
</ul>
<h2 id="CVE-2022-40954">Apache Airflow Spark Provider RCE that bypass restrictions to read arbitrary files</h2>
<p>CVE-2022-40954 <a href="https://cve.org/CVERecord?id=CVE-2022-40954">[CVE]</a> <a href="./CVE-2022-40954.cve.json">[CVE json]</a> <a href="./CVE-2022-40954.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-22T09:40:32.614Z</em></p>
-<h3 id="affected-187">Affected</h3>
+<h3 id="affected-188">Affected</h3>
<ul>
<li>Apache Airflow Spark Provider from unspecified before 4.0.0</li>
<li>Apache Airflow from unspecified before 2.3.0</li>
</ul>
-<h3 id="description-187">Description</h3>
+<h3 id="description-188">Description</h3>
<p>Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Spark Provider is installed (Spark Provider 4.0.0 can only be installed for Airflow 2.3.0 [...]
-<h3 id="references-187">References</h3>
+<h3 id="references-188">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/27646">https://github.com/apache/airflow/pull/27646</a></li>
<li><a href="https://lists.apache.org/thread/0tmdlnmjs5t4gsx5fy73tb6zd3jztq45">https://lists.apache.org/thread/0tmdlnmjs5t4gsx5fy73tb6zd3jztq45</a></li>
</ul>
-<h3 id="credits-183">Credits</h3>
+<h3 id="credits-184">Credits</h3>
<ul>
<li>Apache Airflow PMC wants to thank id_No2015429 of 3H Security Team for reporting the issue.</li>
</ul>
<h2 id="CVE-2022-40754">Open Redirect</h2>
<p>CVE-2022-40754 <a href="https://cve.org/CVERecord?id=CVE-2022-40754">[CVE]</a> <a href="./CVE-2022-40754.cve.json">[CVE json]</a> <a href="./CVE-2022-40754.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-09-21T07:22:31.671Z</em></p>
-<h3 id="affected-188">Affected</h3>
+<h3 id="affected-189">Affected</h3>
<ul>
<li>Apache Airflow from unspecified before 2.4.0</li>
</ul>
-<h3 id="description-188">Description</h3>
+<h3 id="description-189">Description</h3>
<p>In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver’s <code>/confirm</code> endpoint.</p>
-<h3 id="references-188">References</h3>
+<h3 id="references-189">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/26409">https://github.com/apache/airflow/pull/26409</a></li>
<li><a href="https://lists.apache.org/thread/cn098dcp5x3c402xrb06p3l7nz5goffm">https://lists.apache.org/thread/cn098dcp5x3c402xrb06p3l7nz5goffm</a></li>
</ul>
-<h3 id="credits-184">Credits</h3>
+<h3 id="credits-185">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank Konstantin Weddige (Lutra Security) for reporting this issue.</li>
</ul>
<h2 id="CVE-2022-40604">Format String Vulnerability</h2>
<p>CVE-2022-40604 <a href="https://cve.org/CVERecord?id=CVE-2022-40604">[CVE]</a> <a href="./CVE-2022-40604.cve.json">[CVE json]</a> <a href="./CVE-2022-40604.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-09-21T07:22:50.780Z</em></p>
-<h3 id="affected-189">Affected</h3>
+<h3 id="affected-190">Affected</h3>
<ul>
<li>Apache Airflow from unspecified before 2.4.0</li>
</ul>
-<h3 id="description-189">Description</h3>
+<h3 id="description-190">Description</h3>
<p>In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction.</p>
-<h3 id="references-189">References</h3>
+<h3 id="references-190">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/26337">https://github.com/apache/airflow/pull/26337</a></li>
<li><a href="https://lists.apache.org/thread/z20x8m16fnhxdkoollv53w1ybsts687t">https://lists.apache.org/thread/z20x8m16fnhxdkoollv53w1ybsts687t</a></li>
</ul>
-<h3 id="credits-185">Credits</h3>
+<h3 id="credits-186">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank L3yx of Syclover Security Team for reporting this issue.</li>
</ul>
<h2 id="CVE-2022-40189">Apache Airlfow Pig Provider RCE</h2>
<p>CVE-2022-40189 <a href="https://cve.org/CVERecord?id=CVE-2022-40189">[CVE]</a> <a href="./CVE-2022-40189.cve.json">[CVE json]</a> <a href="./CVE-2022-40189.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-22T09:39:35.331Z</em></p>
-<h3 id="affected-190">Affected</h3>
+<h3 id="affected-191">Affected</h3>
<ul>
<li>Apache Airlfow Pig Provider from unspecified before 4.0.0</li>
<li>Apache Airflow from unspecified before 2.3.0</li>
</ul>
-<h3 id="description-190">Description</h3>
+<h3 id="description-191">Description</h3>
<p>Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Pig Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Pig Provider is installed (Pig Provider 4.0.0 can only be installed for Airflow 2.3.0+) [...]
-<h3 id="references-190">References</h3>
+<h3 id="references-191">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/27644">https://github.com/apache/airflow/pull/27644</a></li>
<li><a href="https://lists.apache.org/thread/yxnfzfw2w9pj5s785k3rlyly4y44sd15">https://lists.apache.org/thread/yxnfzfw2w9pj5s785k3rlyly4y44sd15</a></li>
</ul>
-<h3 id="credits-186">Credits</h3>
+<h3 id="credits-187">Credits</h3>
<ul>
<li>Apache Airflow PMC wants to thank id_No2015429 of 3H Security Team for reporting the issue.</li>
</ul>
<h2 id="CVE-2022-40127">Apache Airflow <2.4.0 has an RCE in a bash example</h2>
<p>CVE-2022-40127 <a href="https://cve.org/CVERecord?id=CVE-2022-40127">[CVE]</a> <a href="./CVE-2022-40127.cve.json">[CVE json]</a> <a href="./CVE-2022-40127.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-14T09:30:08.330Z</em></p>
-<h3 id="affected-191">Affected</h3>
+<h3 id="affected-192">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow before 2.4.0</li>
</ul>
-<h3 id="description-191">Description</h3>
+<h3 id="description-192">Description</h3>
<p>A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.</p>
-<h3 id="references-191">References</h3>
+<h3 id="references-192">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/25960">https://github.com/apache/airflow/pull/25960</a></li>
<li><a href="https://lists.apache.org/thread/cf132hgm6jvzvsbpsozl3plf1r4cwysy">https://lists.apache.org/thread/cf132hgm6jvzvsbpsozl3plf1r4cwysy</a></li>
</ul>
-<h3 id="credits-187">Credits</h3>
+<h3 id="credits-188">Credits</h3>
<ul>
<li>Apache Airflow PMC would like to thank L3yx of Syclover Security Team.</li>
</ul>
<h2 id="CVE-2022-38649">Apache Airflow Pinot provider allowed Command Injection</h2>
<p>CVE-2022-38649 <a href="https://cve.org/CVERecord?id=CVE-2022-38649">[CVE]</a> <a href="./CVE-2022-38649.cve.json">[CVE json]</a> <a href="./CVE-2022-38649.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-22T09:35:10.175Z</em></p>
-<h3 id="affected-192">Affected</h3>
+<h3 id="affected-193">Affected</h3>
<ul>
<li>Apache Airflow Pinot Provider from unspecified before 4.0.0</li>
<li>Apache Airflow from unspecified before 2.3.0</li>
</ul>
-<h3 id="description-192">Description</h3>
+<h3 id="description-193">Description</h3>
<p>Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Apache Airflow Pinot Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Apache Airflow Pinot Provider is installed (Apache Airflow Pinot Pro [...]
-<h3 id="references-192">References</h3>
+<h3 id="references-193">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/27641">https://github.com/apache/airflow/pull/27641</a></li>
<li><a href="https://lists.apache.org/thread/033o1gbc4ly6dpd2xf1o201v56fbl4dz">https://lists.apache.org/thread/033o1gbc4ly6dpd2xf1o201v56fbl4dz</a></li>
</ul>
-<h3 id="credits-188">Credits</h3>
+<h3 id="credits-189">Credits</h3>
<ul>
<li>Apache Airflow PMC wants to thank id_No2015429 of 3H Security Team for reporting the issue.</li>
</ul>
<h2 id="CVE-2022-38362">Docker Provider <3.0 RCE vulnerability in example dag</h2>
<p>CVE-2022-38362 <a href="https://cve.org/CVERecord?id=CVE-2022-38362">[CVE]</a> <a href="./CVE-2022-38362.cve.json">[CVE json]</a> <a href="./CVE-2022-38362.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-08-16T14:05:03.199Z</em></p>
-<h3 id="affected-193">Affected</h3>
+<h3 id="affected-194">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow Docker Provider before 3.0.0</li>
</ul>
-<h3 id="description-193">Description</h3>
+<h3 id="description-194">Description</h3>
<p>Apache Airflow Docker’s Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host.</p>
-<h3 id="references-193">References</h3>
+<h3 id="references-194">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/614p38nf4gbk8xhvnskj9b1sqo2dknkb">https://lists.apache.org/thread/614p38nf4gbk8xhvnskj9b1sqo2dknkb</a></li>
</ul>
-<h3 id="credits-189">Credits</h3>
+<h3 id="credits-190">Credits</h3>
<ul>
<li>Thanks to Kai Zhao of 3H Secruity Team for reporting this</li>
</ul>
<h2 id="CVE-2022-38170">Overly permissive umask for daemons</h2>
<p>CVE-2022-38170 <a href="https://cve.org/CVERecord?id=CVE-2022-38170">[CVE]</a> <a href="./CVE-2022-38170.cve.json">[CVE json]</a> <a href="./CVE-2022-38170.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-09-02T07:07:24.352Z</em></p>
-<h3 id="affected-194">Affected</h3>
+<h3 id="affected-195">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow through 2.3.3</li>
</ul>
-<h3 id="description-194">Description</h3>
+<h3 id="description-195">Description</h3>
<p>In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the <code>--daemon</code> flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver.</p>
-<h3 id="references-194">References</h3>
+<h3 id="references-195">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/zn8mbbb1j2od5nc9zhrvb7rpsrg1vvzv">https://lists.apache.org/thread/zn8mbbb1j2od5nc9zhrvb7rpsrg1vvzv</a></li>
</ul>
-<h3 id="credits-190">Credits</h3>
+<h3 id="credits-191">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank Harry Sintonen for reporting this issue.</li>
</ul>
<h2 id="CVE-2022-38054">Session Fixation</h2>
<p>CVE-2022-38054 <a href="https://cve.org/CVERecord?id=CVE-2022-38054">[CVE]</a> <a href="./CVE-2022-38054.cve.json">[CVE json]</a> <a href="./CVE-2022-38054.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-09-13T08:39:38.357Z</em></p>
-<h3 id="affected-195">Affected</h3>
+<h3 id="affected-196">Affected</h3>
<ul>
<li>Apache Airflow from 2.2.4 before Apache Airflow*</li>
</ul>
-<h3 id="description-195">Description</h3>
+<h3 id="description-196">Description</h3>
<p>In Apache Airflow versions 2.2.4 through 2.3.3, the <code>database</code> webserver session backend was susceptible to session fixation.</p>
-<h3 id="references-195">References</h3>
+<h3 id="references-196">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/rsd3h89xdp16rg0ltovx3m7q3ypkxsbb">https://lists.apache.org/thread/rsd3h89xdp16rg0ltovx3m7q3ypkxsbb</a></li>
</ul>
-<h3 id="credits-191">Credits</h3>
+<h3 id="credits-192">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank Kai Zhao for reporting this issue.</li>
<li>Additoinally we would like to thank Ali Al-Habsi for independently discovering and reporting this issue.</li>
@@ -3844,233 +3864,233 @@
<h2 id="CVE-2022-27949">Apache Airflow prior to 2.3.1 may include sensitive values in rendered template</h2>
<p>CVE-2022-27949 <a href="https://cve.org/CVERecord?id=CVE-2022-27949">[CVE]</a> <a href="./CVE-2022-27949.cve.json">[CVE json]</a> <a href="./CVE-2022-27949.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-15T11:12:08.938Z</em></p>
-<h3 id="affected-196">Affected</h3>
+<h3 id="affected-197">Affected</h3>
<ul>
<li>Apache Airflow from unspecified before 2.3.1</li>
</ul>
-<h3 id="description-196">Description</h3>
+<h3 id="description-197">Description</h3>
<p>A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example when they were depending on past and previous instances of the task failed). This issue affects Apache Airflow prior to 2.3.1.</p>
-<h3 id="references-196">References</h3>
+<h3 id="references-197">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/22754">https://github.com/apache/airflow/pull/22754</a></li>
<li><a href="https://lists.apache.org/thread/n38oc5obb48600fsvnbopxcs0jpbp65p">https://lists.apache.org/thread/n38oc5obb48600fsvnbopxcs0jpbp65p</a></li>
</ul>
-<h3 id="credits-192">Credits</h3>
+<h3 id="credits-193">Credits</h3>
<ul>
<li>Apache Airflow PMC would like to thank James Srinivasan for reporting it.</li>
</ul>
<h2 id="CVE-2022-24288">Apache Airflow: RCE in example DAGs</h2>
<p>CVE-2022-24288 <a href="https://cve.org/CVERecord?id=CVE-2022-24288">[CVE]</a> <a href="./CVE-2022-24288.cve.json">[CVE json]</a> <a href="./CVE-2022-24288.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-02-25T08:21:43.680Z</em></p>
-<h3 id="affected-197">Affected</h3>
+<h3 id="affected-198">Affected</h3>
<ul>
<li>Apache Airflow from unspecified before 2.2.4</li>
</ul>
-<h3 id="description-197">Description</h3>
+<h3 id="description-198">Description</h3>
<p>In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.</p>
-<h3 id="references-197">References</h3>
+<h3 id="references-198">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/dbw5ozcmr0h0lhs0yjph7xdc64oht23t">https://lists.apache.org/thread/dbw5ozcmr0h0lhs0yjph7xdc64oht23t</a></li>
</ul>
-<h3 id="credits-193">Credits</h3>
+<h3 id="credits-194">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank Kai Zhao of the TToU Security Team for reporting this issue.</li>
</ul>
<h2 id="CVE-2021-45230">Apache Airflow: Creating DagRuns didn’t respect Dag-level permissions in the Webserver</h2>
<p>CVE-2021-45230 <a href="https://cve.org/CVERecord?id=CVE-2021-45230">[CVE]</a> <a href="./CVE-2021-45230.cve.json">[CVE json]</a> <a href="./CVE-2021-45230.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-01-20T09:06:03.334Z</em></p>
-<h3 id="affected-198">Affected</h3>
+<h3 id="affected-199">Affected</h3>
<ul>
<li>Apache Airflow at Apache Airflow 1.10 1.10.0 to 1.10.15</li>
<li>Apache Airflow from Apache Airflow 2 before 2.2.0</li>
</ul>
-<h3 id="description-198">Description</h3>
+<h3 id="description-199">Description</h3>
<p>In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has “can_create” permissions on DAG Runs can create Dag Runs for dags that they don’t have “edit” permissions for.</p>
-<h3 id="references-198">References</h3>
+<h3 id="references-199">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/m778ojn0k595rwco4ht9wjql89mjoxnl">https://lists.apache.org/thread/m778ojn0k595rwco4ht9wjql89mjoxnl</a></li>
</ul>
-<h3 id="credits-194">Credits</h3>
+<h3 id="credits-195">Credits</h3>
<ul>
<li>Apache Airflow PMC would like to thank Franco Cano Erazo for reporting this issue.</li>
</ul>
<h2 id="CVE-2021-45229">Apache Airflow: Reflected XSS via Origin Query Argument in URL</h2>
<p>CVE-2021-45229 <a href="https://cve.org/CVERecord?id=CVE-2021-45229">[CVE]</a> <a href="./CVE-2021-45229.cve.json">[CVE json]</a> <a href="./CVE-2021-45229.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-02-25T08:21:17.026Z</em></p>
-<h3 id="affected-199">Affected</h3>
+<h3 id="affected-200">Affected</h3>
<ul>
<li>Apache Airflow from unspecified before 2.2.4</li>
</ul>
-<h3 id="description-199">Description</h3>
+<h3 id="description-200">Description</h3>
<p>It was discovered that the “Trigger DAG with config” screen was susceptible to XSS attacks via the <code>origin</code> query argument.</p>
<p>This issue affects Apache Airflow versions 2.2.3 and below.</p>
-<h3 id="references-199">References</h3>
+<h3 id="references-200">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/phx76cgtmhwwdy780rvwhobx8qoy4bnk">https://lists.apache.org/thread/phx76cgtmhwwdy780rvwhobx8qoy4bnk</a></li>
</ul>
-<h3 id="credits-195">Credits</h3>
+<h3 id="credits-196">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank both Bogdan Kurinnoy of the Samsung R&D Institute Ukraine (SRK) and Ali Al-Habsi of Accellion for independently discovering and reporting this issue.</li>
</ul>
<h2 id="CVE-2021-38540">Apache Airflow: Variable Import endpoint missed authentication check</h2>
<p>CVE-2021-38540 <a href="https://cve.org/CVERecord?id=CVE-2021-38540">[CVE]</a> <a href="./CVE-2021-38540.cve.json">[CVE json]</a> <a href="./CVE-2021-38540.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2021-09-09T14:59:44.637Z</em></p>
-<h3 id="affected-200">Affected</h3>
+<h3 id="affected-201">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow before 2.1.3</li>
</ul>
-<h3 id="description-200">Description</h3>
+<h3 id="description-201">Description</h3>
<p>The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially
resulting in a denial of service, information disclosure or remote code execution.</p>
<p>This issue affects Apache Airflow >=2.0.0, <2.1.3.</p>
-<h3 id="references-200">References</h3>
+<h3 id="references-201">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/rb34c3dd1a815456355217eef34060789f771b6f77c3a3dec77de2064%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/rb34c3dd1a815456355217eef34060789f771b6f77c3a3dec77de2064%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
-<h3 id="credits-196">Credits</h3>
+<h3 id="credits-197">Credits</h3>
<ul>
<li>Apache Airflow would like to thank Nathan Jones, National Australia Bank’s Offensive Security Team</li>
</ul>
<h2 id="CVE-2021-35936">No Authentication on Logging Server</h2>
<p>CVE-2021-35936 <a href="https://cve.org/CVERecord?id=CVE-2021-35936">[CVE]</a> <a href="./CVE-2021-35936.cve.json">[CVE json]</a> <a href="./CVE-2021-35936.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2021-08-16T07:22:38.757Z</em></p>
-<h3 id="affected-201">Affected</h3>
+<h3 id="affected-202">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow before 2.1.2</li>
</ul>
-<h3 id="description-201">Description</h3>
+<h3 id="description-202">Description</h3>
<p>If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default.
This logging server had no authentication and allows reading log files of DAG jobs.</p>
<p>This issue affects Apache Airflow < 2.1.2.</p>
-<h3 id="references-201">References</h3>
+<h3 id="references-202">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/r53d6bd7b0a66f92ddaf1313282f10fec802e71246606dd30c16536df%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/r53d6bd7b0a66f92ddaf1313282f10fec802e71246606dd30c16536df%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
-<h3 id="credits-197">Credits</h3>
+<h3 id="credits-198">Credits</h3>
<ul>
<li>Apache Airflow would like to thank Dolev Farhi for reporting this issue.</li>
</ul>
<h2 id="CVE-2021-28359">Apache Airflow Reflected XSS via Origin Query Argument in URL</h2>
<p>CVE-2021-28359 <a href="https://cve.org/CVERecord?id=CVE-2021-28359">[CVE]</a> <a href="./CVE-2021-28359.cve.json">[CVE json]</a> <a href="./CVE-2021-28359.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2021-05-02T07:52:16.051Z</em></p>
-<h3 id="affected-202">Affected</h3>
+<h3 id="affected-203">Affected</h3>
<ul>
<li>Apache Airflow at 2.0.0</li>
<li>Apache Airflow at 2.0.1</li>
<li>Apache Airflow from Apache Airflow before 1.10.15</li>
</ul>
-<h3 id="description-202">Description</h3>
+<h3 id="description-203">Description</h3>
<p>The “origin” parameter passed to some of the endpoints like ‘/trigger’ was vulnerable to XSS exploit. This issue affects Apache Airflow versions <1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series.</p>
<p>This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fix the issue completely. Update to Airflow 1.10.15 or 2.0.2.</p>
<p>Please also update your Python version to the latest available PATCH releases of the installed MINOR versions, example update to Python 3.6.13 if you are on Python 3.6. (Those contain the fix for CVE-2021-23336 <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-23336)">https://nvd.nist.gov/vuln/detail/CVE-2021-23336)</a>.</p>
-<h3 id="references-202">References</h3>
+<h3 id="references-203">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
-<h3 id="credits-198">Credits</h3>
+<h3 id="credits-199">Credits</h3>
<ul>
<li>Vasileios Daskalakis</li>
</ul>
<h2 id="CVE-2021-26697">Apache Airflow: Lineage API endpoint for Experimental API missed authentication check</h2>
<p>CVE-2021-26697 <a href="https://cve.org/CVERecord?id=CVE-2021-26697">[CVE]</a> <a href="./CVE-2021-26697.cve.json">[CVE json]</a> <a href="./CVE-2021-26697.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2021-02-17T14:10:43.736Z</em></p>
-<h3 id="affected-203">Affected</h3>
+<h3 id="affected-204">Affected</h3>
<ul>
<li>Apache Airflow at 2.0.0</li>
</ul>
-<h3 id="description-203">Description</h3>
+<h3 id="description-204">Description</h3>
<p>The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint.</p>
<p>This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task.</p>
<p>This issue affects Apache Airflow 2.0.0.</p>
-<h3 id="references-203">References</h3>
+<h3 id="references-204">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/re21fec81baea7a6d73b0b5d31efd07cc02c61f832e297f65bb19b519%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/re21fec81baea7a6d73b0b5d31efd07cc02c61f832e297f65bb19b519%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
-<h3 id="credits-199">Credits</h3>
+<h3 id="credits-200">Credits</h3>
<ul>
<li>Apache Airflow would like to thank Ian Carroll for reporting this issue.</li>
</ul>
<h2 id="CVE-2021-26559">CWE-284 Improper Access Control on Configurations Endpoint for the Stable API</h2>
<p>CVE-2021-26559 <a href="https://cve.org/CVERecord?id=CVE-2021-26559">[CVE]</a> <a href="./CVE-2021-26559.cve.json">[CVE json]</a> <a href="./CVE-2021-26559.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2021-02-17T13:18:02.283Z</em></p>
-<h3 id="affected-204">Affected</h3>
+<h3 id="affected-205">Affected</h3>
<ul>
<li>Apache Airflow at 2.0.0</li>
</ul>
-<h3 id="description-204">Description</h3>
+<h3 id="description-205">Description</h3>
<p>Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when <code>[webserver] expose_config</code> is set to <code>False</code> in <code>airflow.cfg</code>.</p>
<p>This allowed a privilege escalation attack.</p>
<p>This issue affects Apache Airflow 2.0.0.</p>
-<h3 id="references-204">References</h3>
+<h3 id="references-205">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/r3b3787700279ec361308cbefb7c2cce2acb26891a12ce864e4a13c8d%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/r3b3787700279ec361308cbefb7c2cce2acb26891a12ce864e4a13c8d%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
-<h3 id="credits-200">Credits</h3>
+<h3 id="credits-201">Credits</h3>
<ul>
<li>Apache Airflow would like to thank Ian Carroll for reporting this issue.</li>
</ul>
<h2 id="CVE-2020-17526"></h2>
<p>CVE-2020-17526 <a href="https://cve.org/CVERecord?id=CVE-2020-17526">[CVE]</a> <a href="./CVE-2020-17526.cve.json">[CVE json]</a> <a href="./CVE-2020-17526.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2020-12-21T16:43:50.352Z</em></p>
-<h3 id="affected-205">Affected</h3>
+<h3 id="affected-206">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow before 1.10.14</li>
</ul>
-<h3 id="description-205">Description</h3>
+<h3 id="description-206">Description</h3>
<p>Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for <code>[webserver] secret_key</code> config.</p>
-<h3 id="references-205">References</h3>
+<h3 id="references-206">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/rbeeb73a6c741f2f9200d83b9c2220610da314810c4e8c9cf881d47ef%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/rbeeb73a6c741f2f9200d83b9c2220610da314810c4e8c9cf881d47ef%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
-<h3 id="credits-201">Credits</h3>
+<h3 id="credits-202">Credits</h3>
<ul>
<li>Junghan Lee of Deliveryhero Korea Security Team</li>
</ul>
<h2 id="CVE-2020-17515"></h2>
<p>CVE-2020-17515 <a href="https://cve.org/CVERecord?id=CVE-2020-17515">[CVE]</a> <a href="./CVE-2020-17515.cve.json">[CVE json]</a> <a href="./CVE-2020-17515.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2020-12-11T13:35:28.574Z</em></p>
-<h3 id="affected-206">Affected</h3>
+<h3 id="affected-207">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow before 1.10.13</li>
</ul>
-<h3 id="description-206">Description</h3>
+<h3 id="description-207">Description</h3>
<p>The “origin” parameter passed to some of the endpoints like ‘/trigger’ was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13.</p>
<p>This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.</p>
-<h3 id="references-206">References</h3>
+<h3 id="references-207">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/r4656959c8ed06c1f6202d89aa4e67b35ad7bdba5a666caff3fea888e%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/r4656959c8ed06c1f6202d89aa4e67b35ad7bdba5a666caff3fea888e%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
-<h3 id="credits-202">Credits</h3>
+<h3 id="credits-203">Credits</h3>
<ul>
<li>Ali Abdulwahab Ali Al-habsi of Accellion</li>
</ul>
<h2 id="CVE-2020-17513"></h2>
<p>CVE-2020-17513 <a href="https://cve.org/CVERecord?id=CVE-2020-17513">[CVE]</a> <a href="./CVE-2020-17513.cve.json">[CVE json]</a> <a href="./CVE-2020-17513.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2020-12-14T09:36:02.746Z</em></p>
-<h3 id="affected-207">Affected</h3>
+<h3 id="affected-208">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow before 1.10.13</li>
</ul>
-<h3 id="description-207">Description</h3>
+<h3 id="description-208">Description</h3>
<p>In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack.</p>
-<h3 id="references-207">References</h3>
+<h3 id="references-208">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/rb3647269f07cc2775ca6568cbfd4994d862c842a58120d2aba9c658a%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/rb3647269f07cc2775ca6568cbfd4994d862c842a58120d2aba9c658a%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
<h2 id="CVE-2020-17511"></h2>
<p>CVE-2020-17511 <a href="https://cve.org/CVERecord?id=CVE-2020-17511">[CVE]</a> <a href="./CVE-2020-17511.cve.json">[CVE json]</a> <a href="./CVE-2020-17511.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2020-12-14T09:35:45.373Z</em></p>
-<h3 id="affected-208">Affected</h3>
+<h3 id="affected-209">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow before 1.10.13</li>
</ul>
-<h3 id="description-208">Description</h3>
+<h3 id="description-209">Description</h3>
<p>In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. Same happened when creating a Connection with a password field.</p>
-<h3 id="references-208">References</h3>
+<h3 id="references-209">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/ree782a29d927b96bf0b39fb92e2f1f09ea3112a985f7a08ce93765ac%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/ree782a29d927b96bf0b39fb92e2f1f09ea3112a985f7a08ce93765ac%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
-<h3 id="credits-203">Credits</h3>
+<h3 id="credits-204">Credits</h3>
<ul>
<li>Ali Al-Habsi of Accellion</li>
</ul>
diff --git a/projects/allura/CVE-2026-92116.cve.json b/projects/allura/CVE-2026-92116.cve.json
new file mode 100644
index 00000000..579cb475
--- /dev/null
+++ b/projects/allura/CVE-2026-92116.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "product": "Apache Allura",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "1.21.0",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "reporter",
+ "value": "MopMonk AI"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "<p>OAuth1 callback validation vulnerability in Apache Allura.</p><p>This issue affects Apache Allura: through 1.21.0.</p><p>Users are recommended to upgrade to version 1.22.0, which fixes the issue.</p>"
+ }
+ ],
+ "value": "OAuth1 callback validation\u00a0vulnerability in Apache Allura.\n\n\n\nThis issue affects Apache Allura: through 1.21.0.\n\n\n\nUsers are recommended to upgrade to version 1.22.0, which fixes the issue."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "important"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-601",
+ "description": "CWE-601 URL redirection to untrusted site ('open redirect')",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread.html/d716zfvgpnrjlsc7bmysv4sxbnh2b57f"
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "title": "OAuth1 missing callback validation",
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-92116",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/allura/CVE-2026-92116.osv.json b/projects/allura/CVE-2026-92116.osv.json
new file mode 100644
index 00000000..2e66304c
--- /dev/null
+++ b/projects/allura/CVE-2026-92116.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-92116", "summary": "OAuth1 missing callback validation", "details": "OAuth1 callback validation vulnerability in Apache Allura.\n\n\n\nThis issue affects Apache Allura: through 1.21.0.\n\n\n\nUsers are recommended to upgrade to version 1.22.0, which fixes the issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "0"}, {"last_affected": "0"}]}]}], "references": [{"type": "WEB", "url": "https://lists.apache.org/thread.htm [...]
\ No newline at end of file
diff --git a/projects/allura/CVE-2026-92119.cve.json b/projects/allura/CVE-2026-92119.cve.json
new file mode 100644
index 00000000..bb3f9793
--- /dev/null
+++ b/projects/allura/CVE-2026-92119.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "product": "Apache Allura",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "1.21.0",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "reporter",
+ "value": "CyberLeo"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "<p>REST API Mass Assignment vulnerability in Apache Allura.</p><p>This issue affects Apache Allura: through 1.21.0.</p><p>Users are recommended to upgrade to version 1.22.0, which fixes the issue.</p>"
+ }
+ ],
+ "value": "REST API Mass Assignment\u00a0vulnerability in Apache Allura.\n\n\n\nThis issue affects Apache Allura: through 1.21.0.\n\n\n\nUsers are recommended to upgrade to version 1.22.0, which fixes the issue."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "moderate"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-915",
+ "description": "CWE-915 Improperly controlled modification of Dynamically-Determined object attributes",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread.html/oc6dd1zx94t5wdwwgg5nh3jppom4qmvc"
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "title": "REST API Mass Assignment",
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-92119",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/allura/CVE-2026-92119.osv.json b/projects/allura/CVE-2026-92119.osv.json
new file mode 100644
index 00000000..2e5f6e34
--- /dev/null
+++ b/projects/allura/CVE-2026-92119.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-92119", "summary": "REST API Mass Assignment", "details": "REST API Mass Assignment vulnerability in Apache Allura.\n\n\n\nThis issue affects Apache Allura: through 1.21.0.\n\n\n\nUsers are recommended to upgrade to version 1.22.0, which fixes the issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "0"}, {"last_affected": "0"}]}]}], "references": [{"type": "WEB", "url": "https://lists.apache.org/thread.html/oc6dd1zx94 [...]
\ No newline at end of file
diff --git a/projects/allura/CVE-2026-92120.cve.json b/projects/allura/CVE-2026-92120.cve.json
new file mode 100644
index 00000000..2f44113f
--- /dev/null
+++ b/projects/allura/CVE-2026-92120.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "product": "Apache Allura",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "1.21.0",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "reporter",
+ "value": "CyberLeo"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "<p><span>OAuth1 Request Replay Attack </span>vulnerability in Apache Allura.</p><p>This issue affects Apache Allura: through 1.21.0.</p><p>Users are recommended to upgrade to version 1.22.0 which fixes the issue.</p>"
+ }
+ ],
+ "value": "OAuth1 Request Replay Attack\u00a0vulnerability in Apache Allura.\n\n\n\nThis issue affects Apache Allura: through 1.21.0.\n\n\n\nUsers are recommended to upgrade to version 1.22.0 which fixes the issue."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "low"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-294",
+ "description": "CWE-294 Authentication bypass by capture-replay",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread.html/xpo1wbh1m18tvn9ow3h599wgcswbvn5x"
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "title": "Oauth1 Replay Attack",
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-92120",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/allura/CVE-2026-92120.osv.json b/projects/allura/CVE-2026-92120.osv.json
new file mode 100644
index 00000000..b4cea2b4
--- /dev/null
+++ b/projects/allura/CVE-2026-92120.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-92120", "summary": "Oauth1 Replay Attack", "details": "OAuth1 Request Replay Attack vulnerability in Apache Allura.\n\n\n\nThis issue affects Apache Allura: through 1.21.0.\n\n\n\nUsers are recommended to upgrade to version 1.22.0 which fixes the issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "0"}, {"last_affected": "0"}]}]}], "references": [{"type": "WEB", "url": "https://lists.apache.org/thread.html/xpo1wbh1m18 [...]
\ No newline at end of file
diff --git a/projects/allura/index.html b/projects/allura/index.html
index 51b11520..a2db4023 100644
--- a/projects/allura/index.html
+++ b/projects/allura/index.html
@@ -109,101 +109,152 @@
</ul>
<h1 id="advisories">Advisories</h1>
<p class="bg-warning">This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the project security page linked above. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public <a href="/mailinglist">mailinglist</a> or privately on <a href="mailto:security@apache.org">security@apache.org</a></p>
+<h2 id="CVE-2026-92120">Oauth1 Replay Attack</h2>
+<p>CVE-2026-92120 <a href="https://cve.org/CVERecord?id=CVE-2026-92120">[CVE]</a> <a href="./CVE-2026-92120.cve.json">[CVE json]</a> <a href="./CVE-2026-92120.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-10-12T20:08:03.303Z</em></p>
+<h3 id="affected">Affected</h3>
+<ul>
+<li>Apache Allura through 1.21.0</li>
+</ul>
+<h3 id="description">Description</h3>
+<p><span>OAuth1 Request Replay Attack </span>vulnerability in Apache Allura.</p><p>This issue affects Apache Allura: through 1.21.0.</p><p>Users are recommended to upgrade to version 1.22.0 which fixes the issue.</p>
+<h3 id="references">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread.html/xpo1wbh1m18tvn9ow3h599wgcswbvn5x">https://lists.apache.org/thread.html/xpo1wbh1m18tvn9ow3h599wgcswbvn5x</a></li>
+</ul>
+<h3 id="credits">Credits</h3>
+<ul>
+<li>CyberLeo (reporter)</li>
+</ul>
+<h2 id="CVE-2026-92119">REST API Mass Assignment</h2>
+<p>CVE-2026-92119 <a href="https://cve.org/CVERecord?id=CVE-2026-92119">[CVE]</a> <a href="./CVE-2026-92119.cve.json">[CVE json]</a> <a href="./CVE-2026-92119.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-10-12T20:06:41.002Z</em></p>
+<h3 id="affected-1">Affected</h3>
+<ul>
+<li>Apache Allura through 1.21.0</li>
+</ul>
+<h3 id="description-1">Description</h3>
+<p>REST API Mass Assignment vulnerability in Apache Allura.</p><p>This issue affects Apache Allura: through 1.21.0.</p><p>Users are recommended to upgrade to version 1.22.0, which fixes the issue.</p>
+<h3 id="references-1">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread.html/oc6dd1zx94t5wdwwgg5nh3jppom4qmvc">https://lists.apache.org/thread.html/oc6dd1zx94t5wdwwgg5nh3jppom4qmvc</a></li>
+</ul>
+<h3 id="credits-1">Credits</h3>
+<ul>
+<li>CyberLeo (reporter)</li>
+</ul>
+<h2 id="CVE-2026-92116">OAuth1 missing callback validation</h2>
+<p>CVE-2026-92116 <a href="https://cve.org/CVERecord?id=CVE-2026-92116">[CVE]</a> <a href="./CVE-2026-92116.cve.json">[CVE json]</a> <a href="./CVE-2026-92116.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-10-12T20:04:17.252Z</em></p>
+<h3 id="affected-2">Affected</h3>
+<ul>
+<li>Apache Allura through 1.21.0</li>
+</ul>
+<h3 id="description-2">Description</h3>
+<p>OAuth1 callback validation vulnerability in Apache Allura.</p><p>This issue affects Apache Allura: through 1.21.0.</p><p>Users are recommended to upgrade to version 1.22.0, which fixes the issue.</p>
+<h3 id="references-2">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread.html/d716zfvgpnrjlsc7bmysv4sxbnh2b57f">https://lists.apache.org/thread.html/d716zfvgpnrjlsc7bmysv4sxbnh2b57f</a></li>
+</ul>
+<h3 id="credits-2">Credits</h3>
+<ul>
+<li>MopMonk AI (reporter)</li>
+</ul>
<h2 id="CVE-2026-81270">Information exposure via search</h2>
<p>CVE-2026-81270 <a href="https://cve.org/CVERecord?id=CVE-2026-81270">[CVE]</a> <a href="./CVE-2026-81270.cve.json">[CVE json]</a> <a href="./CVE-2026-81270.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-04T06:59:43.722Z</em></p>
-<h3 id="affected">Affected</h3>
+<h3 id="affected-3">Affected</h3>
<ul>
<li>Apache Allura through 1.20.0</li>
</ul>
-<h3 id="description">Description</h3>
+<h3 id="description-3">Description</h3>
<p>Apache Allura: exposure of non-public information via search.</p><p>This issue affects Apache Allura: through 1.20.0.</p><p>Users are recommended to upgrade to version 1.21.0, which fixes the issue.</p>
-<h3 id="references">References</h3>
+<h3 id="references-3">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/xvg5m12k3nngcomfrgvkvdy54srjmtyg">https://lists.apache.org/thread/xvg5m12k3nngcomfrgvkvdy54srjmtyg</a></li>
</ul>
-<h3 id="credits">Credits</h3>
+<h3 id="credits-3">Credits</h3>
<ul>
<li>n0mi1k (reporter)</li>
</ul>
<h2 id="CVE-2026-80190">Stored XSS via code repositories</h2>
<p>CVE-2026-80190 <a href="https://cve.org/CVERecord?id=CVE-2026-80190">[CVE]</a> <a href="./CVE-2026-80190.cve.json">[CVE json]</a> <a href="./CVE-2026-80190.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-04T07:04:52.220Z</em></p>
-<h3 id="affected-1">Affected</h3>
+<h3 id="affected-4">Affected</h3>
<ul>
<li>Apache Allura through 1.20.0</li>
</ul>
-<h3 id="description-1">Description</h3>
+<h3 id="description-4">Description</h3>
<p>Apache Allura: stored XSS via SVN code repositories. Git repositories are not known to be affected. The vulnerability is likely mitigated via default CSP headers.</p><p>This issue affects Apache Allura: through 1.20.0.</p><p>Users are recommended to upgrade to version 1.21.0, which fixes the issue.</p>
-<h3 id="references-1">References</h3>
+<h3 id="references-4">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/fsj2dgdzskky4wkckhh3fth0ogj5trq2">https://lists.apache.org/thread/fsj2dgdzskky4wkckhh3fth0ogj5trq2</a></li>
</ul>
-<h3 id="credits-1">Credits</h3>
+<h3 id="credits-4">Credits</h3>
<ul>
<li>n0mi1k (reporter)</li>
</ul>
<h2 id="CVE-2026-80181">Server-side request forgery</h2>
<p>CVE-2026-80181 <a href="https://cve.org/CVERecord?id=CVE-2026-80181">[CVE]</a> <a href="./CVE-2026-80181.cve.json">[CVE json]</a> <a href="./CVE-2026-80181.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-04T06:52:36.375Z</em></p>
-<h3 id="affected-2">Affected</h3>
+<h3 id="affected-5">Affected</h3>
<ul>
<li>Apache Allura through 1.20.0</li>
</ul>
-<h3 id="description-2">Description</h3>
+<h3 id="description-5">Description</h3>
<p><span>Apache Allura's<span> </span></span><span>webhooks</span><span><span> </span>are vulnerable to Server-Side Request Forgery (SSRF).</span><br></p><p>This issue affects Apache Allura: through 1.20.0.</p><p>Users are recommended to upgrade to version 1.21.0, which fixes the issue.</p>
-<h3 id="references-2">References</h3>
+<h3 id="references-5">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/v4nplqchsmdg9sdhp91f8hn03rlq8y7s">https://lists.apache.org/thread/v4nplqchsmdg9sdhp91f8hn03rlq8y7s</a></li>
</ul>
-<h3 id="credits-2">Credits</h3>
+<h3 id="credits-5">Credits</h3>
<ul>
<li>n0mi1k (reporter)</li>
</ul>
<h2 id="CVE-2026-80180">Stored XSS via markdown HTML processing</h2>
<p>CVE-2026-80180 <a href="https://cve.org/CVERecord?id=CVE-2026-80180">[CVE]</a> <a href="./CVE-2026-80180.cve.json">[CVE json]</a> <a href="./CVE-2026-80180.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-04T06:50:09.433Z</em></p>
-<h3 id="affected-3">Affected</h3>
+<h3 id="affected-6">Affected</h3>
<ul>
<li>Apache Allura through 1.20.0</li>
</ul>
-<h3 id="description-3">Description</h3>
+<h3 id="description-6">Description</h3>
<p>Stored XSS via markdown HTML processing in Apache Allura.</p><p>This issue affects Apache Allura: from through 1.20.0.</p><p>Users are recommended to upgrade to version 1.21.0, which fixes the issue.</p>
-<h3 id="references-3">References</h3>
+<h3 id="references-6">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/rjo2hjhp76qhl9f3br8jq909mohvzkpq">https://lists.apache.org/thread/rjo2hjhp76qhl9f3br8jq909mohvzkpq</a></li>
</ul>
-<h3 id="credits-3">Credits</h3>
+<h3 id="credits-6">Credits</h3>
<ul>
<li>n0mi1k (reporter)</li>
</ul>
<h2 id="CVE-2026-75099">Unauthenticated REST disclosure</h2>
<p>CVE-2026-75099 <a href="https://cve.org/CVERecord?id=CVE-2026-75099">[CVE]</a> <a href="./CVE-2026-75099.cve.json">[CVE json]</a> <a href="./CVE-2026-75099.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-24T16:42:15.529Z</em></p>
-<h3 id="affected-4">Affected</h3>
+<h3 id="affected-7">Affected</h3>
<ul>
<li>Apache Allura through 1.19.1</li>
</ul>
-<h3 id="description-4">Description</h3>
+<h3 id="description-7">Description</h3>
<p><span>Unauthenticated REST disclosure</span> of certain content items in Apache Allura.</p><p>This issue affects Apache Allura: through 1.19.1.</p><p>Users are recommended to upgrade to version 1.20.0, which fixes the issue.</p>
-<h3 id="references-4">References</h3>
+<h3 id="references-7">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/lnsfx58o6mx6m44qk4vzqrq8ccmrywcy">https://lists.apache.org/thread/lnsfx58o6mx6m44qk4vzqrq8ccmrywcy</a></li>
</ul>
-<h3 id="credits-4">Credits</h3>
+<h3 id="credits-7">Credits</h3>
<ul>
<li>Venkatraman Kumar, securin.io (finder)</li>
</ul>
<h2 id="CVE-2026-73240">Git command injection</h2>
<p>CVE-2026-73240 <a href="https://cve.org/CVERecord?id=CVE-2026-73240">[CVE]</a> <a href="./CVE-2026-73240.cve.json">[CVE json]</a> <a href="./CVE-2026-73240.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-12T16:41:16.893Z</em></p>
-<h3 id="affected-5">Affected</h3>
+<h3 id="affected-8">Affected</h3>
<ul>
<li>Apache Allura before 1.19.1</li>
</ul>
-<h3 id="description-5">Description</h3>
+<h3 id="description-8">Description</h3>
<p>Specifically crafted inputs may lead to git argument injection in Apache Allura.</p><p>This issue affects Apache Allura: before 1.19.1.</p><p>Users are recommended to upgrade to version 1.19.1, which fixes the issue.</p>
-<h3 id="references-5">References</h3>
+<h3 id="references-8">References</h3>
<ul>
<li><a href="https://allura.apache.org/posts/2026-allura-1.19.1.html">https://allura.apache.org/posts/2026-allura-1.19.1.html</a></li>
<li><a href="https://lists.apache.org/thread/10gnxblhomk2z4gxcyyb4t3p4zxsdddv">https://lists.apache.org/thread/10gnxblhomk2z4gxcyyb4t3p4zxsdddv</a></li>
@@ -211,13 +262,13 @@
<h2 id="CVE-2026-73239">Missing permission checks IDOR</h2>
<p>CVE-2026-73239 <a href="https://cve.org/CVERecord?id=CVE-2026-73239">[CVE]</a> <a href="./CVE-2026-73239.cve.json">[CVE json]</a> <a href="./CVE-2026-73239.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-12T16:41:39.780Z</em></p>
-<h3 id="affected-6">Affected</h3>
+<h3 id="affected-9">Affected</h3>
<ul>
<li>Apache Allura before 1.19.1</li>
</ul>
-<h3 id="description-6">Description</h3>
+<h3 id="description-9">Description</h3>
<p>Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura.</p><p>This issue affects Apache Allura: before 1.19.1.</p><p>Users are recommended to upgrade to version 1.19.1, which fixes the issue.</p>
-<h3 id="references-6">References</h3>
+<h3 id="references-9">References</h3>
<ul>
<li><a href="https://allura.apache.org/posts/2026-allura-1.19.1.html">https://allura.apache.org/posts/2026-allura-1.19.1.html</a></li>
<li><a href="https://lists.apache.org/thread/ryn6yomo897d43ovrd47g02t8ycmbxb3">https://lists.apache.org/thread/ryn6yomo897d43ovrd47g02t8ycmbxb3</a></li>
@@ -225,13 +276,13 @@
<h2 id="CVE-2026-73238">XSS in code display</h2>
<p>CVE-2026-73238 <a href="https://cve.org/CVERecord?id=CVE-2026-73238">[CVE]</a> <a href="./CVE-2026-73238.cve.json">[CVE json]</a> <a href="./CVE-2026-73238.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-12T16:41:57.464Z</em></p>
-<h3 id="affected-7">Affected</h3>
+<h3 id="affected-10">Affected</h3>
<ul>
<li>Apache Allura before 1.19.1</li>
</ul>
-<h3 id="description-7">Description</h3>
+<h3 id="description-10">Description</h3>
<p>XSS vulnerability in code display in Apache Allura.</p><p>This issue affects Apache Allura: before 1.19.1.</p><p>Users are recommended to upgrade to version 1.19.1, which fixes the issue.</p>
-<h3 id="references-7">References</h3>
+<h3 id="references-10">References</h3>
<ul>
<li><a href="https://allura.apache.org/posts/2026-allura-1.19.1.html">https://allura.apache.org/posts/2026-allura-1.19.1.html</a></li>
<li><a href="https://lists.apache.org/thread/bbzhnvqlwvwbprnfg4g41s8wkc5bdfmk">https://lists.apache.org/thread/bbzhnvqlwvwbprnfg4g41s8wkc5bdfmk</a></li>
@@ -239,13 +290,13 @@
<h2 id="CVE-2026-73237">XSS in markdown pipeline</h2>
<p>CVE-2026-73237 <a href="https://cve.org/CVERecord?id=CVE-2026-73237">[CVE]</a> <a href="./CVE-2026-73237.cve.json">[CVE json]</a> <a href="./CVE-2026-73237.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-12T16:42:26.194Z</em></p>
-<h3 id="affected-8">Affected</h3>
+<h3 id="affected-11">Affected</h3>
<ul>
<li>Apache Allura from 1.10.0 before 1.19.1</li>
</ul>
-<h3 id="description-8">Description</h3>
+<h3 id="description-11">Description</h3>
<p>XSS vulnerability in Markdown handling in Apache Allura.</p><p>This issue affects Apache Allura: from 1.10.0 before 1.19.1.</p><p>Users are recommended to upgrade to version 1.19.1, which fixes the issue.</p>
-<h3 id="references-8">References</h3>
+<h3 id="references-11">References</h3>
<ul>
<li><a href="https://allura.apache.org/posts/2026-allura-1.19.1.html">https://allura.apache.org/posts/2026-allura-1.19.1.html</a></li>
<li><a href="https://lists.apache.org/thread/p7bd1yz9v9wbsbc6hz3tjxozxnwyzqz0">https://lists.apache.org/thread/p7bd1yz9v9wbsbc6hz3tjxozxnwyzqz0</a></li>
@@ -253,13 +304,13 @@
<h2 id="CVE-2026-69223">Server-side request forgery</h2>
<p>CVE-2026-69223 <a href="https://cve.org/CVERecord?id=CVE-2026-69223">[CVE]</a> <a href="./CVE-2026-69223.cve.json">[CVE json]</a> <a href="./CVE-2026-69223.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-11T17:03:03.256Z</em></p>
-<h3 id="affected-9">Affected</h3>
+<h3 id="affected-12">Affected</h3>
<ul>
<li>Apache Allura before 1.19.1</li>
</ul>
-<h3 id="description-9">Description</h3>
+<h3 id="description-12">Description</h3>
<p>Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF).</p><p>This issue affects Apache Allura: before 1.19.1.</p><p>Users are recommended to upgrade to version 1.19.1, which fixes the issue.</p>
-<h3 id="references-9">References</h3>
+<h3 id="references-12">References</h3>
<ul>
<li><a href="https://allura.apache.org/posts/2026-allura-1.19.1.html">https://allura.apache.org/posts/2026-allura-1.19.1.html</a></li>
<li><a href="https://lists.apache.org/thread/9xpltfm6nombd7rdrx5o0hh8kxmm82pb">https://lists.apache.org/thread/9xpltfm6nombd7rdrx5o0hh8kxmm82pb</a></li>
@@ -267,52 +318,52 @@
<h2 id="CVE-2024-38379">Stored authenticated XSS</h2>
<p>CVE-2024-38379 <a href="https://cve.org/CVERecord?id=CVE-2024-38379">[CVE]</a> <a href="./CVE-2024-38379.cve.json">[CVE json]</a> <a href="./CVE-2024-38379.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-02-06T14:32:32.361Z</em></p>
-<h3 id="affected-10">Affected</h3>
+<h3 id="affected-13">Affected</h3>
<ul>
<li>Apache Allura from 1.4.0 through 1.17.0</li>
</ul>
-<h3 id="description-10">Description</h3>
+<h3 id="description-13">Description</h3>
<p>Apache Allura's neighborhood settings are vulnerable to a stored XSS attack. Only neighborhood admins can access these settings, so the scope of risk is limited to configurations where neighborhood admins are not fully trusted.<br></p><p>This issue affects Apache Allura: from 1.4.0 through 1.17.0.</p><p>Users are recommended to upgrade to version 1.17.1, which fixes the issue.</p>
-<h3 id="references-10">References</h3>
+<h3 id="references-13">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/2lb6vp00sj2b2snpmhff5lyortxjsnrp">https://lists.apache.org/thread/2lb6vp00sj2b2snpmhff5lyortxjsnrp</a></li>
</ul>
-<h3 id="credits-5">Credits</h3>
+<h3 id="credits-8">Credits</h3>
<ul>
<li>Ömer “WASP” Akincir (finder)</li>
</ul>
<h2 id="CVE-2024-36471">sensitive information exposure via DNS rebinding</h2>
<p>CVE-2024-36471 <a href="https://cve.org/CVERecord?id=CVE-2024-36471">[CVE]</a> <a href="./CVE-2024-36471.cve.json">[CVE json]</a> <a href="./CVE-2024-36471.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-06-10T21:55:03.113Z</em></p>
-<h3 id="affected-11">Affected</h3>
+<h3 id="affected-14">Affected</h3>
<ul>
<li>Apache Allura from 1.0.1 through 1.16.0</li>
</ul>
-<h3 id="description-11">Description</h3>
+<h3 id="description-14">Description</h3>
<div>Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL. Project administrators can run these imports, which could cause Allura to read from internal services and expose them.<br></div><div><br></div><div>This issue affects Apache Allura from 1.0.1 through 1.16.0.</div><p></p><p>Users are recommended to upgrade to version 1.17.0, which fixes the issue. If you are unable to upgrade, set "disable_entry_points.allura.importers = [...]
-<h3 id="references-11">References</h3>
+<h3 id="references-14">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/g43164t4bcp0tjwt4opxyks4svm8kvbh">https://lists.apache.org/thread/g43164t4bcp0tjwt4opxyks4svm8kvbh</a></li>
</ul>
-<h3 id="credits-6">Credits</h3>
+<h3 id="credits-9">Credits</h3>
<ul>
<li>truff <a href="https://x.com/truffzor">https://x.com/truffzor</a> (finder)</li>
</ul>
<h2 id="CVE-2023-46851">sensitive information exposure via import</h2>
<p>CVE-2023-46851 <a href="https://cve.org/CVERecord?id=CVE-2023-46851">[CVE]</a> <a href="./CVE-2023-46851.cve.json">[CVE json]</a> <a href="./CVE-2023-46851.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-11-07T08:56:30.662Z</em></p>
-<h3 id="affected-12">Affected</h3>
+<h3 id="affected-15">Affected</h3>
<ul>
<li>Apache Allura from 1.0.1 through 1.15.0</li>
</ul>
-<h3 id="description-12">Description</h3>
+<h3 id="description-15">Description</h3>
<div>Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could cause Allura to read local files and expose them. Exposing internal files then can lead to other exploits, like session hijacking, or remote code execution.<br></div><div><br></div><div>This issue affects Apache Allura from 1.0.1 through 1.15.0.</div><p></p><p>Users are recommended to upgrade to version 1.16.0, which fixe [...]
-<h3 id="references-12">References</h3>
+<h3 id="references-15">References</h3>
<ul>
<li><a href="https://allura.apache.org/posts/2023-allura-1.16.0.html">https://allura.apache.org/posts/2023-allura-1.16.0.html</a></li>
<li><a href="https://lists.apache.org/thread/hqk0vltl7qgrq215zgwjfoj0khbov0gx">https://lists.apache.org/thread/hqk0vltl7qgrq215zgwjfoj0khbov0gx</a></li>
</ul>
-<h3 id="credits-7">Credits</h3>
+<h3 id="credits-10">Credits</h3>
<ul>
<li>Stefan Schiller (Sonar) (finder)</li>
</ul>
diff --git a/projects/answer/CVE-2026-64943.cve.json b/projects/answer/CVE-2026-64943.cve.json
new file mode 100644
index 00000000..6f509d25
--- /dev/null
+++ b/projects/answer/CVE-2026-64943.cve.json
@@ -0,0 +1,96 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:software-id/apache.org/answer",
+ "product": "Apache Answer",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "2.0.2",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "reporter",
+ "value": "meifukun"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "<p>Insertion of Sensitive Information into Log File vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.2.</p>Full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials.<div><br><p>Users are recommended to upgrade to version 2.0.3, which fixes the issue.</p></div>"
+ }
+ ],
+ "value": "Insertion of Sensitive Information into Log File vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nFull API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials.\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "low"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-532",
+ "description": "CWE-532 Insertion of Sensitive Information into Log File",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/gczojx5ypncn1x1pg9z1cphb54t23zzg"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "API keys logged in plaintext during authentication",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-64943",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/answer/CVE-2026-64943.osv.json b/projects/answer/CVE-2026-64943.osv.json
new file mode 100644
index 00000000..2f1650a8
--- /dev/null
+++ b/projects/answer/CVE-2026-64943.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-64943", "summary": "API keys logged in plaintext during authentication", "details": "Insertion of Sensitive Information into Log File vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nFull API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials.\n\n\nUsers are recommended to upgrade to version 2.0.3, whi [...]
\ No newline at end of file
diff --git a/projects/answer/CVE-2026-64944.cve.json b/projects/answer/CVE-2026-64944.cve.json
new file mode 100644
index 00000000..56afe9de
--- /dev/null
+++ b/projects/answer/CVE-2026-64944.cve.json
@@ -0,0 +1,96 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:software-id/apache.org/answer",
+ "product": "Apache Answer",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "2.0.2",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "reporter",
+ "value": "meifukun"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "<p>Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.2.</p>The importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization path, so attacker-controlled HTML embedded in an imported data source is persisted and rendered to all viewers (including privileged users) as stored XSS.<div><br> [...]
+ }
+ ],
+ "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nThe importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization path, so attacker-controlled HTML embedded in an imported data source is persisted and rendered to all viewers (including privileged users) as stored XSS.\n\n\nUsers are [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "low"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-79",
+ "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/2cjdm4pdrrvj0t6cgcfyo3hot9vq72kb"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Stored XSS via unsanitized HTML in imported question content",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-64944",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/answer/CVE-2026-64944.osv.json b/projects/answer/CVE-2026-64944.osv.json
new file mode 100644
index 00000000..dcff01a3
--- /dev/null
+++ b/projects/answer/CVE-2026-64944.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-64944", "summary": "Stored XSS via unsanitized HTML in imported question content", "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nThe importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization path, so attacker-controlled HTML embedded in an i [...]
\ No newline at end of file
diff --git a/projects/answer/CVE-2026-64945.cve.json b/projects/answer/CVE-2026-64945.cve.json
new file mode 100644
index 00000000..d62be723
--- /dev/null
+++ b/projects/answer/CVE-2026-64945.cve.json
@@ -0,0 +1,96 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:software-id/apache.org/answer",
+ "product": "Apache Answer",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "2.0.2",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "reporter",
+ "value": "meifukun"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "<p>A vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.2.</p>The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show.<div><br><p>Users are recommended to upgra [...]
+ }
+ ],
+ "value": "A vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nThe question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show.\n\n\nUsers are recommended to upgrade to versio [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "low"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-863",
+ "description": "CWE-863 Incorrect Authorization",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/3wdqq1vp449bty5ovs02f0894km07wmz"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Incorrect permission mapping allows users with only the unpin permission to hide/show questions",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-64945",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/answer/CVE-2026-64945.osv.json b/projects/answer/CVE-2026-64945.osv.json
new file mode 100644
index 00000000..a572810e
--- /dev/null
+++ b/projects/answer/CVE-2026-64945.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-64945", "summary": "Incorrect permission mapping allows users with only the unpin permission to hide/show questions", "details": "A vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nThe question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user [...]
\ No newline at end of file
diff --git a/projects/answer/CVE-2026-67249.cve.json b/projects/answer/CVE-2026-67249.cve.json
new file mode 100644
index 00000000..f52ff5a1
--- /dev/null
+++ b/projects/answer/CVE-2026-67249.cve.json
@@ -0,0 +1,96 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:software-id/apache.org/answer",
+ "product": "Apache Answer",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "2.0.2",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "reporter",
+ "value": "Arpit Jain"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "<p>A vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.2.</p>A verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced.<div><br><p>Users are recommended to upgrade to version 2.0.3, which fixes the issue.</p></div>"
+ }
+ ],
+ "value": "A vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nA verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced.\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "moderate"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-863",
+ "description": "CWE-863 Incorrect Authorization",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/kbdgj9vzd24zb4r2d9ydqyr6f70rpg0v"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Email Code Purpose Confusion May Allow Account Takeover",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-67249",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/answer/CVE-2026-67249.osv.json b/projects/answer/CVE-2026-67249.osv.json
new file mode 100644
index 00000000..3efa6d05
--- /dev/null
+++ b/projects/answer/CVE-2026-67249.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-67249", "summary": "Email Code Purpose Confusion May Allow Account Takeover", "details": "A vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nA verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced.\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue.", "affected": [{"ranges": [{"t [...]
\ No newline at end of file
diff --git a/projects/answer/CVE-2026-68482.cve.json b/projects/answer/CVE-2026-68482.cve.json
new file mode 100644
index 00000000..66faf6b4
--- /dev/null
+++ b/projects/answer/CVE-2026-68482.cve.json
@@ -0,0 +1,96 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:software-id/apache.org/answer",
+ "product": "Apache Answer",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "2.0.2",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "reporter",
+ "value": "Yash Shendge"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "<p>Missing Authorization vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.2.</p>An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks.<div><br><p>Users are recommended to upgrade to version 2.0.3, which fixes the issue.</p></div>"
+ }
+ ],
+ "value": "Missing Authorization vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nAn unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks.\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "low"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-862",
+ "description": "CWE-862 Missing Authorization",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/m2tbvdv12hmr9sw6ft53rjnww8hqzds0"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Improper Authorization in Question Invite User Lookup",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-68482",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/answer/CVE-2026-68482.osv.json b/projects/answer/CVE-2026-68482.osv.json
new file mode 100644
index 00000000..93f1b19e
--- /dev/null
+++ b/projects/answer/CVE-2026-68482.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-68482", "summary": "Improper Authorization in Question Invite User Lookup", "details": "Missing Authorization vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nAn unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks.\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue.", "affe [...]
\ No newline at end of file
diff --git a/projects/answer/CVE-2026-71563.cve.json b/projects/answer/CVE-2026-71563.cve.json
new file mode 100644
index 00000000..022060fa
--- /dev/null
+++ b/projects/answer/CVE-2026-71563.cve.json
@@ -0,0 +1,101 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:software-id/apache.org/answer",
+ "product": "Apache Answer",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "2.0.2",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "reporter",
+ "value": "Han, JunGyu"
+ },
+ {
+ "lang": "en",
+ "type": "reporter",
+ "value": "VK, AzeFox Foundations"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "<p>Missing Authorization vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.2.</p>An authorization flaw in the MCP answer retrieval tool allows holders of a global API key to access answer content associated with hidden, deleted, or pending-review questions.<div><br><p>Users are recommended to upgrade to version 2.0.3, which fixes the issue.</p></div>"
+ }
+ ],
+ "value": "Missing Authorization vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nAn authorization flaw in the MCP answer retrieval tool allows holders of a global API key to access answer content associated with hidden, deleted, or pending-review questions.\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "moderate"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-862",
+ "description": "CWE-862 Missing Authorization",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/msodd7g2r6xdn9wpkpdp04m9g1jb2xtl"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "MCP Answer Retrieval Exposes Content from Non-Public Questions",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-71563",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/answer/CVE-2026-71563.osv.json b/projects/answer/CVE-2026-71563.osv.json
new file mode 100644
index 00000000..1d1c909b
--- /dev/null
+++ b/projects/answer/CVE-2026-71563.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-71563", "summary": "MCP Answer Retrieval Exposes Content from Non-Public Questions", "details": "Missing Authorization vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nAn authorization flaw in the MCP answer retrieval tool allows holders of a global API key to access answer content associated with hidden, deleted, or pending-review questions.\n\n\nUsers are recommended to upgrade to version 2.0.3, which [...]
\ No newline at end of file
diff --git a/projects/answer/CVE-2026-76994.cve.json b/projects/answer/CVE-2026-76994.cve.json
new file mode 100644
index 00000000..78a0316b
--- /dev/null
+++ b/projects/answer/CVE-2026-76994.cve.json
@@ -0,0 +1,96 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:software-id/apache.org/answer",
+ "product": "Apache Answer",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "2.0.2",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "reporter",
+ "value": "sec-reex"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.2.</p>Unauthenticated attackers could obtain metadata associated with hidden questions through public answer profiles.<div><br><p>Users are recommended to upgrade to version 2.0.3, which fixes the issue.</p></div>"
+ }
+ ],
+ "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nUnauthenticated attackers could obtain metadata associated with hidden questions through public answer profiles.\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "moderate"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-200",
+ "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/b9whow167cr0lkhqk6xzk0c2bb86srhy"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Exposure of Hidden Question Metadata Through Public Answer Profiles",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-76994",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/answer/CVE-2026-76994.osv.json b/projects/answer/CVE-2026-76994.osv.json
new file mode 100644
index 00000000..29ffeac9
--- /dev/null
+++ b/projects/answer/CVE-2026-76994.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-76994", "summary": "Exposure of Hidden Question Metadata Through Public Answer Profiles", "details": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nUnauthenticated attackers could obtain metadata associated with hidden questions through public answer profiles.\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue.", "a [...]
\ No newline at end of file
diff --git a/projects/answer/CVE-2026-79620.cve.json b/projects/answer/CVE-2026-79620.cve.json
new file mode 100644
index 00000000..50d7da07
--- /dev/null
+++ b/projects/answer/CVE-2026-79620.cve.json
@@ -0,0 +1,96 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:software-id/apache.org/answer",
+ "product": "Apache Answer",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "2.0.2",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "reporter",
+ "value": "n0mi1k"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "<p>Exposure of sensitive information through data queries vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.2.</p><p>An improper authorization check in the similar-question search allowed authenticated users to view metadata of non-public questions.</p><p>Users are recommended to upgrade to version 2.0.3, which fixes the issue.</p>"
+ }
+ ],
+ "value": "Exposure of sensitive information through data queries vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\n\n\nAn improper authorization check in the similar-question search allowed authenticated users to view metadata of non-public questions.\n\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "moderate"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-202",
+ "description": "CWE-202 Exposure of sensitive information through data queries",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/p6oqj9b27o4nppc0kv00rn7yb7n2l6o8"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Improper Authorization Allows Disclosure of Non-Public Question Metadata",
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-79620",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/answer/CVE-2026-79620.osv.json b/projects/answer/CVE-2026-79620.osv.json
new file mode 100644
index 00000000..b61087ca
--- /dev/null
+++ b/projects/answer/CVE-2026-79620.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-79620", "summary": "Improper Authorization Allows Disclosure of Non-Public Question Metadata", "details": "Exposure of sensitive information through data queries vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\n\n\nAn improper authorization check in the similar-question search allowed authenticated users to view metadata of non-public questions.\n\n\n\nUsers are recommended to upgrade to version 2.0.3, [...]
\ No newline at end of file
diff --git a/projects/answer/CVE-2026-79624.cve.json b/projects/answer/CVE-2026-79624.cve.json
new file mode 100644
index 00000000..45a5ba75
--- /dev/null
+++ b/projects/answer/CVE-2026-79624.cve.json
@@ -0,0 +1,96 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:software-id/apache.org/answer",
+ "product": "Apache Answer",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "2.0.2",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "reporter",
+ "value": "Maksim Hayder"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "<p>Insufficient session expiration vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.2.</p><p>Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token.</p><p>Users are recommended to upgrade to version 2.0.3, which fixes the issue.</p>"
+ }
+ ],
+ "value": "Insufficient session expiration vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\n\n\nInsufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token.\n\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "moderate"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-613",
+ "description": "CWE-613 Insufficient session expiration",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/lpwc1hpnt3fkfwkh00v5j0dvpzqmnoqk"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Stale Visit Tokens Retain Access to Private Uploads After Session Revocation",
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-79624",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/answer/CVE-2026-79624.osv.json b/projects/answer/CVE-2026-79624.osv.json
new file mode 100644
index 00000000..1fa9e39b
--- /dev/null
+++ b/projects/answer/CVE-2026-79624.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-79624", "summary": "Stale Visit Tokens Retain Access to Private Uploads After Session Revocation", "details": "Insufficient session expiration vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\n\n\nInsufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token.\n\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the iss [...]
\ No newline at end of file
diff --git a/projects/answer/CVE-2026-79633.cve.json b/projects/answer/CVE-2026-79633.cve.json
new file mode 100644
index 00000000..b3d10882
--- /dev/null
+++ b/projects/answer/CVE-2026-79633.cve.json
@@ -0,0 +1,96 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:software-id/apache.org/answer",
+ "product": "Apache Answer",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "2.0.2",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "reporter",
+ "value": "Luigi Colluto"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "<p> vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.2.</p><p>Missing authorization checks allowed authenticated users to perform actions on non-public content they were not permitted to access.</p><p>Users are recommended to upgrade to version 2.0.3, which fixes the issue.</p>"
+ }
+ ],
+ "value": "vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\n\n\nMissing authorization checks allowed authenticated users to perform actions on non-public content they were not permitted to access.\n\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "moderate"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-202",
+ "description": "CWE-202 Exposure of sensitive information through data queries",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/m301yrn0fwgr957q8qzfzt8tpjklocv9"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Missing Authorization Allows Mutations of Non-Public Content",
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-79633",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/answer/CVE-2026-79633.osv.json b/projects/answer/CVE-2026-79633.osv.json
new file mode 100644
index 00000000..27f78f1e
--- /dev/null
+++ b/projects/answer/CVE-2026-79633.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-79633", "summary": "Missing Authorization Allows Mutations of Non-Public Content", "details": "vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\n\n\nMissing authorization checks allowed authenticated users to perform actions on non-public content they were not permitted to access.\n\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue.", "affected": [{"ranges": [{"type": "SEMVER" [...]
\ No newline at end of file
diff --git a/projects/answer/CVE-2026-86589.cve.json b/projects/answer/CVE-2026-86589.cve.json
new file mode 100644
index 00000000..b08c94a2
--- /dev/null
+++ b/projects/answer/CVE-2026-86589.cve.json
@@ -0,0 +1,96 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:software-id/apache.org/answer",
+ "product": "Apache Answer",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "2.0.2",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "reporter",
+ "value": "ascanner"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "<p>Incorrect implementation of authentication algorithm vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.2.</p><p>A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass central account suspension or deletion checks until the session<br> expires or is revoked.</p><p>Users are recommended to upgrade to version 2.0.3, which fi [...]
+ }
+ ],
+ "value": "Incorrect implementation of authentication algorithm vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\n\n\nA flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass central account suspension or deletion checks until the session\n expires or is revoked.\n\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes th [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "moderate"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-303",
+ "description": "CWE-303 Incorrect implementation of authentication algorithm",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/t8mbzfolzlqz4z5hcwq3v0lnwjqb2tl5"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "User Center integration does not revoke first-login sessions after central account suspension",
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-86589",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/answer/CVE-2026-86589.osv.json b/projects/answer/CVE-2026-86589.osv.json
new file mode 100644
index 00000000..2fce0df3
--- /dev/null
+++ b/projects/answer/CVE-2026-86589.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-86589", "summary": "User Center integration does not revoke first-login sessions after central account suspension", "details": "Incorrect implementation of authentication algorithm vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\n\n\nA flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass central ac [...]
\ No newline at end of file
diff --git a/projects/answer/CVE-2026-90910.cve.json b/projects/answer/CVE-2026-90910.cve.json
new file mode 100644
index 00000000..5bef6171
--- /dev/null
+++ b/projects/answer/CVE-2026-90910.cve.json
@@ -0,0 +1,96 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:software-id/apache.org/answer",
+ "product": "Apache Answer",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "2.0.2",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "reporter",
+ "value": "Maksim Hayder"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "<p>Missing authentication for critical function vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.2.</p><p>The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions.</p><p>Users are recommended to upgrade to version 2.0.3, which fixes the issue.</p>"
+ }
+ ],
+ "value": "Missing authentication for critical function vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\n\n\nThe reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions.\n\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "moderate"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-306",
+ "description": "CWE-306 Missing authentication for critical function",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/bhw80mvmnt9206wyqz80rcbwx1znv1p3"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Reaction API authorization bypass for restricted content",
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-90910",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/answer/CVE-2026-90910.osv.json b/projects/answer/CVE-2026-90910.osv.json
new file mode 100644
index 00000000..f0a28b1a
--- /dev/null
+++ b/projects/answer/CVE-2026-90910.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-90910", "summary": "Reaction API authorization bypass for restricted content", "details": "Missing authentication for critical function vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\n\n\nThe reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions.\n\n\n\nUsers are recommended to upgrad [...]
\ No newline at end of file
diff --git a/projects/answer/index.html b/projects/answer/index.html
index a7ee8e2d..4b91a3db 100644
--- a/projects/answer/index.html
+++ b/projects/answer/index.html
@@ -109,54 +109,259 @@
</ul>
<h1 id="advisories">Advisories</h1>
<p class="bg-warning">This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the project security page linked above. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public <a href="/mailinglist">mailinglist</a> or privately on <a href="mailto:security@apache.org">security@apache.org</a></p>
+<h2 id="CVE-2026-90910">Reaction API authorization bypass for restricted content</h2>
+<p>CVE-2026-90910 <a href="https://cve.org/CVERecord?id=CVE-2026-90910">[CVE]</a> <a href="./CVE-2026-90910.cve.json">[CVE json]</a> <a href="./CVE-2026-90910.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-10-19T09:35:53.657Z</em></p>
+<h3 id="affected">Affected</h3>
+<ul>
+<li>Apache Answer through 2.0.2</li>
+</ul>
+<h3 id="description">Description</h3>
+<p>Missing authentication for critical function vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.2.</p><p>The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions.</p><p>Users are recommended to upgrade to version 2.0.3, which fixes the issue.</p>
+<h3 id="references">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/bhw80mvmnt9206wyqz80rcbwx1znv1p3">https://lists.apache.org/thread/bhw80mvmnt9206wyqz80rcbwx1znv1p3</a></li>
+</ul>
+<h3 id="credits">Credits</h3>
+<ul>
+<li>Maksim Hayder (reporter)</li>
+</ul>
+<h2 id="CVE-2026-86589">User Center integration does not revoke first-login sessions after central account suspension</h2>
+<p>CVE-2026-86589 <a href="https://cve.org/CVERecord?id=CVE-2026-86589">[CVE]</a> <a href="./CVE-2026-86589.cve.json">[CVE json]</a> <a href="./CVE-2026-86589.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-10-19T09:35:25.843Z</em></p>
+<h3 id="affected-1">Affected</h3>
+<ul>
+<li>Apache Answer through 2.0.2</li>
+</ul>
+<h3 id="description-1">Description</h3>
+<p>Incorrect implementation of authentication algorithm vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.2.</p><p>A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass central account suspension or deletion checks until the session<br> expires or is revoked.</p><p>Users are recommended to upgrade to version 2.0.3, which fixes the issue.</p>
+<h3 id="references-1">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/t8mbzfolzlqz4z5hcwq3v0lnwjqb2tl5">https://lists.apache.org/thread/t8mbzfolzlqz4z5hcwq3v0lnwjqb2tl5</a></li>
+</ul>
+<h3 id="credits-1">Credits</h3>
+<ul>
+<li>ascanner (reporter)</li>
+</ul>
+<h2 id="CVE-2026-79633">Missing Authorization Allows Mutations of Non-Public Content</h2>
+<p>CVE-2026-79633 <a href="https://cve.org/CVERecord?id=CVE-2026-79633">[CVE]</a> <a href="./CVE-2026-79633.cve.json">[CVE json]</a> <a href="./CVE-2026-79633.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-10-19T09:35:04.330Z</em></p>
+<h3 id="affected-2">Affected</h3>
+<ul>
+<li>Apache Answer through 2.0.2</li>
+</ul>
+<h3 id="description-2">Description</h3>
+<p> vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.2.</p><p>Missing authorization checks allowed authenticated users to perform actions on non-public content they were not permitted to access.</p><p>Users are recommended to upgrade to version 2.0.3, which fixes the issue.</p>
+<h3 id="references-2">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/m301yrn0fwgr957q8qzfzt8tpjklocv9">https://lists.apache.org/thread/m301yrn0fwgr957q8qzfzt8tpjklocv9</a></li>
+</ul>
+<h3 id="credits-2">Credits</h3>
+<ul>
+<li>Luigi Colluto (reporter)</li>
+</ul>
+<h2 id="CVE-2026-79624">Stale Visit Tokens Retain Access to Private Uploads After Session Revocation</h2>
+<p>CVE-2026-79624 <a href="https://cve.org/CVERecord?id=CVE-2026-79624">[CVE]</a> <a href="./CVE-2026-79624.cve.json">[CVE json]</a> <a href="./CVE-2026-79624.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-10-19T09:34:39.031Z</em></p>
+<h3 id="affected-3">Affected</h3>
+<ul>
+<li>Apache Answer through 2.0.2</li>
+</ul>
+<h3 id="description-3">Description</h3>
+<p>Insufficient session expiration vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.2.</p><p>Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token.</p><p>Users are recommended to upgrade to version 2.0.3, which fixes the issue.</p>
+<h3 id="references-3">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/lpwc1hpnt3fkfwkh00v5j0dvpzqmnoqk">https://lists.apache.org/thread/lpwc1hpnt3fkfwkh00v5j0dvpzqmnoqk</a></li>
+</ul>
+<h3 id="credits-3">Credits</h3>
+<ul>
+<li>Maksim Hayder (reporter)</li>
+</ul>
+<h2 id="CVE-2026-79620">Improper Authorization Allows Disclosure of Non-Public Question Metadata</h2>
+<p>CVE-2026-79620 <a href="https://cve.org/CVERecord?id=CVE-2026-79620">[CVE]</a> <a href="./CVE-2026-79620.cve.json">[CVE json]</a> <a href="./CVE-2026-79620.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-10-19T09:34:09.974Z</em></p>
+<h3 id="affected-4">Affected</h3>
+<ul>
+<li>Apache Answer through 2.0.2</li>
+</ul>
+<h3 id="description-4">Description</h3>
+<p>Exposure of sensitive information through data queries vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.2.</p><p>An improper authorization check in the similar-question search allowed authenticated users to view metadata of non-public questions.</p><p>Users are recommended to upgrade to version 2.0.3, which fixes the issue.</p>
+<h3 id="references-4">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/p6oqj9b27o4nppc0kv00rn7yb7n2l6o8">https://lists.apache.org/thread/p6oqj9b27o4nppc0kv00rn7yb7n2l6o8</a></li>
+</ul>
+<h3 id="credits-4">Credits</h3>
+<ul>
+<li>n0mi1k (reporter)</li>
+</ul>
+<h2 id="CVE-2026-76994">Exposure of Hidden Question Metadata Through Public Answer Profiles</h2>
+<p>CVE-2026-76994 <a href="https://cve.org/CVERecord?id=CVE-2026-76994">[CVE]</a> <a href="./CVE-2026-76994.cve.json">[CVE json]</a> <a href="./CVE-2026-76994.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-10-19T09:33:12.978Z</em></p>
+<h3 id="affected-5">Affected</h3>
+<ul>
+<li>Apache Answer through 2.0.2</li>
+</ul>
+<h3 id="description-5">Description</h3>
+<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.2.</p>Unauthenticated attackers could obtain metadata associated with hidden questions through public answer profiles.<div><br><p>Users are recommended to upgrade to version 2.0.3, which fixes the issue.</p></div>
+<h3 id="references-5">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/b9whow167cr0lkhqk6xzk0c2bb86srhy">https://lists.apache.org/thread/b9whow167cr0lkhqk6xzk0c2bb86srhy</a></li>
+</ul>
+<h3 id="credits-5">Credits</h3>
+<ul>
+<li>sec-reex (reporter)</li>
+</ul>
+<h2 id="CVE-2026-71563">MCP Answer Retrieval Exposes Content from Non-Public Questions</h2>
+<p>CVE-2026-71563 <a href="https://cve.org/CVERecord?id=CVE-2026-71563">[CVE]</a> <a href="./CVE-2026-71563.cve.json">[CVE json]</a> <a href="./CVE-2026-71563.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-10-19T09:32:39.465Z</em></p>
+<h3 id="affected-6">Affected</h3>
+<ul>
+<li>Apache Answer through 2.0.2</li>
+</ul>
+<h3 id="description-6">Description</h3>
+<p>Missing Authorization vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.2.</p>An authorization flaw in the MCP answer retrieval tool allows holders of a global API key to access answer content associated with hidden, deleted, or pending-review questions.<div><br><p>Users are recommended to upgrade to version 2.0.3, which fixes the issue.</p></div>
+<h3 id="references-6">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/msodd7g2r6xdn9wpkpdp04m9g1jb2xtl">https://lists.apache.org/thread/msodd7g2r6xdn9wpkpdp04m9g1jb2xtl</a></li>
+</ul>
+<h3 id="credits-6">Credits</h3>
+<ul>
+<li>Han, JunGyu (reporter)</li>
+<li>VK, AzeFox Foundations (reporter)</li>
+</ul>
+<h2 id="CVE-2026-68482">Improper Authorization in Question Invite User Lookup</h2>
+<p>CVE-2026-68482 <a href="https://cve.org/CVERecord?id=CVE-2026-68482">[CVE]</a> <a href="./CVE-2026-68482.cve.json">[CVE json]</a> <a href="./CVE-2026-68482.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-10-19T09:31:49.451Z</em></p>
+<h3 id="affected-7">Affected</h3>
+<ul>
+<li>Apache Answer through 2.0.2</li>
+</ul>
+<h3 id="description-7">Description</h3>
+<p>Missing Authorization vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.2.</p>An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks.<div><br><p>Users are recommended to upgrade to version 2.0.3, which fixes the issue.</p></div>
+<h3 id="references-7">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/m2tbvdv12hmr9sw6ft53rjnww8hqzds0">https://lists.apache.org/thread/m2tbvdv12hmr9sw6ft53rjnww8hqzds0</a></li>
+</ul>
+<h3 id="credits-7">Credits</h3>
+<ul>
+<li>Yash Shendge (reporter)</li>
+</ul>
+<h2 id="CVE-2026-67249">Email Code Purpose Confusion May Allow Account Takeover</h2>
+<p>CVE-2026-67249 <a href="https://cve.org/CVERecord?id=CVE-2026-67249">[CVE]</a> <a href="./CVE-2026-67249.cve.json">[CVE json]</a> <a href="./CVE-2026-67249.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-10-19T09:31:19.395Z</em></p>
+<h3 id="affected-8">Affected</h3>
+<ul>
+<li>Apache Answer through 2.0.2</li>
+</ul>
+<h3 id="description-8">Description</h3>
+<p>A vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.2.</p>A verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced.<div><br><p>Users are recommended to upgrade to version 2.0.3, which fixes the issue.</p></div>
+<h3 id="references-8">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/kbdgj9vzd24zb4r2d9ydqyr6f70rpg0v">https://lists.apache.org/thread/kbdgj9vzd24zb4r2d9ydqyr6f70rpg0v</a></li>
+</ul>
+<h3 id="credits-8">Credits</h3>
+<ul>
+<li>Arpit Jain (reporter)</li>
+</ul>
+<h2 id="CVE-2026-64945">Incorrect permission mapping allows users with only the unpin permission to hide/show questions</h2>
+<p>CVE-2026-64945 <a href="https://cve.org/CVERecord?id=CVE-2026-64945">[CVE]</a> <a href="./CVE-2026-64945.cve.json">[CVE json]</a> <a href="./CVE-2026-64945.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-10-19T09:30:50.536Z</em></p>
+<h3 id="affected-9">Affected</h3>
+<ul>
+<li>Apache Answer through 2.0.2</li>
+</ul>
+<h3 id="description-9">Description</h3>
+<p>A vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.2.</p>The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show.<div><br><p>Users are recommended to upgrade to version 2.0.3, whi [...]
+<h3 id="references-9">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/3wdqq1vp449bty5ovs02f0894km07wmz">https://lists.apache.org/thread/3wdqq1vp449bty5ovs02f0894km07wmz</a></li>
+</ul>
+<h3 id="credits-9">Credits</h3>
+<ul>
+<li>meifukun (reporter)</li>
+</ul>
+<h2 id="CVE-2026-64944">Stored XSS via unsanitized HTML in imported question content</h2>
+<p>CVE-2026-64944 <a href="https://cve.org/CVERecord?id=CVE-2026-64944">[CVE]</a> <a href="./CVE-2026-64944.cve.json">[CVE json]</a> <a href="./CVE-2026-64944.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-10-19T09:26:51.147Z</em></p>
+<h3 id="affected-10">Affected</h3>
+<ul>
+<li>Apache Answer through 2.0.2</li>
+</ul>
+<h3 id="description-10">Description</h3>
+<p>Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.2.</p>The importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization path, so attacker-controlled HTML embedded in an imported data source is persisted and rendered to all viewers (including privileged users) as stored XSS.<div><br><p>Users are recommended [...]
+<h3 id="references-10">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/2cjdm4pdrrvj0t6cgcfyo3hot9vq72kb">https://lists.apache.org/thread/2cjdm4pdrrvj0t6cgcfyo3hot9vq72kb</a></li>
+</ul>
+<h3 id="credits-10">Credits</h3>
+<ul>
+<li>meifukun (reporter)</li>
+</ul>
+<h2 id="CVE-2026-64943">API keys logged in plaintext during authentication</h2>
+<p>CVE-2026-64943 <a href="https://cve.org/CVERecord?id=CVE-2026-64943">[CVE]</a> <a href="./CVE-2026-64943.cve.json">[CVE json]</a> <a href="./CVE-2026-64943.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-10-19T09:26:12.414Z</em></p>
+<h3 id="affected-11">Affected</h3>
+<ul>
+<li>Apache Answer through 2.0.2</li>
+</ul>
+<h3 id="description-11">Description</h3>
+<p>Insertion of Sensitive Information into Log File vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.2.</p>Full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials.<div><br><p>Users are recommended to upgrade to version 2.0.3, which fixes the issue.</p></div>
+<h3 id="references-11">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/gczojx5ypncn1x1pg9z1cphb54t23zzg">https://lists.apache.org/thread/gczojx5ypncn1x1pg9z1cphb54t23zzg</a></li>
+</ul>
+<h3 id="credits-11">Credits</h3>
+<ul>
+<li>meifukun (reporter)</li>
+</ul>
<h2 id="CVE-2026-60053">Residual Administrative API Key Access After Role or Account Revocation</h2>
<p>CVE-2026-60053 <a href="https://cve.org/CVERecord?id=CVE-2026-60053">[CVE]</a> <a href="./CVE-2026-60053.cve.json">[CVE json]</a> <a href="./CVE-2026-60053.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-05T15:13:06.027Z</em></p>
-<h3 id="affected">Affected</h3>
+<h3 id="affected-12">Affected</h3>
<ul>
<li>Apache Answer through 2.0.1</li>
</ul>
-<h3 id="description">Description</h3>
+<h3 id="description-12">Description</h3>
<p>Insufficient Session Expiration vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.1.</p>Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys were explicitly removed.<br><p>Users are recommended to upgrade to version 2.0.2, which fixes the issue.</p>
-<h3 id="references">References</h3>
+<h3 id="references-12">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/2vkcj3bdvso6cywnklt2vtkc2m4o0b5c">https://lists.apache.org/thread/2vkcj3bdvso6cywnklt2vtkc2m4o0b5c</a></li>
</ul>
-<h3 id="credits">Credits</h3>
+<h3 id="credits-12">Credits</h3>
<ul>
<li>yangxi (reporter)</li>
</ul>
<h2 id="CVE-2026-60023">Unauthorized disclosure of deleted or pending answer content</h2>
<p>CVE-2026-60023 <a href="https://cve.org/CVERecord?id=CVE-2026-60023">[CVE]</a> <a href="./CVE-2026-60023.cve.json">[CVE json]</a> <a href="./CVE-2026-60023.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-05T15:12:01.731Z</em></p>
-<h3 id="affected-1">Affected</h3>
+<h3 id="affected-13">Affected</h3>
<ul>
<li>Apache Answer through 2.0.1</li>
</ul>
-<h3 id="description-1">Description</h3>
+<h3 id="description-13">Description</h3>
<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.1.</p>Deleted or pending answers could be retrieved by unauthorized users through the single-answer read path when the parent question remained visible, exposing answer content that should not have been accessible.<br><p>Users are recommended to upgrade to version 2.0.2, which fixes the issue.</p>
-<h3 id="references-1">References</h3>
+<h3 id="references-13">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/rq3ygd0j9cchkbmh99dqf8624s7r8y49">https://lists.apache.org/thread/rq3ygd0j9cchkbmh99dqf8624s7r8y49</a></li>
</ul>
-<h3 id="credits-1">Credits</h3>
+<h3 id="credits-13">Credits</h3>
<ul>
<li>yangxi (reporter)</li>
</ul>
<h2 id="CVE-2026-50749">Missing authorization in revision audit reject allows authenticated users to reject pending revisions</h2>
<p>CVE-2026-50749 <a href="https://cve.org/CVERecord?id=CVE-2026-50749">[CVE]</a> <a href="./CVE-2026-50749.cve.json">[CVE json]</a> <a href="./CVE-2026-50749.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-05T15:11:00.104Z</em></p>
-<h3 id="affected-2">Affected</h3>
+<h3 id="affected-14">Affected</h3>
<ul>
<li>Apache Answer through 2.0.1</li>
</ul>
-<h3 id="description-2">Description</h3>
+<h3 id="description-14">Description</h3>
<p>Improper Authorization vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.1.</p>Any authenticated user can reject arbitrary pending edit-revisions without review permission due to a missing authorization check on the reject operation.<br><p>Users are recommended to upgrade to version 2.0.2, which fixes the issue.</p>
-<h3 id="references-2">References</h3>
+<h3 id="references-14">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/ogk461yr4w9o95k15bkjxk2kpbkrbnln">https://lists.apache.org/thread/ogk461yr4w9o95k15bkjxk2kpbkrbnln</a></li>
</ul>
-<h3 id="credits-2">Credits</h3>
+<h3 id="credits-14">Credits</h3>
<ul>
<li>tonghuaroot (reporter)</li>
<li>Mattia Campanelli (reporter)</li>
@@ -166,34 +371,34 @@
<h2 id="CVE-2026-48912">Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URL</h2>
<p>CVE-2026-48912 <a href="https://cve.org/CVERecord?id=CVE-2026-48912">[CVE]</a> <a href="./CVE-2026-48912.cve.json">[CVE json]</a> <a href="./CVE-2026-48912.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-05T15:10:03.446Z</em></p>
-<h3 id="affected-3">Affected</h3>
+<h3 id="affected-15">Affected</h3>
<ul>
<li>Apache Answer through 2.0.1</li>
</ul>
-<h3 id="description-3">Description</h3>
+<h3 id="description-15">Description</h3>
<p>Improper Input Validation vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.1.</p> A missing ownership check in the avatar-cleanup logic allows any authenticated user to delete other users' uploaded files by supplying their file URLs.<br><p>Users are recommended to upgrade to version 2.0.2, which fixes the issue.</p>
-<h3 id="references-3">References</h3>
+<h3 id="references-15">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/b9jnttmspd9kp4vgbvb32dcqb4201flq">https://lists.apache.org/thread/b9jnttmspd9kp4vgbvb32dcqb4201flq</a></li>
</ul>
-<h3 id="credits-3">Credits</h3>
+<h3 id="credits-15">Credits</h3>
<ul>
<li>tonghuaroot (reporter)</li>
</ul>
<h2 id="CVE-2026-48911">Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow</h2>
<p>CVE-2026-48911 <a href="https://cve.org/CVERecord?id=CVE-2026-48911">[CVE]</a> <a href="./CVE-2026-48911.cve.json">[CVE json]</a> <a href="./CVE-2026-48911.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-05T15:09:10.774Z</em></p>
-<h3 id="affected-4">Affected</h3>
+<h3 id="affected-16">Affected</h3>
<ul>
<li>Apache Answer through 2.0.1</li>
</ul>
-<h3 id="description-4">Description</h3>
+<h3 id="description-16">Description</h3>
<p>Insufficient Verification of Data Authenticity vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.1.</p>A missing authorization check in the external-login email binding flow allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into clicking a crafted confirmation link.<br><p>Users are recommended to upgrade to version 2.0.2, which fixes the issue.</p>
-<h3 id="references-4">References</h3>
+<h3 id="references-16">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/mrlwtdnhqqgfbchjgq6rffkz67o8wyv8">https://lists.apache.org/thread/mrlwtdnhqqgfbchjgq6rffkz67o8wyv8</a></li>
</ul>
-<h3 id="credits-4">Credits</h3>
+<h3 id="credits-16">Credits</h3>
<ul>
<li>tonghuaroot (reporter)</li>
<li>yangxi (reporter)</li>
@@ -201,170 +406,170 @@
<h2 id="CVE-2026-48834">Denial of service via crafted Accept-Language header parsing</h2>
<p>CVE-2026-48834 <a href="https://cve.org/CVERecord?id=CVE-2026-48834">[CVE]</a> <a href="./CVE-2026-48834.cve.json">[CVE json]</a> <a href="./CVE-2026-48834.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-05T15:07:31.168Z</em></p>
-<h3 id="affected-5">Affected</h3>
+<h3 id="affected-17">Affected</h3>
<ul>
<li>Apache Answer through 2.0.1</li>
</ul>
-<h3 id="description-5">Description</h3>
+<h3 id="description-17">Description</h3>
<p>Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.1.</p>Unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing.<br><p>Users are recommended to upgrade to version 2.0.2, which fixes the issue.</p>
-<h3 id="references-5">References</h3>
+<h3 id="references-17">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/0yg5smwnbrhqs55m5h61gn42mcs8s95p">https://lists.apache.org/thread/0yg5smwnbrhqs55m5h61gn42mcs8s95p</a></li>
</ul>
-<h3 id="credits-5">Credits</h3>
+<h3 id="credits-17">Credits</h3>
<ul>
<li>tonghuaroot (reporter)</li>
</ul>
<h2 id="CVE-2026-34905">Unlisted Questions Accessible via Direct API Access</h2>
<p>CVE-2026-34905 <a href="https://cve.org/CVERecord?id=CVE-2026-34905">[CVE]</a> <a href="./CVE-2026-34905.cve.json">[CVE json]</a> <a href="./CVE-2026-34905.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-09T07:35:55.677Z</em></p>
-<h3 id="affected-6">Affected</h3>
+<h3 id="affected-18">Affected</h3>
<ul>
<li>Apache Answer through 2.0.0</li>
</ul>
-<h3 id="description-6">Description</h3>
+<h3 id="description-18">Description</h3>
<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.0.</p>The unlisted question feature did not enforce access restrictions on direct API endpoints, allowing authenticated users to discover and access unlisted questions, their answers, comments, and revision history.<br><p>Users are recommended to upgrade to version 2.0.1, which fixes the issue.</p>
-<h3 id="references-6">References</h3>
+<h3 id="references-18">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/khxoft96sptr2kh0cpzgw7f6qwv0ltcf">https://lists.apache.org/thread/khxoft96sptr2kh0cpzgw7f6qwv0ltcf</a></li>
</ul>
-<h3 id="credits-6">Credits</h3>
+<h3 id="credits-18">Credits</h3>
<ul>
<li>Hamed Kohi (reporter)</li>
</ul>
<h2 id="CVE-2026-34033">HTML Content Injection in Email</h2>
<p>CVE-2026-34033 <a href="https://cve.org/CVERecord?id=CVE-2026-34033">[CVE]</a> <a href="./CVE-2026-34033.cve.json">[CVE json]</a> <a href="./CVE-2026-34033.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-09T07:35:14.622Z</em></p>
-<h3 id="affected-7">Affected</h3>
+<h3 id="affected-19">Affected</h3>
<ul>
<li>Apache Answer through 2.0.0</li>
</ul>
-<h3 id="description-7">Description</h3>
+<h3 id="description-19">Description</h3>
<p>Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.0.</p>User-supplied content was included in notification emails without proper escaping, allowing authenticated users to inject arbitrary HTML into emails sent to other users.<br><p>Users are recommended to upgrade to version 2.0.1, which fixes the issue.</p>
-<h3 id="references-7">References</h3>
+<h3 id="references-19">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/wrfd9blbfotfg479jr8vlwfx6pwr9sgj">https://lists.apache.org/thread/wrfd9blbfotfg479jr8vlwfx6pwr9sgj</a></li>
</ul>
-<h3 id="credits-7">Credits</h3>
+<h3 id="credits-19">Credits</h3>
<ul>
<li>Reimar Fritz (reporter)</li>
</ul>
<h2 id="CVE-2026-34031">The custom avatar was not properly validated</h2>
<p>CVE-2026-34031 <a href="https://cve.org/CVERecord?id=CVE-2026-34031">[CVE]</a> <a href="./CVE-2026-34031.cve.json">[CVE json]</a> <a href="./CVE-2026-34031.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-09T07:34:37.370Z</em></p>
-<h3 id="affected-8">Affected</h3>
+<h3 id="affected-20">Affected</h3>
<ul>
<li>Apache Answer through 2.0.0</li>
</ul>
-<h3 id="description-8">Description</h3>
+<h3 id="description-20">Description</h3>
<p>Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.0.</p>The server did not sufficiently validate user-supplied image URLs, allowing arbitrary external content to be embedded as profile images, which could expose users to unintended external requests and tracking by third-party servers.<br><p>Users are recommended to upgrade to version 2.0.1, which fixes the issue.</p>
-<h3 id="references-8">References</h3>
+<h3 id="references-20">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/rwtxy39t54to9kv3dqtbjsbdpyk4jkd2">https://lists.apache.org/thread/rwtxy39t54to9kv3dqtbjsbdpyk4jkd2</a></li>
</ul>
-<h3 id="credits-8">Credits</h3>
+<h3 id="credits-20">Credits</h3>
<ul>
<li>Reimar Fritz (reporter)</li>
</ul>
<h2 id="CVE-2026-33582">Uploading specially crafted TIFF files causes an Out-of-Memory error</h2>
<p>CVE-2026-33582 <a href="https://cve.org/CVERecord?id=CVE-2026-33582">[CVE]</a> <a href="./CVE-2026-33582.cve.json">[CVE json]</a> <a href="./CVE-2026-33582.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-09T07:34:00.786Z</em></p>
-<h3 id="affected-9">Affected</h3>
+<h3 id="affected-21">Affected</h3>
<ul>
<li>Apache Answer through 2.0.0</li>
</ul>
-<h3 id="description-9">Description</h3>
+<h3 id="description-21">Description</h3>
<p>Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.0.</p>A crafted TIFF image could trigger excessive memory allocation during image decoding, allowing an authenticated user to cause the server process to crash.<br><p>Users are recommended to upgrade to version 2.0.1, which fixes the issue.</p>
-<h3 id="references-9">References</h3>
+<h3 id="references-21">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/3sgpx4cwsgpnt66xv3cqvtc8z4st1kbq">https://lists.apache.org/thread/3sgpx4cwsgpnt66xv3cqvtc8z4st1kbq</a></li>
</ul>
-<h3 id="credits-9">Credits</h3>
+<h3 id="credits-21">Credits</h3>
<ul>
<li>Andy Gill, ZephrSec Ltd (reporter)</li>
</ul>
<h2 id="CVE-2026-25700">AdminToken not invalidated after admin deactivation</h2>
<p>CVE-2026-25700 <a href="https://cve.org/CVERecord?id=CVE-2026-25700">[CVE]</a> <a href="./CVE-2026-25700.cve.json">[CVE json]</a> <a href="./CVE-2026-25700.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-10T14:56:58.543Z</em></p>
-<h3 id="affected-10">Affected</h3>
+<h3 id="affected-22">Affected</h3>
<ul>
<li>Apache Answer through 2.0.0</li>
</ul>
-<h3 id="description-10">Description</h3>
+<h3 id="description-22">Description</h3>
<p>Improper Restriction of Security Token Assignment vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.0.</p>Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired.<br><p>Users are recommended to upgrade to version 2.0.1, which fixes the issue.</p>
-<h3 id="references-10">References</h3>
+<h3 id="references-22">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/ftw52mlxknjm29vo1mnqovj53z2kh96y">https://lists.apache.org/thread/ftw52mlxknjm29vo1mnqovj53z2kh96y</a></li>
</ul>
-<h3 id="credits-10">Credits</h3>
+<h3 id="credits-22">Credits</h3>
<ul>
<li>Sho Odagiri (reporter)</li>
</ul>
<h2 id="CVE-2026-25699">Authorization Bypass in Timeline API</h2>
<p>CVE-2026-25699 <a href="https://cve.org/CVERecord?id=CVE-2026-25699">[CVE]</a> <a href="./CVE-2026-25699.cve.json">[CVE json]</a> <a href="./CVE-2026-25699.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-09T07:33:11.641Z</em></p>
-<h3 id="affected-11">Affected</h3>
+<h3 id="affected-23">Affected</h3>
<ul>
<li>Apache Answer through 2.0.0</li>
</ul>
-<h3 id="description-11">Description</h3>
+<h3 id="description-23">Description</h3>
<p>Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.0.</p>Timeline-related APIs lacked proper authorization checks, allowing regular authenticated users to access deleted, private, or unapproved content and its revision history.<br><p>Users are recommended to upgrade to version 2.0.1, which fixes the issue.</p>
-<h3 id="references-11">References</h3>
+<h3 id="references-23">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/c36k4hzwhncqo0qfn5fg57f1gkjhyfv8">https://lists.apache.org/thread/c36k4hzwhncqo0qfn5fg57f1gkjhyfv8</a></li>
</ul>
-<h3 id="credits-11">Credits</h3>
+<h3 id="credits-23">Credits</h3>
<ul>
<li>Sho Odagiri (reporter)</li>
</ul>
<h2 id="CVE-2026-25688">XSS in AI Answer Rendering</h2>
<p>CVE-2026-25688 <a href="https://cve.org/CVERecord?id=CVE-2026-25688">[CVE]</a> <a href="./CVE-2026-25688.cve.json">[CVE json]</a> <a href="./CVE-2026-25688.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-09T07:32:22.140Z</em></p>
-<h3 id="affected-12">Affected</h3>
+<h3 id="affected-24">Affected</h3>
<ul>
<li>Apache Answer through 2.0.0</li>
</ul>
-<h3 id="description-12">Description</h3>
+<h3 id="description-24">Description</h3>
<p>Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 2.0.0.</p>AI-generated response content was rendered in the browser without proper sanitization, allowing malicious scripts to be executed when the content was viewed.<br><p>Users are recommended to upgrade to version 2.0.1, which fixes the issue.</p>
-<h3 id="references-12">References</h3>
+<h3 id="references-24">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/x42joj43rqb38ms5q60f7bgq3qbo7t5q">https://lists.apache.org/thread/x42joj43rqb38ms5q60f7bgq3qbo7t5q</a></li>
</ul>
-<h3 id="credits-12">Credits</h3>
+<h3 id="credits-24">Credits</h3>
<ul>
<li>Sho Odagiri (reporter)</li>
</ul>
<h2 id="CVE-2026-24735">Revision API Improper Access Control leads to Information Disclosure</h2>
<p>CVE-2026-24735 <a href="https://cve.org/CVERecord?id=CVE-2026-24735">[CVE]</a> <a href="./CVE-2026-24735.cve.json">[CVE json]</a> <a href="./CVE-2026-24735.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-03T06:48:19.838Z</em></p>
-<h3 id="affected-13">Affected</h3>
+<h3 id="affected-25">Affected</h3>
<ul>
<li>Apache Answer through 1.7.1</li>
</ul>
-<h3 id="description-13">Description</h3>
+<h3 id="description-25">Description</h3>
<p>Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 1.7.1.</p>An unauthenticated API endpoint incorrectly exposes full revision history for deleted content. This allows unauthorized user to retrieve restricted or sensitive information.<br><p>Users are recommended to upgrade to version 2.0.0, which fixes the issue.</p>
-<h3 id="references-13">References</h3>
+<h3 id="references-25">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/whxloom7mpxlyt5wzdskflsg5mzdzd60">https://lists.apache.org/thread/whxloom7mpxlyt5wzdskflsg5mzdzd60</a></li>
</ul>
-<h3 id="credits-13">Credits</h3>
+<h3 id="credits-25">Credits</h3>
<ul>
<li>Sho Odagiri of GMO Cybersecurity by Ierae, Inc. (reporter)</li>
</ul>
<h2 id="CVE-2025-29868">Using externally referenced images can leak user privacy.</h2>
<p>CVE-2025-29868 <a href="https://cve.org/CVERecord?id=CVE-2025-29868">[CVE]</a> <a href="./CVE-2025-29868.cve.json">[CVE json]</a> <a href="./CVE-2025-29868.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-04-01T07:56:26.883Z</em></p>
-<h3 id="affected-14">Affected</h3>
+<h3 id="affected-26">Affected</h3>
<ul>
<li>Apache Answer through 1.4.2</li>
</ul>
-<h3 id="description-14">Description</h3>
+<h3 id="description-26">Description</h3>
<p>Private Data Structure Returned From A Public Method vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 1.4.2.</p>If a user uses an externally referenced image, when a user accesses this image, the provider of the image may obtain private information about the ip address of that accessing user.<br><p>Users are recommended to upgrade to version 1.4.5, which fixes the issue. In the new version, administrators can set whether external content can be disp [...]
-<h3 id="references-14">References</h3>
+<h3 id="references-26">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/l7pohw5g03g3qsvrz8pqc9t29mdv5lhf">https://lists.apache.org/thread/l7pohw5g03g3qsvrz8pqc9t29mdv5lhf</a></li>
</ul>
-<h3 id="credits-14">Credits</h3>
+<h3 id="credits-26">Credits</h3>
<ul>
<li>Hamed Kohi (reporter)</li>
<li>Luke Smith (reporter)</li>
@@ -372,153 +577,153 @@
<h2 id="CVE-2024-45719">Predictable Authorization Token Using UUIDv1</h2>
<p>CVE-2024-45719 <a href="https://cve.org/CVERecord?id=CVE-2024-45719">[CVE]</a> <a href="./CVE-2024-45719.cve.json">[CVE json]</a> <a href="./CVE-2024-45719.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-11-22T14:36:42.714Z</em></p>
-<h3 id="affected-15">Affected</h3>
+<h3 id="affected-27">Affected</h3>
<ul>
<li>Apache Answer through 1.4.0</li>
</ul>
-<h3 id="description-15">Description</h3>
+<h3 id="description-27">Description</h3>
<p>Inadequate Encryption Strength vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 1.4.0.</p>The ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable.<br><p>Users are recommended to upgrade to version 1.4.1, which fixes the issue.</p>
-<h3 id="references-15">References</h3>
+<h3 id="references-27">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/sz2d0z39k01nbx3r9pj65t76o1hy9491">https://lists.apache.org/thread/sz2d0z39k01nbx3r9pj65t76o1hy9491</a></li>
</ul>
-<h3 id="credits-15">Credits</h3>
+<h3 id="credits-27">Credits</h3>
<ul>
<li>Chi Tran from Eevee (reporter)</li>
</ul>
<h2 id="CVE-2024-41890">The link to reset the user’s password will remain valid after sending a new link</h2>
<p>CVE-2024-41890 <a href="https://cve.org/CVERecord?id=CVE-2024-41890">[CVE]</a> <a href="./CVE-2024-41890.cve.json">[CVE json]</a> <a href="./CVE-2024-41890.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-08-09T14:53:26.714Z</em></p>
-<h3 id="affected-16">Affected</h3>
+<h3 id="affected-28">Affected</h3>
<ul>
<li>Apache Answer through 1.3.5</li>
</ul>
-<h3 id="description-16">Description</h3>
+<h3 id="description-28">Description</h3>
<p>Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 1.3.5.</p>User sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused or hijacked.<br><p>Users are recommended to upgrade to version 1.3.6, which fixes the issue.</p>
-<h3 id="references-16">References</h3>
+<h3 id="references-28">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/j7c080xj31x8rvz1pyk2h47rdd9pwbv9">https://lists.apache.org/thread/j7c080xj31x8rvz1pyk2h47rdd9pwbv9</a></li>
</ul>
-<h3 id="credits-16">Credits</h3>
+<h3 id="credits-28">Credits</h3>
<ul>
<li>Mohammad Reza Omrani (reporter)</li>
</ul>
<h2 id="CVE-2024-41888">The link for resetting user password is not Single-Use</h2>
<p>CVE-2024-41888 <a href="https://cve.org/CVERecord?id=CVE-2024-41888">[CVE]</a> <a href="./CVE-2024-41888.cve.json">[CVE json]</a> <a href="./CVE-2024-41888.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-08-09T14:55:12.877Z</em></p>
-<h3 id="affected-17">Affected</h3>
+<h3 id="affected-29">Affected</h3>
<ul>
<li>Apache Answer through 1.3.5</li>
</ul>
-<h3 id="description-17">Description</h3>
+<h3 id="description-29">Description</h3>
<p>Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 1.3.5.</p>The password reset link remains valid within its expiration period even after it has been used. This could potentially lead to the link being misused or hijacked.<br><p>Users are recommended to upgrade to version 1.3.6, which fixes the issue.</p>
-<h3 id="references-17">References</h3>
+<h3 id="references-29">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/jbs1j2o9rqm5sc19jyk3jcfvkmfkmyf4">https://lists.apache.org/thread/jbs1j2o9rqm5sc19jyk3jcfvkmfkmyf4</a></li>
</ul>
-<h3 id="credits-17">Credits</h3>
+<h3 id="credits-29">Credits</h3>
<ul>
<li>Mohammad Reza Omrani (reporter)</li>
</ul>
<h2 id="CVE-2024-40761">Avatar URL leaked user email addresses</h2>
<p>CVE-2024-40761 <a href="https://cve.org/CVERecord?id=CVE-2024-40761">[CVE]</a> <a href="./CVE-2024-40761.cve.json">[CVE json]</a> <a href="./CVE-2024-40761.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-09-25T07:31:07.119Z</em></p>
-<h3 id="affected-18">Affected</h3>
+<h3 id="affected-30">Affected</h3>
<ul>
<li>Apache Answer through 1.3.5</li>
</ul>
-<h3 id="description-18">Description</h3>
+<h3 id="description-30">Description</h3>
<p>Inadequate Encryption Strength vulnerability in Apache Answer.</p><p>This issue affects Apache Answer: through 1.3.5.</p>Using the MD5 value of a user's email to access Gravatar is insecure and can lead to the leakage of user email. The official recommendation is to use SHA256 instead.<br><p>Users are recommended to upgrade to version 1.4.0, which fixes the issue.</p>
-<h3 id="references-18">References</h3>
+<h3 id="references-30">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/mmrhsfy16qwrw0pkv0p9kj40vy3sg08x">https://lists.apache.org/thread/mmrhsfy16qwrw0pkv0p9kj40vy3sg08x</a></li>
</ul>
-<h3 id="credits-18">Credits</h3>
+<h3 id="credits-30">Credits</h3>
<ul>
<li>张岳熙 (reporter)</li>
</ul>
<h2 id="CVE-2024-29217">XSS vulnerability when changing personal website</h2>
<p>CVE-2024-29217 <a href="https://cve.org/CVERecord?id=CVE-2024-29217">[CVE]</a> <a href="./CVE-2024-29217.cve.json">[CVE json]</a> <a href="./CVE-2024-29217.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-04-21T16:04:07.662Z</em></p>
-<h3 id="affected-19">Affected</h3>
+<h3 id="affected-31">Affected</h3>
<ul>
<li>Apache Answer before 1.3.0</li>
</ul>
-<h3 id="description-19">Description</h3>
+<h3 id="description-31">Description</h3>
<p>Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Apache Answer.<p>This issue affects Apache Answer: before 1.3.0.</p>XSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the website to create such an attack.<br><p>Users are recommended to upgrade to version [1.3.0], which fixes the issue.</p><p></p></p>
-<h3 id="references-19">References</h3>
+<h3 id="references-31">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/nc0g1borr0d3wx25jm39pn7nyf268n0x">https://lists.apache.org/thread/nc0g1borr0d3wx25jm39pn7nyf268n0x</a></li>
</ul>
-<h3 id="credits-19">Credits</h3>
+<h3 id="credits-31">Credits</h3>
<ul>
<li>Tsubasa Umeuchi (reporter)</li>
</ul>
<h2 id="CVE-2024-26578">Repeated submission at registration created duplicate users with the same name</h2>
<p>CVE-2024-26578 <a href="https://cve.org/CVERecord?id=CVE-2024-26578">[CVE]</a> <a href="./CVE-2024-26578.cve.json">[CVE json]</a> <a href="./CVE-2024-26578.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-02-22T09:28:11.636Z</em></p>
-<h3 id="affected-20">Affected</h3>
+<h3 id="affected-32">Affected</h3>
<ul>
<li>Apache Answer through 1.2.1</li>
</ul>
-<h3 id="description-20">Description</h3>
+<h3 id="description-32">Description</h3>
<p>Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’) vulnerability in Apache Answer.<p>This issue affects Apache Answer: through 1.2.1.</p>Repeated submission during registration resulted in the registration of the same user. When users register, if they rapidly submit multiple registrations using scripts, it can result in the creation of multiple user accounts simultaneously with the same name.<br><p>Users are recommended to upgrade [...]
-<h3 id="references-20">References</h3>
+<h3 id="references-32">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/ko0ksnznt2484lxt0zts2ygr82ldkhcb">https://lists.apache.org/thread/ko0ksnznt2484lxt0zts2ygr82ldkhcb</a></li>
</ul>
-<h3 id="credits-20">Credits</h3>
+<h3 id="credits-32">Credits</h3>
<ul>
<li>Mohammad Reza Omrani (reporter)</li>
</ul>
<h2 id="CVE-2024-23349">XSS vulnerability when submitting summary</h2>
<p>CVE-2024-23349 <a href="https://cve.org/CVERecord?id=CVE-2024-23349">[CVE]</a> <a href="./CVE-2024-23349.cve.json">[CVE json]</a> <a href="./CVE-2024-23349.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-02-22T09:48:18.347Z</em></p>
-<h3 id="affected-21">Affected</h3>
+<h3 id="affected-33">Affected</h3>
<ul>
<li>Apache Answer through 1.2.1</li>
</ul>
-<h3 id="description-21">Description</h3>
+<h3 id="description-33">Description</h3>
<p>Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Apache Answer.<p>This issue affects Apache Answer: through 1.2.1.</p>XSS attack when user enters summary. A logged-in user, when modifying their own submitted question, can input malicious code in the summary to create such an attack.<br><br><span style="background-color: var(--wht);">Users are recommended to upgrade to version [1.2.5], which fixes the issue.</span></p>
-<h3 id="references-21">References</h3>
+<h3 id="references-33">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/y5902t09vfgy7892z3vzr1zq900sgyqg">https://lists.apache.org/thread/y5902t09vfgy7892z3vzr1zq900sgyqg</a></li>
</ul>
-<h3 id="credits-21">Credits</h3>
+<h3 id="credits-33">Credits</h3>
<ul>
<li>Lyaa@JeeseenSec (reporter)</li>
</ul>
<h2 id="CVE-2024-22393">Pixel Flood Attack by uploading the large pixel file</h2>
<p>CVE-2024-22393 <a href="https://cve.org/CVERecord?id=CVE-2024-22393">[CVE]</a> <a href="./CVE-2024-22393.cve.json">[CVE json]</a> <a href="./CVE-2024-22393.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-02-22T09:51:41.833Z</em></p>
-<h3 id="affected-22">Affected</h3>
+<h3 id="affected-34">Affected</h3>
<ul>
<li>Apache Answer through 1.2.1</li>
</ul>
-<h3 id="description-22">Description</h3>
+<h3 id="description-34">Description</h3>
<p>Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.<p>This issue affects Apache Answer: through 1.2.1.</p>Pixel Flood Attack by uploading large pixel files will cause server out of memory. A logged-in user can cause such an attack by uploading an image when posting content.<br><p>Users are recommended to upgrade to version [1.2.5], which fixes the issue.</p></p>
-<h3 id="references-22">References</h3>
+<h3 id="references-34">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/f58l6dr4r74hl6o71gn47kmn44vw12cv">https://lists.apache.org/thread/f58l6dr4r74hl6o71gn47kmn44vw12cv</a></li>
</ul>
-<h3 id="credits-22">Credits</h3>
+<h3 id="credits-34">Credits</h3>
<ul>
<li>Mohammad Reza Omrani (reporter)</li>
</ul>
<h2 id="CVE-2023-49619">Repeated submissions using scripts resulted in an abnormal number of collections for questions.</h2>
<p>CVE-2023-49619 <a href="https://cve.org/CVERecord?id=CVE-2023-49619">[CVE]</a> <a href="./CVE-2023-49619.cve.json">[CVE json]</a> <a href="./CVE-2023-49619.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-01-10T08:24:57.576Z</em></p>
-<h3 id="affected-23">Affected</h3>
+<h3 id="affected-35">Affected</h3>
<ul>
<li>Apache Answer through 1.2.0</li>
</ul>
-<h3 id="description-23">Description</h3>
+<h3 id="description-35">Description</h3>
<p>Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’) vulnerability in Apache Answer.<br><br><span style="background-color: var(--wht);">This issue affects Apache Answer: through 1.2.0.<br><br></span><span style="background-color: rgb(255, 255, 255);">Under normal circumstances, a user can only bookmark a question once, and will only increase the number of questions bookmarked once. However, repeat submissions through the script can in [...]
-<h3 id="references-23">References</h3>
+<h3 id="references-35">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/nscrl3c7pn68q4j73y3ottql6n5x3hd4">https://lists.apache.org/thread/nscrl3c7pn68q4j73y3ottql6n5x3hd4</a></li>
</ul>
-<h3 id="credits-23">Credits</h3>
+<h3 id="credits-35">Credits</h3>
<ul>
<li>ek1ng (reporter)</li>
</ul>
diff --git a/projects/arrow/CVE-2026-92287.cve.json b/projects/arrow/CVE-2026-92287.cve.json
new file mode 100644
index 00000000..9528719d
--- /dev/null
+++ b/projects/arrow/CVE-2026-92287.cve.json
@@ -0,0 +1,125 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "product": "Apache Arrow C++",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThan": "26.0.0",
+ "status": "affected",
+ "version": "4.0.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "unaffected",
+ "version": "26.0.0",
+ "versionType": "semver"
+ }
+ ]
+ },
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:pypi/pyarrow",
+ "product": "PyArrow",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThan": "26.0.0",
+ "status": "affected",
+ "version": "8.0.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "unaffected",
+ "version": "26.0.0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "n0mi1k"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "<div>Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1.</div><div><br></div><div>This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation.</div><div><br></div><div>On the reader side, the KMS URL can be application-controlled (specified in the KmsConnectionConfig) or file-controlled.\nIf the user does not leverage application control for t [...]
+ }
+ ],
+ "value": "Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1.\n\n\n\n\nThis affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation.\n\n\n\n\nOn the reader side, the KMS URL can be application-controlled (specified in the\u00a0KmsConnectionConfig) or file-controlled.\nIf the user does not leverage application control for this parameter, a file-controlled KMS URL [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "moderate"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-20",
+ "description": "CWE-20 Improper input validation",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "issue-tracking"
+ ],
+ "url": "https://github.com/apache/arrow/issues/51349"
+ },
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/0t6vry0msbk9dpsd0xv395ov5b84hj57"
+ }
+ ],
+ "source": {
+ "discovery": "INTERNAL"
+ },
+ "title": "Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation",
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-92287",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/arrow/index.html b/projects/arrow/index.html
index 22635cf9..358e4b0a 100644
--- a/projects/arrow/index.html
+++ b/projects/arrow/index.html
@@ -109,33 +109,56 @@
</ul>
<h1 id="advisories">Advisories</h1>
<p class="bg-warning">This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the project security page linked above. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public <a href="/mailinglist">mailinglist</a> or privately on <a href="mailto:security@apache.org">security@apache.org</a></p>
+<h2 id="CVE-2026-92287">Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation</h2>
+<p>CVE-2026-92287 <a href="https://cve.org/CVERecord?id=CVE-2026-92287">[CVE]</a> <a href="./CVE-2026-92287.cve.json">[CVE json]</a></p>
+<p><em>Last updated: 2026-10-20T08:15:12.414Z</em></p>
+<h3 id="affected">Affected</h3>
+<ul>
+<li>Apache Arrow C++ from 4.0.0 before 26.0.0</li>
+<li>Apache Arrow C++ at 26.0.0 unaffected</li>
+<li>PyArrow from 8.0.0 before 26.0.0</li>
+<li>PyArrow at 26.0.0 unaffected</li>
+</ul>
+<h3 id="description">Description</h3>
+<div>Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1.</div><div><br></div><div>This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation.</div><div><br></div><div>On the reader side, the KMS URL can be application-controlled (specified in the KmsConnectionConfig) or file-controlled.
+If the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation.
+If the KMS implementation does not perform host validation and makes use of the provided KMS URL, a KMS token can be sent to a malicious host set by an attacker in the file. </div><div><br></div><div>Users are recommended to upgrade to version 26.0.0, which disables this behavior by default and requires that users opt-in to it by enabling the read_kms_url flag in the DecryptionConfiguration. Users of affected versions are recommended to either specify the KMS URL in the&nb [...]
+<h3 id="references">References</h3>
+<ul>
+<li><a href="https://github.com/apache/arrow/issues/51349">https://github.com/apache/arrow/issues/51349</a></li>
+<li><a href="https://lists.apache.org/thread/0t6vry0msbk9dpsd0xv395ov5b84hj57">https://lists.apache.org/thread/0t6vry0msbk9dpsd0xv395ov5b84hj57</a></li>
+</ul>
+<h3 id="credits">Credits</h3>
+<ul>
+<li>n0mi1k (finder)</li>
+</ul>
<h2 id="CVE-2026-25087">Potential use-after-free when reading IPC file with pre-buffering</h2>
<p>CVE-2026-25087 <a href="https://cve.org/CVERecord?id=CVE-2026-25087">[CVE]</a> <a href="./CVE-2026-25087.cve.json">[CVE json]</a></p>
<p><em>Last updated: 2026-02-20T09:56:40.992Z</em></p>
-<h3 id="affected">Affected</h3>
+<h3 id="affected-1">Affected</h3>
<ul>
<li>Apache Arrow from 15.0.0 through 23.0.0</li>
<li>Apache Arrow at 23.0.1 unaffected</li>
</ul>
-<h3 id="description">Description</h3>
+<h3 id="description-1">Description</h3>
<p>Use After Free vulnerability in Apache Arrow C++.</p><p>This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering enabled, if the IPC file contains data with variadic buffers (such as Binary View and String View data). Depending on the number of variadic buffers in a record batch column and on the temporal sequence of multi-threaded IO, a write to a dangling pointer could occur. The val [...]
-<h3 id="references">References</h3>
+<h3 id="references-1">References</h3>
<ul>
<li><a href="https://github.com/apache/arrow/pull/48925">https://github.com/apache/arrow/pull/48925</a></li>
<li><a href="https://lists.apache.org/thread/mpm4ld1qony30tchfpjtk5b11tcyvmwh">https://lists.apache.org/thread/mpm4ld1qony30tchfpjtk5b11tcyvmwh</a></li>
</ul>
-<h3 id="credits">Credits</h3>
+<h3 id="credits-1">Credits</h3>
<ul>
<li>Emi Galle (reporter)</li>
</ul>
<h2 id="CVE-2024-52338">Arbitrary code execution when loading a malicious data file</h2>
<p>CVE-2024-52338 <a href="https://cve.org/CVERecord?id=CVE-2024-52338">[CVE]</a> <a href="./CVE-2024-52338.cve.json">[CVE json]</a> <a href="./CVE-2024-52338.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-11-28T16:31:53.209Z</em></p>
-<h3 id="affected-1">Affected</h3>
+<h3 id="affected-2">Affected</h3>
<ul>
<li>Apache Arrow R package from 4.0.0 through 16.1.0</li>
</ul>
-<h3 id="description-1">Description</h3>
+<h3 id="description-2">Description</h3>
<p>Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it
reads Arrow IPC, Feather or Parquet data from untrusted sources (for
example, user-supplied input files). This vulnerability only affects the arrow R package, not other Apache Arrow
@@ -143,7 +166,7 @@ implementations or bindings unless those bindings are specifically used via the
is recommended that downstream libraries upgrade their dependency
requirements to arrow 17.0.0 or later. If using an affected
version of the package, untrusted data can read into a Table and its internal to_data_frame() method can be used as a workaround (e.g., read_parquet(..., as_data_frame = FALSE)$to_data_frame()).<br></p><p>This issue affects the Apache Arrow R package: from 4.0.0 through 16.1.0.<br></p><p>Users are recommended to upgrade to version 17.0.0, which fixes the issue.</p>
-<h3 id="references-1">References</h3>
+<h3 id="references-2">References</h3>
<ul>
<li><a href="https://github.com/apache/arrow/commit/801de2fbcf5bcbce0c019ed4b35ff3fc863b141b">https://github.com/apache/arrow/commit/801de2fbcf5bcbce0c019ed4b35ff3fc863b141b</a></li>
<li><a href="https://lists.apache.org/thread/0rcbvj1gdp15lvm23zm601tjpq0k25vt">https://lists.apache.org/thread/0rcbvj1gdp15lvm23zm601tjpq0k25vt</a></li>
@@ -151,37 +174,37 @@ version of the package, untrusted data can read into a Table and its internal to
<h2 id="CVE-2024-41178">AWS WebIdentityToken exposure in log files</h2>
<p>CVE-2024-41178 <a href="https://cve.org/CVERecord?id=CVE-2024-41178">[CVE]</a> <a href="./CVE-2024-41178.cve.json">[CVE json]</a> <a href="./CVE-2024-41178.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-07-23T17:07:57.878Z</em></p>
-<h3 id="affected-2">Affected</h3>
+<h3 id="affected-3">Affected</h3>
<ul>
<li>Apache Arrow Rust Object Store from 0.5.0 through 0.10.1</li>
</ul>
-<h3 id="description-2">Description</h3>
+<h3 id="description-3">Description</h3>
<p>Exposure of temporary credentials in logs in Apache Arrow Rust Object Store (<code>object_store</code> crate), version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. <br><br>On certain error conditions, the logs may contain the OIDC token passed to <a target="_blank" rel="nofollow" href="https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html">AssumeRoleWithWebIdentity</a>. This allows someone with access to the logs to impersonate that [...]
-<h3 id="references-2">References</h3>
+<h3 id="references-3">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/3t0povdppnt2czv6crlsqhvyko93kcrg">https://lists.apache.org/thread/3t0povdppnt2czv6crlsqhvyko93kcrg</a></li>
</ul>
-<h3 id="credits-1">Credits</h3>
+<h3 id="credits-2">Credits</h3>
<ul>
<li>Paul Hatcherian (finder)</li>
</ul>
<h2 id="CVE-2023-47248">Arbitrary code execution when loading a malicious data file</h2>
<p>CVE-2023-47248 <a href="https://cve.org/CVERecord?id=CVE-2023-47248">[CVE]</a> <a href="./CVE-2023-47248.cve.json">[CVE json]</a> <a href="./CVE-2023-47248.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-11-10T14:10:15.590Z</em></p>
-<h3 id="affected-3">Affected</h3>
+<h3 id="affected-4">Affected</h3>
<ul>
<li>PyArrow from 0.14.0 through 14.0.0</li>
<li>PyArrow from 0.14.0 through 14.0.0</li>
</ul>
-<h3 id="description-3">Description</h3>
+<h3 id="description-4">Description</h3>
<div>Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).</div><div><br></div><div>This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.<br></div><div><br></div><div>It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, [...]
-<h3 id="references-3">References</h3>
+<h3 id="references-4">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/yhy7tdfjf9hrl9vfrtzo8p2cyjq87v7n">https://lists.apache.org/thread/yhy7tdfjf9hrl9vfrtzo8p2cyjq87v7n</a></li>
<li><a href="https://github.com/apache/arrow/commit/f14170976372436ec1d03a724d8d3f3925484ecf">https://github.com/apache/arrow/commit/f14170976372436ec1d03a724d8d3f3925484ecf</a></li>
<li><a href="https://pypi.org/project/pyarrow-hotfix/">https://pypi.org/project/pyarrow-hotfix/</a></li>
</ul>
-<h3 id="credits-2">Credits</h3>
+<h3 id="credits-3">Credits</h3>
<ul>
<li>Li Jiakun - laoquanshi (finder)</li>
</ul>
diff --git a/projects/brpc/CVE-2026-48830.cve.json b/projects/brpc/CVE-2026-48830.cve.json
new file mode 100644
index 00000000..03945665
--- /dev/null
+++ b/projects/brpc/CVE-2026-48830.cve.json
@@ -0,0 +1,104 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:github/apache/brpc",
+ "platforms": [
+ "all"
+ ],
+ "product": "Apache bRPC",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "1.17.0",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ },
+ {
+ "status": "unaffected",
+ "version": "1.18.0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Brubbish of VARAS@IIE"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection.<br><br>When <code>ServerOptions.auth</code> is enabled and builtin HTTP services are exposed on the public listener, a builtin request received as the first message on a socket may cause the connection to be treated as auth [...]
+ }
+ ],
+ "value": "Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection.\n\nWhen ServerOptions.auth is enabled and builtin HTTP services are exposed on the public listener, a builtin request received as the first message on a socket may cause the connection to be treated as authenticated for later r [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "high"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-287",
+ "description": "CWE-287 Improper Authentication",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "HTTP builtin request can mark a connection authenticated and bypass auth for later requests",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-48830",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-54425.cve.json b/projects/brpc/CVE-2026-54425.cve.json
new file mode 100644
index 00000000..451538e2
--- /dev/null
+++ b/projects/brpc/CVE-2026-54425.cve.json
@@ -0,0 +1,96 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:github/apache/brpc",
+ "product": "Apache bRPC",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThan": "1.18.0",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "\u9ec4\u5b8f\u6d0b(Huang Hongyang)"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries. Each update was decoded by recursively invoking the HPACK decoder, which could exhaust the thread stack before a header field or end of input was reached.<br><br>Root Cause:<br>The bRPC HPACK decoder recursively decoded the next entr [...]
+ }
+ ],
+ "value": "Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries. Each update was decoded by recursively invoking the HPACK decoder, which could exhaust the thread stack before a header field or end of input was reached.\n\nRoot Cause:\nThe bRPC HPACK decoder recursively decoded the next entry after pr [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "high"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-674",
+ "description": "CWE-674 Uncontrolled Recursion",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-54425",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-54425.osv.json b/projects/brpc/CVE-2026-54425.osv.json
new file mode 100644
index 00000000..0be09c34
--- /dev/null
+++ b/projects/brpc/CVE-2026-54425.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-54425", "summary": "Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding", "details": "Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries. Each update was decoded by recursively invoking the HPACK decoder, which could exhaust the thread stack bef [...]
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-54426.cve.json b/projects/brpc/CVE-2026-54426.cve.json
new file mode 100644
index 00000000..c9ee7409
--- /dev/null
+++ b/projects/brpc/CVE-2026-54426.cve.json
@@ -0,0 +1,96 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:github/apache/brpc",
+ "product": "Apache bRPC",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThan": "1.18.0",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Nikko Enggaliano Pratama (nikkoenggaliano@gmail.com) on Github"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP array reply. The parser recursed once for each nested array level without enforcing a depth limit. The fix adds a configurable Redis reply depth limit with default value 128 and rejects replies exceeding that limit. <br><br>Affected Scenarios:<br>Applications using bRPC as a Redis [...]
+ }
+ ],
+ "value": "Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP array reply. The parser recursed once for each nested array level without enforcing a depth limit. The fix adds a configurable Redis reply depth limit with default value 128 and rejects replies exceeding that limit.\u00a0\n\nAffected Scenarios:\nApplications using bRPC as a Redis client with C [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "high"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-674",
+ "description": "CWE-674 Uncontrolled Recursion",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Stack Exhaustion via Unbounded Recursion in Redis Reply Parser",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-54426",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-54426.osv.json b/projects/brpc/CVE-2026-54426.osv.json
new file mode 100644
index 00000000..a526b22b
--- /dev/null
+++ b/projects/brpc/CVE-2026-54426.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-54426", "summary": "Stack Exhaustion via Unbounded Recursion in Redis Reply Parser", "details": "Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP array reply. The parser recursed once for each nested array level without enforcing a depth limit. The fix adds a configurable Redis reply depth limit with default value 128 [...]
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-54427.cve.json b/projects/brpc/CVE-2026-54427.cve.json
new file mode 100644
index 00000000..7060b15a
--- /dev/null
+++ b/projects/brpc/CVE-2026-54427.cve.json
@@ -0,0 +1,89 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:github/apache/brpc",
+ "product": "Apache bRPC",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThan": "1.18.0",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays. The parser recursively processed nested AMF containers without enforcing a depth limit, which could exhaust the native stack.<br><br>Affected Scenarios:<br>Applications using bRPC RTMP support and parsing AMF data from an untrusted RTMP peer. This includes RTMP servers parsing client command messages, [...]
+ }
+ ],
+ "value": "Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays. The parser recursively processed nested AMF containers without enforcing a depth limit, which could exhaust the native stack.\n\nAffected Scenarios:\nApplications using bRPC RTMP support and parsing AMF data from an untrusted RTMP peer. This includes RTMP servers parsing client command messages, RTMP clients [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "high"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-674",
+ "description": "CWE-674 Uncontrolled Recursion",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Stack Exhaustion via Unbounded Recursion in AMF Parser",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-54427",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-54427.osv.json b/projects/brpc/CVE-2026-54427.osv.json
new file mode 100644
index 00000000..2d6731d0
--- /dev/null
+++ b/projects/brpc/CVE-2026-54427.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-54427", "summary": "Stack Exhaustion via Unbounded Recursion in AMF Parser", "details": "Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays. The parser recursively processed nested AMF containers without enforcing a depth limit, which could exhaust the native stack.\n\nAffected Scenarios:\nApplications using bRPC RTMP support and parsi [...]
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-56386.cve.json b/projects/brpc/CVE-2026-56386.cve.json
new file mode 100644
index 00000000..24aa482c
--- /dev/null
+++ b/projects/brpc/CVE-2026-56386.cve.json
@@ -0,0 +1,102 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:github/apache/brpc",
+ "product": "Apache bRPC",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThan": "1.18.0",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Nikko Enggaliano Pratama"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload.<br><br>Root Cause:<br>The HTTP/2 DATA frame handler computed the fragment size from the attacker-controlled payload length and, when the PADDED flag was present, decremented the fragment size before ensuring that the f [...]
+ }
+ ],
+ "value": "Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload.\n\nRoot Cause:\nThe HTTP/2 DATA frame handler computed the fragment size from the attacker-controlled payload length and, when the PADDED flag was present, decremented the fragment size before ensuring that the frame conta [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "high"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-191",
+ "description": "CWE-191 Integer Underflow",
+ "lang": "en",
+ "type": "CWE"
+ },
+ {
+ "cweId": "CWE-125",
+ "description": "CWE-125 Out-of-bounds Read",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-56386",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-56386.osv.json b/projects/brpc/CVE-2026-56386.osv.json
new file mode 100644
index 00000000..987f6cb2
--- /dev/null
+++ b/projects/brpc/CVE-2026-56386.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-56386", "summary": "Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser", "details": "Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload.\n\nRoot Cause:\nThe HTTP/2 DATA frame handler computed the fragment size from the attacker-cont [...]
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-56387.cve.json b/projects/brpc/CVE-2026-56387.cve.json
new file mode 100644
index 00000000..e2a5953b
--- /dev/null
+++ b/projects/brpc/CVE-2026-56387.cve.json
@@ -0,0 +1,107 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:github/apache/brpc",
+ "product": "Apache bRPC",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThan": "1.18.0",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Nikko Enggaliano Pratama"
+ },
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "73Lab of Qingteng.cn"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a bRPC server with RTMP enabled can send a small AMF payload with an excessive declared long string length or array count, causing excessive memory allocation or resource consumption before the parser rejects the incomplete payload.<br><br>Root Cause:<br>The AMF long string parser resized the destination stri [...]
+ }
+ ],
+ "value": "The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a bRPC server with RTMP enabled can send a small AMF payload with an excessive declared long string length or array count, causing excessive memory allocation or resource consumption before the parser rejects the incomplete payload.\n\nRoot Cause:\nThe AMF long string parser resized the destination string to the [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "high"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-789",
+ "description": "CWE-789 Memory Allocation with Excessive Size Value",
+ "lang": "en",
+ "type": "CWE"
+ },
+ {
+ "cweId": "CWE-770",
+ "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Remote Memory Exhaustion in RTMP AMF Parser",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-56387",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-56387.osv.json b/projects/brpc/CVE-2026-56387.osv.json
new file mode 100644
index 00000000..1479ace1
--- /dev/null
+++ b/projects/brpc/CVE-2026-56387.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-56387", "summary": "Remote Memory Exhaustion in RTMP AMF Parser", "details": "The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a bRPC server with RTMP enabled can send a small AMF payload with an excessive declared long string length or array count, causing excessive memory allocation or resource consumption before the parser rejects the [...]
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-56388.cve.json b/projects/brpc/CVE-2026-56388.cve.json
new file mode 100644
index 00000000..b11278df
--- /dev/null
+++ b/projects/brpc/CVE-2026-56388.cve.json
@@ -0,0 +1,108 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:github/apache/brpc",
+ "product": "Apache bRPC",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThan": "1.18.0",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Nikko Enggaliano Pratama"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a bRPC server with Redis service enabled can send an empty array header followed by a bulk string, causing an out-of-bounds write in the parser and crashing the process.<br><br>Root Cause:<br>RedisCommandParser::ConsumeImpl rejected negative RESP array counts but accepted zero. It resized the command argument vector to zer [...]
+ }
+ ],
+ "value": "The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a bRPC server with Redis service enabled can send an empty array header followed by a bulk string, causing an out-of-bounds write in the parser and crashing the process.\n\nRoot Cause:\nRedisCommandParser::ConsumeImpl rejected negative RESP array counts but accepted zero. It resized the command argument vector to zero elements [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "high"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-787",
+ "description": "CWE-787 Out-of-bounds Write",
+ "lang": "en",
+ "type": "CWE"
+ },
+ {
+ "cweId": "CWE-617",
+ "description": "CWE-617 Reachable Assertion",
+ "lang": "en",
+ "type": "CWE"
+ },
+ {
+ "cweId": "CWE-252",
+ "description": "CWE-252 Unchecked Return Value",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Out-of-Bounds Write in Redis Command Parser",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-56388",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-56388.osv.json b/projects/brpc/CVE-2026-56388.osv.json
new file mode 100644
index 00000000..3d314465
--- /dev/null
+++ b/projects/brpc/CVE-2026-56388.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-56388", "summary": "Out-of-Bounds Write in Redis Command Parser", "details": "The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a bRPC server with Redis service enabled can send an empty array header followed by a bulk string, causing an out-of-bounds write in the parser and crashing the process.\n\nRoot Cause:\nRedisCommandParser::ConsumeImpl rejected [...]
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-58064.cve.json b/projects/brpc/CVE-2026-58064.cve.json
new file mode 100644
index 00000000..9942b81b
--- /dev/null
+++ b/projects/brpc/CVE-2026-58064.cve.json
@@ -0,0 +1,96 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:github/apache/brpc",
+ "product": "Apache bRPC",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThan": "1.18.0",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "73Lab of Qingteng.cn"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "<div><div>The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was available. A remote attacker with access to a Redis-protocol bRPC service could send long inline inputs without a terminating CRLF to increase memory usage and CPU copy overhead, potentially causing denial of service.</div><br><div>Root Cause:<br>The Redis inline command parser alloc [...]
+ }
+ ],
+ "value": "The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was available. A remote attacker with access to a Redis-protocol bRPC service could send long inline inputs without a terminating CRLF to increase memory usage and CPU copy overhead, potentially causing denial of service.\n\n\nRoot Cause:\nThe Redis inline command parser allocated memory based on the [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "high"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-770",
+ "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Denial of Service via Unbounded Redis Inline Command Allocation",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-58064",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-58064.osv.json b/projects/brpc/CVE-2026-58064.osv.json
new file mode 100644
index 00000000..39a2a264
--- /dev/null
+++ b/projects/brpc/CVE-2026-58064.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-58064", "summary": "Denial of Service via Unbounded Redis Inline Command Allocation", "details": "The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was available. A remote attacker with access to a Redis-protocol bRPC service could send long inline inputs without a terminating CRLF to increase memory usage and CPU copy overhea [...]
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-61902.cve.json b/projects/brpc/CVE-2026-61902.cve.json
new file mode 100644
index 00000000..97d321b9
--- /dev/null
+++ b/projects/brpc/CVE-2026-61902.cve.json
@@ -0,0 +1,96 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:github/apache/brpc",
+ "product": "Apache bRPC",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThan": "1.18.0",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "BeaCox"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "<div><div>Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing.</div><div>A remote unauthenticated peer can cause an affected process to buffer message data beyond the configured limit, which may lead to memory exhaustion and denial of service. <br>Users should upgrade to 1.18.0 or apply the patch from PR <a target=\"_blank\" rel [...]
+ }
+ ],
+ "value": "Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing.\n\nA remote unauthenticated peer can cause an affected process to buffer message data beyond the configured limit, which may lead to memory exhaustion and denial of service. \nUsers should upgrade to 1.18.0 or apply the patch from PR https://github.com/apache/brpc/pull/3382 . The [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "medium"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-400",
+ "description": "CWE-400 Uncontrolled Resource Consumption",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Memory Exhaustion Through Inconsistent Message Body Limits",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-61902",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-61902.osv.json b/projects/brpc/CVE-2026-61902.osv.json
new file mode 100644
index 00000000..09d239a9
--- /dev/null
+++ b/projects/brpc/CVE-2026-61902.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-61902", "summary": "Memory Exhaustion Through Inconsistent Message Body Limits", "details": "Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing.\n\nA remote unauthenticated peer can cause an affected process to buffer message data beyond the configured limit, which may lead to memory exhaustion and denial of [...]
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-61916.cve.json b/projects/brpc/CVE-2026-61916.cve.json
new file mode 100644
index 00000000..a93e7d27
--- /dev/null
+++ b/projects/brpc/CVE-2026-61916.cve.json
@@ -0,0 +1,101 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:github/apache/brpc",
+ "platforms": [
+ "ARM64",
+ "RISC-V",
+ "other platforms where plain char is unsigned"
+ ],
+ "product": "Apache bRPC",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThan": "1.18.0",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Ubeddulla Khan"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain <code>char</code> is unsigned, such as ARM64, allow remote attackers to cause a process crash and denial of service by sending crafted input containing bytes with the high bit set.<br><br><strong>Root Cause:</strong><br>Two 256-entry lookup tables are accessed through pointers biased by 128 so that valid indices are in the range -128 [...]
+ }
+ ],
+ "value": "Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned, such as ARM64, allow remote attackers to cause a process crash and denial of service by sending crafted input containing bytes with the high bit set.\n\nRoot Cause:\nTwo 256-entry lookup tables are accessed through pointers biased by 128 so that valid indices are in the range -128 to 127. Input bytes are promoted from pl [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "moderate"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-125",
+ "description": "CWE-125 Out-of-bounds Read",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-61916",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-61916.osv.json b/projects/brpc/CVE-2026-61916.osv.json
new file mode 100644
index 00000000..a106bbb9
--- /dev/null
+++ b/projects/brpc/CVE-2026-61916.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-61916", "summary": "Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms", "details": "Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned, such as ARM64, allow remote attackers to cause a process crash and denial of service by sending crafted input containing bytes with the high bit set.\n\nRoot Cause:\nTwo 256-entry lookup [...]
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-66392.cve.json b/projects/brpc/CVE-2026-66392.cve.json
new file mode 100644
index 00000000..7b87b2bb
--- /dev/null
+++ b/projects/brpc/CVE-2026-66392.cve.json
@@ -0,0 +1,96 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:github/apache/brpc",
+ "product": "Apache bRPC",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThan": "1.18.0",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "ZenDuk"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "<div><div>Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, but do not bind the certificate to an expected DNS name or IP address. A network attacker who can redirect or intercept a connection and who possesses a certificate issued by a CA trusted by the client for another name may impersonate the requested TLS endpoint.</div><br><div>Affected Scenarios:<br>Applications use a bRPC client Channel [...]
+ }
+ ],
+ "value": "Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, but do not bind the certificate to an expected DNS name or IP address. A network attacker who can redirect or intercept a connection and who possesses a certificate issued by a CA trusted by the client for another name may impersonate the requested TLS endpoint.\n\n\nAffected Scenarios:\nApplications use a bRPC client Channel to connect to an untruste [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "Medium"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-297",
+ "description": "CWE-297 Improper Validation of Certificate with Host Mismatch",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "TLS Client Accepts Certificates for Mismatched Peer Names",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-66392",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-66392.osv.json b/projects/brpc/CVE-2026-66392.osv.json
new file mode 100644
index 00000000..a1258f4c
--- /dev/null
+++ b/projects/brpc/CVE-2026-66392.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-66392", "summary": "TLS Client Accepts Certificates for Mismatched Peer Names", "details": "Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, but do not bind the certificate to an expected DNS name or IP address. A network attacker who can redirect or intercept a connection and who possesses a certificate issued by a CA trusted by the client for another name may impersonate th [...]
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-74755.cve.json b/projects/brpc/CVE-2026-74755.cve.json
new file mode 100644
index 00000000..5f9fc044
--- /dev/null
+++ b/projects/brpc/CVE-2026-74755.cve.json
@@ -0,0 +1,96 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:github/apache/brpc",
+ "product": "Apache bRPC",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThan": "1.18.0",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Feng Zhijie (Independent security researcher)"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value_size. The UnparsedValue::as_string() function computes `_size - 1` without validating `_size`; when value_size is 0 the expression underflows to SIZE_MAX, resize() throws std::length_error, and because the exception is not caught on the request parsing p [...]
+ }
+ ],
+ "value": "An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value_size. The UnparsedValue::as_string() function computes `_size - 1` without validating `_size`; when value_size is 0 the expression underflows to SIZE_MAX, resize() throws std::length_error, and because the exception is not caught on the request parsing path the [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "moderate"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-191",
+ "description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Integer Underflow in mcpack2pb Parser Leading to Denial of Service",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-74755",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-74755.osv.json b/projects/brpc/CVE-2026-74755.osv.json
new file mode 100644
index 00000000..7e2927f9
--- /dev/null
+++ b/projects/brpc/CVE-2026-74755.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-74755", "summary": "Integer Underflow in mcpack2pb Parser Leading to Denial of Service", "details": "An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value_size. The UnparsedValue::as_string() function computes `_size - 1` without validating `_size`; when value_size is 0 the expression under [...]
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-74757.cve.json b/projects/brpc/CVE-2026-74757.cve.json
new file mode 100644
index 00000000..274ff636
--- /dev/null
+++ b/projects/brpc/CVE-2026-74757.cve.json
@@ -0,0 +1,96 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:github/apache/brpc",
+ "product": "Apache bRPC",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThan": "1.18.0",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Feng Zhijie (Dopamine)"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server allocate a large amount of memory via sending a crafted mcpack request with a huge array item count.<br><br>Root Cause:<br>The bRPC mcpack2pb parser trusts the item count stored in the mcpack array header without validating it against the actual payload size. The code generated by the mcpack2pb protoc plu [...]
+ }
+ ],
+ "value": "Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server allocate a large amount of memory via sending a crafted mcpack request with a huge array item count.\n\nRoot Cause:\nThe bRPC\u00a0mcpack2pb parser trusts the item count stored in the mcpack array header without validating it against the actual payload size. The code generated by the mcpack2pb protoc plugin uses this [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "high"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-770",
+ "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Uncontrolled Memory Allocation via Malicious mcpack Array Item Count",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-74757",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-74757.osv.json b/projects/brpc/CVE-2026-74757.osv.json
new file mode 100644
index 00000000..d9e4322e
--- /dev/null
+++ b/projects/brpc/CVE-2026-74757.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-74757", "summary": "Uncontrolled Memory Allocation via Malicious mcpack Array Item Count", "details": "Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server allocate a large amount of memory via sending a crafted mcpack request with a huge array item count.\n\nRoot Cause:\nThe bRPC mcpack2pb parser trusts the item count stored in the mcpack array [...]
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-74758.cve.json b/projects/brpc/CVE-2026-74758.cve.json
new file mode 100644
index 00000000..61019cfd
--- /dev/null
+++ b/projects/brpc/CVE-2026-74758.cve.json
@@ -0,0 +1,96 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:github/apache/brpc",
+ "product": "Apache bRPC",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThan": "1.18.0",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Feng Zhijie (Dopamine)"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required.<br><br>Root Cause:<br>When an RTMP Abort control message names the chunk stream that is currently being parsed (the chunk stream carrying the message itself), RtmpChunkStream::OnAbortMessage calls RtmpContext::ClearChunk [...]
+ }
+ ],
+ "value": "A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required.\n\nRoot Cause:\nWhen an RTMP Abort control message names the chunk stream that is currently being parsed (the chunk stream carrying the message itself), RtmpChunkStream::OnAbortMessage calls RtmpContext::ClearChunkStream, which [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "high"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-416",
+ "description": "CWE-416 Use After Free",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Heap Use-After-Free in RTMP Abort Message Handling",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-74758",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-74758.osv.json b/projects/brpc/CVE-2026-74758.osv.json
new file mode 100644
index 00000000..aea22664
--- /dev/null
+++ b/projects/brpc/CVE-2026-74758.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-74758", "summary": "Heap Use-After-Free in RTMP Abort Message Handling", "details": "A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required.\n\nRoot Cause:\nWhen an RTMP Abort control message names the chunk stream that is currently being parsed (the chunk st [...]
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-78048.cve.json b/projects/brpc/CVE-2026-78048.cve.json
new file mode 100644
index 00000000..e88b9554
--- /dev/null
+++ b/projects/brpc/CVE-2026-78048.cve.json
@@ -0,0 +1,96 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:github/apache/brpc",
+ "product": "Apache bRPC",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThan": "1.18.0",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "ubeddulla khan"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a crafted sequence of HPACK headers, resulting in a denial of service.<br><br>Root Cause:<br>In src/brpc/details/hpack.cpp, IndexTable::Init sizes the dynamic-table ring buffer as num_headers = max_size / (32 + 2), i.e. it assumes a minimum table entry [...]
+ }
+ ],
+ "value": "A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a crafted sequence of HPACK headers, resulting in a denial of service.\n\nRoot Cause:\nIn src/brpc/details/hpack.cpp, IndexTable::Init sizes the dynamic-table ring buffer as num_headers = max_size / (32 + 2), i.e. it assumes a minimum table entry of 34 bytes ( [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "high"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-617",
+ "description": "CWE-617 Reachable Assertion",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Decoder",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-78048",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-78048.osv.json b/projects/brpc/CVE-2026-78048.osv.json
new file mode 100644
index 00000000..1534ab0a
--- /dev/null
+++ b/projects/brpc/CVE-2026-78048.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-78048", "summary": "Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Decoder", "details": "A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a crafted sequence of HPACK headers, resulting in a denial of service.\n\nRoot Cause:\nIn src/brpc/details/hpack.cpp, Ind [...]
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-78058.cve.json b/projects/brpc/CVE-2026-78058.cve.json
new file mode 100644
index 00000000..1ff426ab
--- /dev/null
+++ b/projects/brpc/CVE-2026-78058.cve.json
@@ -0,0 +1,106 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:github/apache/brpc",
+ "product": "Apache bRPC",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThan": "1.18.0",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Claude"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms allows a remote unauthenticated attacker to crash the server or grow its memory without bound by sending crafted HTTP/2 frames.<br><br>Root Cause:<br>The h2 parser, enabled by default on every bRPC server port and used by h2/gRPC clients, trusts the peer to respect receive-side limits that bRPC advertises but never enforces:<br>1. SETTINGS_MAX_CO [...]
+ }
+ ],
+ "value": "Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms allows a remote unauthenticated attacker to crash the server or grow its memory without bound by sending crafted HTTP/2 frames.\n\nRoot Cause:\nThe h2 parser, enabled by default on every bRPC server port and used by h2/gRPC clients, trusts the peer to respect receive-side limits that bRPC advertises but never enforces:\n1. SETTINGS_MAX_CONCURRENT_STREAM [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "high"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-400",
+ "description": "CWE-400 Uncontrolled Resource Consumption",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ },
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-476",
+ "description": "CWE-476 NULL Pointer Dereference",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "title": "Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-78058",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-78058.osv.json b/projects/brpc/CVE-2026-78058.osv.json
new file mode 100644
index 00000000..fc29cad8
--- /dev/null
+++ b/projects/brpc/CVE-2026-78058.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-78058", "summary": "Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path", "details": "Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms allows a remote unauthenticated attacker to crash the server or grow its memory without bound by sending crafted HTTP/2 frames.\n\nRoot Cause:\nThe h2 parser, enabled by default on every bRPC server port and used by h2/gRPC clien [...]
\ No newline at end of file
diff --git a/projects/brpc/CVE-2026-78066.cve.json b/projects/brpc/CVE-2026-78066.cve.json
new file mode 100644
index 00000000..70b7d020
--- /dev/null
+++ b/projects/brpc/CVE-2026-78066.cve.json
@@ -0,0 +1,96 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:github/apache/brpc",
+ "product": "Apache bRPC",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThan": "1.18.0",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Claude"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process.<br><br>Root Cause:<br>1) The gzip/zlib/snappy decompressors enforce no output limit: -max_body_size is checked against the compressed bytes only, so a cap-compliant body (e.g.  [...]
+ }
+ ],
+ "value": "Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process.\n\nRoot Cause:\n1) The gzip/zlib/snappy decompressors enforce no output limit: -max_body_size is checked against the compressed bytes only, so a cap-compliant body (e.g.\u00a064\u00a0MiB) [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "high"
+ },
+ "type": "Textual description of severity"
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-770",
+ "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
+ "lang": "en",
+ "type": "CWE"
... 39993 lines suppressed ...