You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@security.apache.org by gi...@apache.org on 2026/08/24 11:47:01 UTC
(security-site) branch asf-site updated: Updated site from main (60118774f2963504bc674c4e2788d2f2197f4ca3)
This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/security-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new 47a072c0 Updated site from main (60118774f2963504bc674c4e2788d2f2197f4ca3)
47a072c0 is described below
commit 47a072c0e4a55d31ec214909acd1a03e8007ffda
Author: jenkins <bu...@apache.org>
AuthorDate: Mon Aug 24 11:46:58 2026 +0000
Updated site from main (60118774f2963504bc674c4e2788d2f2197f4ca3)
built by https://ci-builds.apache.org/job/Security/job/site/job/main/
---
projects/airflow/CVE-2026-54183.cve.json | 108 ++
projects/airflow/CVE-2026-54183.osv.json | 1 +
projects/airflow/CVE-2026-58076.cve.json | 108 ++
projects/airflow/CVE-2026-58076.osv.json | 1 +
projects/airflow/CVE-2026-59242.cve.json | 102 ++
projects/airflow/CVE-2026-59242.osv.json | 1 +
projects/airflow/CVE-2026-59244.cve.json | 102 ++
projects/airflow/CVE-2026-59244.osv.json | 1 +
projects/airflow/CVE-2026-65017.cve.json | 114 ++
projects/airflow/CVE-2026-65017.osv.json | 1 +
projects/airflow/CVE-2026-67260.cve.json | 108 ++
projects/airflow/CVE-2026-67260.osv.json | 1 +
projects/airflow/CVE-2026-67587.cve.json | 114 ++
projects/airflow/CVE-2026-67587.osv.json | 1 +
projects/airflow/CVE-2026-68076.cve.json | 108 ++
projects/airflow/CVE-2026-68076.osv.json | 1 +
projects/airflow/CVE-2026-68868.cve.json | 102 ++
projects/airflow/CVE-2026-68868.osv.json | 1 +
projects/airflow/CVE-2026-68870.cve.json | 108 ++
projects/airflow/CVE-2026-68870.osv.json | 1 +
projects/airflow/CVE-2026-68871.cve.json | 102 ++
projects/airflow/CVE-2026-68871.osv.json | 1 +
projects/airflow/CVE-2026-68872.cve.json | 102 ++
projects/airflow/CVE-2026-68872.osv.json | 1 +
projects/airflow/CVE-2026-68968.cve.json | 102 ++
projects/airflow/CVE-2026-68968.osv.json | 1 +
projects/airflow/CVE-2026-68969.cve.json | 108 ++
projects/airflow/CVE-2026-68969.osv.json | 1 +
projects/airflow/CVE-2026-68970.cve.json | 108 ++
projects/airflow/CVE-2026-68970.osv.json | 1 +
projects/airflow/CVE-2026-68971.cve.json | 102 ++
projects/airflow/CVE-2026-68971.osv.json | 1 +
projects/airflow/index.html | 1673 ++++++++++++++---------
projects/allura/CVE-2026-69223.cve.json | 85 ++
projects/allura/CVE-2026-69223.osv.json | 1 +
projects/allura/CVE-2026-73237.cve.json | 85 ++
projects/allura/CVE-2026-73237.osv.json | 1 +
projects/allura/CVE-2026-73238.cve.json | 85 ++
projects/allura/CVE-2026-73238.osv.json | 1 +
projects/allura/CVE-2026-73239.cve.json | 95 ++
projects/allura/CVE-2026-73239.osv.json | 1 +
projects/allura/CVE-2026-73240.cve.json | 85 ++
projects/allura/CVE-2026-73240.osv.json | 1 +
projects/allura/index.html | 88 +-
projects/cloudstack/CVE-2026-47359.cve.json | 100 ++
projects/cloudstack/CVE-2026-47359.osv.json | 1 +
projects/cloudstack/CVE-2026-50112.cve.json | 125 ++
projects/cloudstack/CVE-2026-50112.osv.json | 1 +
projects/cloudstack/CVE-2026-50222.cve.json | 125 ++
projects/cloudstack/CVE-2026-50222.osv.json | 1 +
projects/cloudstack/CVE-2026-59085.cve.json | 105 ++
projects/cloudstack/CVE-2026-59085.osv.json | 1 +
projects/cloudstack/CVE-2026-59654.cve.json | 119 ++
projects/cloudstack/CVE-2026-59654.osv.json | 1 +
projects/cloudstack/CVE-2026-59655.cve.json | 100 ++
projects/cloudstack/CVE-2026-59655.osv.json | 1 +
projects/cloudstack/CVE-2026-59657.cve.json | 95 ++
projects/cloudstack/CVE-2026-59657.osv.json | 1 +
projects/cloudstack/CVE-2026-59780.cve.json | 95 ++
projects/cloudstack/CVE-2026-59780.osv.json | 1 +
projects/cloudstack/CVE-2026-59799.cve.json | 95 ++
projects/cloudstack/CVE-2026-59799.osv.json | 1 +
projects/cloudstack/CVE-2026-61397.cve.json | 115 ++
projects/cloudstack/CVE-2026-61397.osv.json | 1 +
projects/cloudstack/CVE-2026-61398.cve.json | 95 ++
projects/cloudstack/CVE-2026-61398.osv.json | 1 +
projects/cloudstack/CVE-2026-61399.cve.json | 95 ++
projects/cloudstack/CVE-2026-61399.osv.json | 1 +
projects/cloudstack/CVE-2026-61400.cve.json | 95 ++
projects/cloudstack/CVE-2026-61400.osv.json | 1 +
projects/cloudstack/CVE-2026-61422.cve.json | 94 ++
projects/cloudstack/CVE-2026-61422.osv.json | 1 +
projects/cloudstack/CVE-2026-62440.cve.json | 94 ++
projects/cloudstack/CVE-2026-62440.osv.json | 1 +
projects/cloudstack/CVE-2026-65613.cve.json | 105 ++
projects/cloudstack/CVE-2026-65613.osv.json | 1 +
projects/cloudstack/CVE-2026-66721.cve.json | 95 ++
projects/cloudstack/CVE-2026-66721.osv.json | 1 +
projects/cloudstack/CVE-2026-66722.cve.json | 95 ++
projects/cloudstack/CVE-2026-66722.osv.json | 1 +
projects/cloudstack/CVE-2026-66797.cve.json | 95 ++
projects/cloudstack/CVE-2026-66797.osv.json | 1 +
projects/cloudstack/CVE-2026-68745.cve.json | 95 ++
projects/cloudstack/CVE-2026-68745.osv.json | 1 +
projects/cloudstack/index.html | 616 +++++++--
projects/dolphinscheduler/index.html | 2 +-
projects/httpcomponents/CVE-2026-71290.cve.json | 91 ++
projects/httpcomponents/CVE-2026-71290.osv.json | 1 +
projects/httpcomponents/index.html | 59 +-
projects/index.html | 8 +
projects/inlong/CVE-2026-63015.cve.json | 89 ++
projects/inlong/CVE-2026-63015.osv.json | 1 +
projects/inlong/CVE-2026-63016.cve.json | 89 ++
projects/inlong/CVE-2026-63016.osv.json | 1 +
projects/inlong/CVE-2026-63037.cve.json | 89 ++
projects/inlong/CVE-2026-63037.osv.json | 1 +
projects/inlong/CVE-2026-63038.cve.json | 89 ++
projects/inlong/CVE-2026-63038.osv.json | 1 +
projects/inlong/CVE-2026-63039.cve.json | 89 ++
projects/inlong/CVE-2026-63039.osv.json | 1 +
projects/inlong/CVE-2026-63040.cve.json | 89 ++
projects/inlong/CVE-2026-63040.osv.json | 1 +
projects/inlong/CVE-2026-63042.cve.json | 89 ++
projects/inlong/CVE-2026-63042.osv.json | 1 +
projects/inlong/CVE-2026-63043.cve.json | 89 ++
projects/inlong/CVE-2026-63043.osv.json | 1 +
projects/inlong/CVE-2026-63044.cve.json | 89 ++
projects/inlong/CVE-2026-63044.osv.json | 1 +
projects/inlong/CVE-2026-63046.cve.json | 89 ++
projects/inlong/CVE-2026-63046.osv.json | 1 +
projects/inlong/index.html | 419 ++++--
projects/nifi/index.html | 2 +-
projects/ranger/index.html | 4 +-
projects/shindig/CVE-2026-66256.cve.json | 114 ++
projects/shindig/CVE-2026-66256.osv.json | 1 +
projects/shindig/index.html | 148 ++
projects/shindig/index.xml | 10 +
projects/shiro/index.html | 2 +-
projects/skywalking/CVE-2026-34884.cve.json | 88 ++
projects/skywalking/CVE-2026-34884.osv.json | 1 +
projects/skywalking/index.html | 47 +-
projects/struts/CVE-2026-73631.cve.json | 89 ++
projects/struts/CVE-2026-73631.osv.json | 1 +
projects/struts/CVE-2026-73632.cve.json | 89 ++
projects/struts/CVE-2026-73632.osv.json | 1 +
projects/struts/CVE-2026-73633.cve.json | 109 ++
projects/struts/CVE-2026-73633.osv.json | 1 +
projects/struts/CVE-2026-73634.cve.json | 96 ++
projects/struts/CVE-2026-73634.osv.json | 1 +
projects/struts/CVE-2026-73635.cve.json | 108 ++
projects/struts/CVE-2026-73635.osv.json | 1 +
projects/struts/index.html | 166 ++-
sitemap.xml | 2 +
133 files changed, 8137 insertions(+), 1007 deletions(-)
diff --git a/projects/airflow/CVE-2026-54183.cve.json b/projects/airflow/CVE-2026-54183.cve.json
new file mode 100644
index 00000000..4857baa9
--- /dev/null
+++ b/projects/airflow/CVE-2026-54183.cve.json
@@ -0,0 +1,108 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Airflow Variables were not masked in the UI for authenticated users",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
+ "lang": "en",
+ "cweId": "CWE-200",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "3.3.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was shown unmasked in the Variables UI. The exposure is limited to the UI: any authenticated user who can see the Variable in the UI can already read its full value through the Variab [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was shown unmasked in the Variables UI. The exposure is limited to the UI: any authenticated user who can see the Variable in the UI can already read its full value thro [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/68422",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://www.cve.org/CVERecord?id=CVE-2026-42358",
+ "tags": [
+ "related"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/z5mrdq6c60f2wyx4cc64cj8nv0dxd9lo",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Omkhar Arasaratnam (@omkhar)",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-54183",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-54183.osv.json b/projects/airflow/CVE-2026-54183.osv.json
new file mode 100644
index 00000000..4050ecd8
--- /dev/null
+++ b/projects/airflow/CVE-2026-54183.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-54183", "summary": "Airflow Variables were not masked in the UI for authenticated users", "details": "Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was shown unmasked in the Variables UI. The exposure is l [...]
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-58076.cve.json b/projects/airflow/CVE-2026-58076.cve.json
new file mode 100644
index 00000000..5590c589
--- /dev/null
+++ b/projects/airflow/CVE-2026-58076.cve.json
@@ -0,0 +1,108 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-502: Deserialization of Untrusted Data",
+ "lang": "en",
+ "cweId": "CWE-502",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "3.0.0",
+ "lessThan": "3.3.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's `executor_config` reaches that branch, so a Dag author could place a value there that causes an arbitrary callable to be imported and invoked -- for example `subprocess.check_output`, or `builtins.eval` on the `b [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's `executor_config` reaches that branch, so a Dag author could place a value there that causes an arbitrary callable to be imported and invoked -- for example `subprocess.check_output`, or `builtins.e [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/68511",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://www.cve.org/CVERecord?id=CVE-2026-33264",
+ "tags": [
+ "related"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/t81p688t15jozxsng8521o60nh2kfsos",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Jan Kahmen (turingpoint), GitHub: @kah-ja",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-58076",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-58076.osv.json b/projects/airflow/CVE-2026-58076.osv.json
new file mode 100644
index 00000000..8783fe42
--- /dev/null
+++ b/projects/airflow/CVE-2026-58076.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-58076", "summary": "Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server", "details": "Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operato [...]
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-59242.cve.json b/projects/airflow/CVE-2026-59242.cve.json
new file mode 100644
index 00000000..19194b55
--- /dev/null
+++ b/projects/airflow/CVE-2026-59242.cve.json
@@ -0,0 +1,102 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-502: Deserialization of Untrusted Data",
+ "lang": "en",
+ "cweId": "CWE-502",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "3.3.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` without the `_check_forbidden_xcom_keys` guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary `airflow.*` classes on the API server (CWE-502). An authenticated user who can write an XCom value and then read it back with `deserialize=true` triggers the unsafe instantiatio [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` without the `_check_forbidden_xcom_keys` guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary `airflow.*` classes on the API server (CWE-502). An authenticated user who can write an XCom value and then read it back with `deserialize=true` triggers the unsafe ins [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/69378",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/dm0520yhh4mn7qknyoh45r2w6c5qg2mg",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "localhost-detect (@localhost-detect)",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-59242",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-59242.osv.json b/projects/airflow/CVE-2026-59242.osv.json
new file mode 100644
index 00000000..b73970a5
--- /dev/null
+++ b/projects/airflow/CVE-2026-59242.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-59242", "summary": "Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint", "details": "Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` without the `_check_forbidden_xcom_keys` guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary `airflow.*` classes on the [...]
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-59244.cve.json b/projects/airflow/CVE-2026-59244.cve.json
new file mode 100644
index 00000000..e98edb16
--- /dev/null
+++ b/projects/airflow/CVE-2026-59244.cve.json
@@ -0,0 +1,102 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-312: Cleartext Storage of Sensitive Information",
+ "lang": "en",
+ "cweId": "CWE-312",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "3.3.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI \u2014 the dict value failed an `isinstance(str)` guard \u2014 so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI \u2014 the dict value failed an `isinstance(str)` guard \u2014 so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values r [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/68975",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/fncod6vttfo5fvmfs3h9r8s2kmm9j1n6",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Juan Pablo Guereca (@jpgerek)",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Juan Pablo Guereca (@jpgerek)",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-59244",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-59244.osv.json b/projects/airflow/CVE-2026-59244.osv.json
new file mode 100644
index 00000000..00d52f53
--- /dev/null
+++ b/projects/airflow/CVE-2026-59244.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-59244", "summary": "Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI", "details": "Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendere [...]
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-65017.cve.json b/projects/airflow/CVE-2026-65017.cve.json
new file mode 100644
index 00000000..61ca3061
--- /dev/null
+++ b/projects/airflow/CVE-2026-65017.cve.json
@@ -0,0 +1,114 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
+ "lang": "en",
+ "cweId": "CWE-200",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "3.3.0",
+ "lessThan": "3.3.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access \u2014 with no prior access to the secret \u2014 could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets masker m [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access \u2014 with no prior access to the secret \u2014 could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/70755",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://www.cve.org/CVERecord?id=CVE-2026-48828",
+ "tags": [
+ "related"
+ ]
+ },
+ {
+ "url": "https://www.cve.org/CVERecord?id=CVE-2026-48892",
+ "tags": [
+ "related"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/kykn94kjf0tntx4wywtvjowh5bzdgf38",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Andrew Rukin (Arenadata)",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-65017",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-65017.osv.json b/projects/airflow/CVE-2026-65017.osv.json
new file mode 100644
index 00000000..f0642313
--- /dev/null
+++ b/projects/airflow/CVE-2026-65017.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-65017", "summary": "Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)", "details": "Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could read a team-scoped Cel [...]
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-67260.cve.json b/projects/airflow/CVE-2026-67260.cve.json
new file mode 100644
index 00000000..5f71fa48
--- /dev/null
+++ b/projects/airflow/CVE-2026-67260.cve.json
@@ -0,0 +1,108 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-502: Deserialization of Untrusted Data",
+ "lang": "en",
+ "cweId": "CWE-502",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "3.3.0",
+ "lessThan": "3.3.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author \u2014 who controls that value through the task execution API \u2014 can cause an arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job. No non-default configuration is required: the sweep [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author \u2014 who controls that value through the task execution API \u2014 can cause an arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job. No non-default configuration is required: [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/70685",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://www.cve.org/CVERecord?id=CVE-2026-58076",
+ "tags": [
+ "related"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/vygr0fh82cjzjp5k4vtfmboxryvm3lyn",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Erik Villegas (GitHub: @erik-451)",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-67260",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-67260.osv.json b/projects/airflow/CVE-2026-67260.osv.json
new file mode 100644
index 00000000..418cd9f2
--- /dev/null
+++ b/projects/airflow/CVE-2026-67260.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-67260", "summary": "DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization", "details": "Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an arbitrary module [...]
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-67587.cve.json b/projects/airflow/CVE-2026-67587.cve.json
new file mode 100644
index 00000000..fb7092a2
--- /dev/null
+++ b/projects/airflow/CVE-2026-67587.cve.json
@@ -0,0 +1,114 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-502: Deserialization of Untrusted Data",
+ "lang": "en",
+ "cweId": "CWE-502",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "3.3.0",
+ "lessThan": "3.3.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncCallback` is itself an Airflow class it passes the default `allowed_deserialization_classes` allow-list, so tightening that setting does not help. A Dag author \u2014 who controls a task instance's `next_kwargs` through the task execution API \u2014 can therefore cause an arbitrary module to [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncCallback` is itself an Airflow class it passes the default `allowed_deserialization_classes` allow-list, so tightening that setting does not help. A Dag author \u2014 who controls a task instance's `next_kwargs` through the task execution API \u2014 can therefore cause an arbitr [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/70704",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://www.cve.org/CVERecord?id=CVE-2026-58076",
+ "tags": [
+ "related"
+ ]
+ },
+ {
+ "url": "https://www.cve.org/CVERecord?id=CVE-2026-67260",
+ "tags": [
+ "related"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/o00ww4n69qojvsckb464dtwd2nhzy6t0",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Nguyen Van Hiep (@hypnguyen1209), MBBank",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-67587",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-67587.osv.json b/projects/airflow/CVE-2026-67587.osv.json
new file mode 100644
index 00000000..b114e5b1
--- /dev/null
+++ b/projects/airflow/CVE-2026-67587.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-67587", "summary": "DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget", "details": "Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncCallback` is itself an Airflow class it passes the default `allowed_deserialization_classes` allow-list, so tightening that setting does no [...]
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-68076.cve.json b/projects/airflow/CVE-2026-68076.cve.json
new file mode 100644
index 00000000..f1118a2c
--- /dev/null
+++ b/projects/airflow/CVE-2026-68076.cve.json
@@ -0,0 +1,108 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Connections test API: team-scope guard bypass resolves another team's environment Connection",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
+ "lang": "en",
+ "cweId": "CWE-639",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "3.3.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are allowed to contain. When the guard did not apply, the lookup fell through to an unconditional global read that resolved the stored `AIRFLOW_CONN__<TEAM>___<ID>` variable regardle [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are allowed to contain. When the guard did not apply, the lookup fell through to an unconditional global read that resolved the stored `AIRFLOW_CONN__<TEAM>___< [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/70736",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://github.com/apache/airflow/pull/70902",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/v4mc51dgmrc1t82mhzsngsgzo2gxsf2l",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Andrew Rukin (Arenadata)",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-68076",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-68076.osv.json b/projects/airflow/CVE-2026-68076.osv.json
new file mode 100644
index 00000000..366148a1
--- /dev/null
+++ b/projects/airflow/CVE-2026-68076.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-68076", "summary": "Connections test API: team-scope guard bypass resolves another team's environment Connection", "details": "Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are allowed to contain. When th [...]
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-68868.cve.json b/projects/airflow/CVE-2026-68868.cve.json
new file mode 100644
index 00000000..0d76a4e1
--- /dev/null
+++ b/projects/airflow/CVE-2026-68868.cve.json
@@ -0,0 +1,102 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-1220: Insufficient Granularity of Access Control",
+ "lang": "en",
+ "cweId": "CWE-1220",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow Google provider",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow-providers-google",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "22.3.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Variable, obtaining its [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Varia [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/70869",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/03h5y0fmqlh0yf055zlocxh591ozx69x",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Apache Airflow security team",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-68868",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-68868.osv.json b/projects/airflow/CVE-2026-68868.osv.json
new file mode 100644
index 00000000..1e3c2c36
--- /dev/null
+++ b/projects/airflow/CVE-2026-68868.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-68868", "summary": "google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables", "details": "The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secr [...]
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-68870.cve.json b/projects/airflow/CVE-2026-68870.cve.json
new file mode 100644
index 00000000..3f5e3120
--- /dev/null
+++ b/projects/airflow/CVE-2026-68870.cve.json
@@ -0,0 +1,108 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's Connection or Variable",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
+ "lang": "en",
+ "cweId": "CWE-639",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow Microsoft Azure provider",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow-providers-microsoft-azure",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "14.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enablin [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/70876",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://github.com/apache/airflow/pull/70899",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/dtkk6vtfoj1y4zjyd6s3mzg0v5g9yg0p",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Apache Airflow security team",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-68870",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-68870.osv.json b/projects/airflow/CVE-2026-68870.osv.json
new file mode 100644
index 00000000..46f2a4fe
--- /dev/null
+++ b/projects/airflow/CVE-2026-68870.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-68870", "summary": "microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's Connection or Variable", "details": "The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belong [...]
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-68871.cve.json b/projects/airflow/CVE-2026-68871.cve.json
new file mode 100644
index 00000000..6387c56a
--- /dev/null
+++ b/projects/airflow/CVE-2026-68871.cve.json
@@ -0,0 +1,102 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "yandex Lockbox backend: team-scope guard bypass resolves another team's Connection or Variable",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
+ "lang": "en",
+ "cweId": "CWE-639",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow Yandex provider",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow-providers-yandex",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "4.5.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-te [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond ena [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/70877",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/jlj9tv085txk4t0j029mvh43mz89o63c",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Apache Airflow security team",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-68871",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-68871.osv.json b/projects/airflow/CVE-2026-68871.osv.json
new file mode 100644
index 00000000..9fad10d4
--- /dev/null
+++ b/projects/airflow/CVE-2026-68871.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-68871", "summary": "yandex Lockbox backend: team-scope guard bypass resolves another team's Connection or Variable", "details": "The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team b [...]
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-68872.cve.json b/projects/airflow/CVE-2026-68872.cve.json
new file mode 100644
index 00000000..bb44af2c
--- /dev/null
+++ b/projects/airflow/CVE-2026-68872.cve.json
@@ -0,0 +1,102 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
+ "lang": "en",
+ "cweId": "CWE-639",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow Amazon provider",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow-providers-amazon",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "9.34.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/70878",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/9nd31g40rd2zpgwwymskvjpfq1xnmllg",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Apache Airflow security team",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-68872",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-68872.osv.json b/projects/airflow/CVE-2026-68872.osv.json
new file mode 100644
index 00000000..9bb63648
--- /dev/null
+++ b/projects/airflow/CVE-2026-68872.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-68872", "summary": "amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable", "details": "The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in one team [...]
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-68968.cve.json b/projects/airflow/CVE-2026-68968.cve.json
new file mode 100644
index 00000000..2745748d
--- /dev/null
+++ b/projects/airflow/CVE-2026-68968.cve.json
@@ -0,0 +1,102 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Authorization bypass in the Backfill API through conflicting interpretations of the backfill id",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-436: Interpretation Conflict",
+ "lang": "en",
+ "cweId": "CWE-436",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "3.3.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse. The authorization dependency parsed it with `int()` while the route handler parsed it as pydantic's `NonNegativeInt`, which accepts values `int()` rejects (`1.0` coerces to `1`); FastAPI resolves dependencies before endpoint validation, so the two acted on different Dags. An authenticated user holding edit permission on an [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse. The authorization dependency parsed it with `int()` while the route handler parsed it as pydantic's `NonNegativeInt`, which accepts values `int()` rejects (`1.0` coerces to `1`); FastAPI resolves dependencies before endpoint validation, so the two acted on different Dags. An authenticated user holding edit pe [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/70889",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/f9zmw6xs5b4syhwzbl6fsxm4kf2632ol",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ },
+ {
+ "lang": "en",
+ "value": "Harish Kolla (@Har1sh-k)",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-68968",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-68968.osv.json b/projects/airflow/CVE-2026-68968.osv.json
new file mode 100644
index 00000000..dfcf637d
--- /dev/null
+++ b/projects/airflow/CVE-2026-68968.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-68968", "summary": "Authorization bypass in the Backfill API through conflicting interpretations of the backfill id", "details": "Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse. The authorization dependency parsed it with `int()` while the route handler parsed it as pydantic's `NonNegativeInt`, which accepts values `int()` rejects (`1.0` coerces [...]
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-68969.cve.json b/projects/airflow/CVE-2026-68969.cve.json
new file mode 100644
index 00000000..49aed1b3
--- /dev/null
+++ b/projects/airflow/CVE-2026-68969.cve.json
@@ -0,0 +1,108 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Bulk Variable and Connection endpoints record secret values in the audit log in cleartext",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-532: Insertion of Sensitive Information into Log File",
+ "lang": "en",
+ "cweId": "CWE-532",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "3.3.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`). The audit-log masking recognised only top-level request fields, and a bulk request nests its entities two levels below, so no masking was applied to them. Any authenticated user with audit-log read access -- who need not hold Variables or Connections read at a [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`). The audit-log masking recognised only top-level request fields, and a bulk request nests its entities two levels below, so no masking was applied to them. Any authenticated user with audit-log read access -- who need not hold Variables or Connections read [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/70890",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://www.cve.org/CVERecord?id=CVE-2026-50204",
+ "tags": [
+ "related"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/p3jr90jgp2brto4vwcrx680f3x11y70c",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ },
+ {
+ "lang": "en",
+ "value": "Harish Kolla (@Har1sh-k)",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-68969",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-68969.osv.json b/projects/airflow/CVE-2026-68969.osv.json
new file mode 100644
index 00000000..f1b30c2e
--- /dev/null
+++ b/projects/airflow/CVE-2026-68969.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-68969", "summary": "Bulk Variable and Connection endpoints record secret values in the audit log in cleartext", "details": "Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`). The audit-log masking recognised only top-level request fields, and a bulk request nests its entities two levels [...]
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-68970.cve.json b/projects/airflow/CVE-2026-68970.cve.json
new file mode 100644
index 00000000..b7d8587f
--- /dev/null
+++ b/projects/airflow/CVE-2026-68970.cve.json
@@ -0,0 +1,108 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-312: Cleartext Storage of Sensitive Information",
+ "lang": "en",
+ "cweId": "CWE-312",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "3.3.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level matched neither and was returned unmasked. Any authenticated user able to read the logs or rendered templates of a task that references such a Variable could recover the values [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level matched neither and was returned unmasked. Any authenticated user able to read the logs or rendered templates of a task that references such a Variable could recover t [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/70891",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://www.cve.org/CVERecord?id=CVE-2026-59244",
+ "tags": [
+ "related"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/kkrlnbsk47oght4h38mcd3h2kcb8dt28",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Raphael Zanarelli (@zanarellidev)",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-68970",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-68970.osv.json b/projects/airflow/CVE-2026-68970.osv.json
new file mode 100644
index 00000000..3861f64e
--- /dev/null
+++ b/projects/airflow/CVE-2026-68970.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-68970", "summary": "Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI", "details": "Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level matched neither and was ret [...]
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-68971.cve.json b/projects/airflow/CVE-2026-68971.cve.json
new file mode 100644
index 00000000..ef68c887
--- /dev/null
+++ b/projects/airflow/CVE-2026-68971.cve.json
@@ -0,0 +1,102 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Cross-team authorization bypass in the asset materialization and dag-run result endpoints",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-862: Missing Authorization",
+ "lang": "en",
+ "cweId": "CWE-862",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow",
+ "collectionURL": "https://pypi.python.org",
+ "packageName": "apache-airflow",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "3.3.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_until_finished` authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global one by that field -- the Keycloak auth manager, for example, checks the `DAG` resource instead of `DAG:<team>` -- so the team-scoped permission that should gate th [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_until_finished` authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global one by that field -- the Keycloak auth manager, for example, checks the `DAG` resource instead of `DAG:<team>` -- so the team-scoped permission that [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/70893",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/kfxqqwgojdjdnt6bxg3ord4y41y334fo",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "@haoxucu",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Jarek Potiuk",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-68971",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-68971.osv.json b/projects/airflow/CVE-2026-68971.osv.json
new file mode 100644
index 00000000..192660ca
--- /dev/null
+++ b/projects/airflow/CVE-2026-68971.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-68971", "summary": "Cross-team authorization bypass in the asset materialization and dag-run result endpoints", "details": "Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_until_finished` authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global one by that fie [...]
\ No newline at end of file
diff --git a/projects/airflow/index.html b/projects/airflow/index.html
index 08b46b3d..c2910cbc 100644
--- a/projects/airflow/index.html
+++ b/projects/airflow/index.html
@@ -109,78 +109,393 @@
</ul>
<h1 id="advisories">Advisories</h1>
<p class="bg-warning">This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the project security page linked above. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public <a href="/mailinglist">mailinglist</a> or privately on <a href="mailto:security@apache.org">security@apache.org</a></p>
+<h2 id="CVE-2026-68971">Cross-team authorization bypass in the asset materialization and dag-run result endpoints</h2>
+<p>CVE-2026-68971 <a href="https://cve.org/CVERecord?id=CVE-2026-68971">[CVE]</a> <a href="./CVE-2026-68971.cve.json">[CVE json]</a> <a href="./CVE-2026-68971.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-12T15:24:09.501Z</em></p>
+<h3 id="affected">Affected</h3>
+<ul>
+<li>Apache Airflow before 3.3.1</li>
+</ul>
+<h3 id="description">Description</h3>
+<p>Apache Airflow's asset materialization endpoint (<code>POST /api/v2/assets/{asset_id}/materialize</code>) and the XCom result check on <code>wait_dag_run_until_finished</code> authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global one by that field – the Keycloak auth manager, for example, checks the <code>DAG</code> resource instead of <code>DAG:&lt;team&gt;</code> &ndash [...]
+<h3 id="references">References</h3>
+<ul>
+<li><a href="https://github.com/apache/airflow/pull/70893">https://github.com/apache/airflow/pull/70893</a></li>
+<li><a href="https://lists.apache.org/thread/kfxqqwgojdjdnt6bxg3ord4y41y334fo">https://lists.apache.org/thread/kfxqqwgojdjdnt6bxg3ord4y41y334fo</a></li>
+</ul>
+<h3 id="credits">Credits</h3>
+<ul>
+<li>@haoxucu (finder)</li>
+<li>Jarek Potiuk (remediation developer)</li>
+</ul>
+<h2 id="CVE-2026-68970">Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI</h2>
+<p>CVE-2026-68970 <a href="https://cve.org/CVERecord?id=CVE-2026-68970">[CVE]</a> <a href="./CVE-2026-68970.cve.json">[CVE json]</a> <a href="./CVE-2026-68970.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-12T15:24:51.786Z</em></p>
+<h3 id="affected-1">Affected</h3>
+<ul>
+<li>Apache Airflow before 3.3.1</li>
+</ul>
+<h3 id="description-1">Description</h3>
+<p>Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level matched neither and was returned unmasked. Any authenticated user able to read the logs or rendered templates of a task that references such a Variable could recover the values, with no special [...]
+<h3 id="references-1">References</h3>
+<ul>
+<li><a href="https://github.com/apache/airflow/pull/70891">https://github.com/apache/airflow/pull/70891</a></li>
+<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-59244">https://www.cve.org/CVERecord?id=CVE-2026-59244</a></li>
+<li><a href="https://lists.apache.org/thread/kkrlnbsk47oght4h38mcd3h2kcb8dt28">https://lists.apache.org/thread/kkrlnbsk47oght4h38mcd3h2kcb8dt28</a></li>
+</ul>
+<h3 id="credits-1">Credits</h3>
+<ul>
+<li>Raphael Zanarelli (@zanarellidev) (finder)</li>
+<li>Jarek Potiuk (remediation developer)</li>
+</ul>
+<h2 id="CVE-2026-68969">Bulk Variable and Connection endpoints record secret values in the audit log in cleartext</h2>
+<p>CVE-2026-68969 <a href="https://cve.org/CVERecord?id=CVE-2026-68969">[CVE]</a> <a href="./CVE-2026-68969.cve.json">[CVE json]</a> <a href="./CVE-2026-68969.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-18T16:43:40.170Z</em></p>
+<h3 id="affected-2">Affected</h3>
+<ul>
+<li>Apache Airflow before 3.3.1</li>
+</ul>
+<h3 id="description-2">Description</h3>
+<p>Apache Airflow wrote Variable values and Connection <code>extra</code> contents to the audit log in cleartext when they were submitted through the bulk endpoints (<code>PATCH /api/v2/variables</code> and <code>PATCH /api/v2/connections</code>). The audit-log masking recognised only top-level request fields, and a bulk request nests its entities two levels below, so no masking was applied to them. Any authenticated user with audit-log read access – who need not hold Variables or [...]
+<h3 id="references-2">References</h3>
+<ul>
+<li><a href="https://github.com/apache/airflow/pull/70890">https://github.com/apache/airflow/pull/70890</a></li>
+<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-50204">https://www.cve.org/CVERecord?id=CVE-2026-50204</a></li>
+<li><a href="https://lists.apache.org/thread/p3jr90jgp2brto4vwcrx680f3x11y70c">https://lists.apache.org/thread/p3jr90jgp2brto4vwcrx680f3x11y70c</a></li>
+</ul>
+<h3 id="credits-2">Credits</h3>
+<ul>
+<li>Jarek Potiuk (remediation developer)</li>
+<li>Harish Kolla (@Har1sh-k) (finder)</li>
+</ul>
+<h2 id="CVE-2026-68968">Authorization bypass in the Backfill API through conflicting interpretations of the backfill id</h2>
+<p>CVE-2026-68968 <a href="https://cve.org/CVERecord?id=CVE-2026-68968">[CVE]</a> <a href="./CVE-2026-68968.cve.json">[CVE json]</a> <a href="./CVE-2026-68968.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-18T16:43:04.336Z</em></p>
+<h3 id="affected-3">Affected</h3>
+<ul>
+<li>Apache Airflow before 3.3.1</li>
+</ul>
+<h3 id="description-3">Description</h3>
+<p>Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the <code>backfill_id</code> path segment failed to parse. The authorization dependency parsed it with <code>int()</code> while the route handler parsed it as pydantic's <code>NonNegativeInt</code>, which accepts values <code>int()</code> rejects (<code>1.0</code> coerces to <code>1</code>); FastAPI resolves dependencies before endpoint validation, so the two acted on different Dags. An [...]
+<h3 id="references-3">References</h3>
+<ul>
+<li><a href="https://github.com/apache/airflow/pull/70889">https://github.com/apache/airflow/pull/70889</a></li>
+<li><a href="https://lists.apache.org/thread/f9zmw6xs5b4syhwzbl6fsxm4kf2632ol">https://lists.apache.org/thread/f9zmw6xs5b4syhwzbl6fsxm4kf2632ol</a></li>
+</ul>
+<h3 id="credits-3">Credits</h3>
+<ul>
+<li>Jarek Potiuk (remediation developer)</li>
+<li>Harish Kolla (@Har1sh-k) (finder)</li>
+</ul>
+<h2 id="CVE-2026-68872">amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team’s Connection or Variable</h2>
+<p>CVE-2026-68872 <a href="https://cve.org/CVERecord?id=CVE-2026-68872">[CVE]</a> <a href="./CVE-2026-68872.cve.json">[CVE json]</a> <a href="./CVE-2026-68872.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-10T18:21:17.038Z</em></p>
+<h3 id="affected-4">Affected</h3>
+<ul>
+<li>Apache Airflow Amazon provider before 9.34.0</li>
+</ul>
+<h3 id="description-4">Description</h3>
+<p>The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyon [...]
+<h3 id="references-4">References</h3>
+<ul>
+<li><a href="https://github.com/apache/airflow/pull/70878">https://github.com/apache/airflow/pull/70878</a></li>
+<li><a href="https://lists.apache.org/thread/9nd31g40rd2zpgwwymskvjpfq1xnmllg">https://lists.apache.org/thread/9nd31g40rd2zpgwwymskvjpfq1xnmllg</a></li>
+</ul>
+<h3 id="credits-4">Credits</h3>
+<ul>
+<li>Apache Airflow security team (finder)</li>
+<li>Jarek Potiuk (remediation developer)</li>
+</ul>
+<h2 id="CVE-2026-68871">yandex Lockbox backend: team-scope guard bypass resolves another team’s Connection or Variable</h2>
+<p>CVE-2026-68871 <a href="https://cve.org/CVERecord?id=CVE-2026-68871">[CVE]</a> <a href="./CVE-2026-68871.cve.json">[CVE json]</a> <a href="./CVE-2026-68871.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-10T18:18:18.472Z</em></p>
+<h3 id="affected-5">Affected</h3>
+<ul>
+<li>Apache Airflow Yandex provider before 4.5.1</li>
+</ul>
+<h3 id="description-5">Description</h3>
+<p>The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using [...]
+<h3 id="references-5">References</h3>
+<ul>
+<li><a href="https://github.com/apache/airflow/pull/70877">https://github.com/apache/airflow/pull/70877</a></li>
+<li><a href="https://lists.apache.org/thread/jlj9tv085txk4t0j029mvh43mz89o63c">https://lists.apache.org/thread/jlj9tv085txk4t0j029mvh43mz89o63c</a></li>
+</ul>
+<h3 id="credits-5">Credits</h3>
+<ul>
+<li>Apache Airflow security team (finder)</li>
+<li>Jarek Potiuk (remediation developer)</li>
+</ul>
+<h2 id="CVE-2026-68870">microsoft.azure Key Vault backend: team-scope guard bypass resolves another team’s Connection or Variable</h2>
+<p>CVE-2026-68870 <a href="https://cve.org/CVERecord?id=CVE-2026-68870">[CVE]</a> <a href="./CVE-2026-68870.cve.json">[CVE json]</a> <a href="./CVE-2026-68870.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-10T18:10:29.342Z</em></p>
+<h3 id="affected-6">Affected</h3>
+<ul>
+<li>Apache Airflow Microsoft Azure provider before 14.1.0</li>
+</ul>
+<h3 id="description-6">Description</h3>
+<p>The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode [...]
+<h3 id="references-6">References</h3>
+<ul>
+<li><a href="https://github.com/apache/airflow/pull/70876">https://github.com/apache/airflow/pull/70876</a></li>
+<li><a href="https://github.com/apache/airflow/pull/70899">https://github.com/apache/airflow/pull/70899</a></li>
+<li><a href="https://lists.apache.org/thread/dtkk6vtfoj1y4zjyd6s3mzg0v5g9yg0p">https://lists.apache.org/thread/dtkk6vtfoj1y4zjyd6s3mzg0v5g9yg0p</a></li>
+</ul>
+<h3 id="credits-6">Credits</h3>
+<ul>
+<li>Apache Airflow security team (finder)</li>
+<li>Jarek Potiuk (remediation developer)</li>
+</ul>
+<h2 id="CVE-2026-68868">google Secret Manager backend: team scope is never applied, exposing every team’s Connections and Variables</h2>
+<p>CVE-2026-68868 <a href="https://cve.org/CVERecord?id=CVE-2026-68868">[CVE]</a> <a href="./CVE-2026-68868.cve.json">[CVE json]</a> <a href="./CVE-2026-68868.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-12T10:33:13.058Z</em></p>
+<h3 id="affected-7">Affected</h3>
+<ul>
+<li>Apache Airflow Google provider before 22.3.0</li>
+</ul>
+<h3 id="description-7">Description</h3>
+<p>The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's <code>team_name</code> was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Variable, obtaining its creden [...]
+<h3 id="references-7">References</h3>
+<ul>
+<li><a href="https://github.com/apache/airflow/pull/70869">https://github.com/apache/airflow/pull/70869</a></li>
+<li><a href="https://lists.apache.org/thread/03h5y0fmqlh0yf055zlocxh591ozx69x">https://lists.apache.org/thread/03h5y0fmqlh0yf055zlocxh591ozx69x</a></li>
+</ul>
+<h3 id="credits-7">Credits</h3>
+<ul>
+<li>Apache Airflow security team (finder)</li>
+<li>Jarek Potiuk (remediation developer)</li>
+</ul>
+<h2 id="CVE-2026-68076">Connections test API: team-scope guard bypass resolves another team’s environment Connection</h2>
+<p>CVE-2026-68076 <a href="https://cve.org/CVERecord?id=CVE-2026-68076">[CVE]</a> <a href="./CVE-2026-68076.cve.json">[CVE json]</a> <a href="./CVE-2026-68076.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-12T15:23:21.465Z</em></p>
+<h3 id="affected-8">Affected</h3>
+<ul>
+<li>Apache Airflow before 3.3.1</li>
+</ul>
+<h3 id="description-8">Description</h3>
+<p>Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are allowed to contain. When the guard did not apply, the lookup fell through to an unconditional global read that resolved the stored <code>AIRFLOW_CONN__&lt;TEAM&gt;___&lt;ID&gt;</c [...]
+<h3 id="references-8">References</h3>
+<ul>
+<li><a href="https://github.com/apache/airflow/pull/70736">https://github.com/apache/airflow/pull/70736</a></li>
+<li><a href="https://github.com/apache/airflow/pull/70902">https://github.com/apache/airflow/pull/70902</a></li>
+<li><a href="https://lists.apache.org/thread/v4mc51dgmrc1t82mhzsngsgzo2gxsf2l">https://lists.apache.org/thread/v4mc51dgmrc1t82mhzsngsgzo2gxsf2l</a></li>
+</ul>
+<h3 id="credits-8">Credits</h3>
+<ul>
+<li>Andrew Rukin (Arenadata) (finder)</li>
+<li>Jarek Potiuk (remediation developer)</li>
+</ul>
+<h2 id="CVE-2026-67587">DAG-author remote code execution on the Scheduler via a Serde <code>Callback</code> deserialization gadget</h2>
+<p>CVE-2026-67587 <a href="https://cve.org/CVERecord?id=CVE-2026-67587">[CVE]</a> <a href="./CVE-2026-67587.cve.json">[CVE json]</a> <a href="./CVE-2026-67587.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-12T15:32:09.019Z</em></p>
+<h3 id="affected-9">Affected</h3>
+<ul>
+<li>Apache Airflow from 3.3.0 before 3.3.1</li>
+</ul>
+<h3 id="description-9">Description</h3>
+<p>Apache Airflow's Task SDK rebuilt a <code>Callback</code> object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because <code>SyncCallback</code> is itself an Airflow class it passes the default <code>allowed_deserialization_classes</code> allow-list, so tightening that setting does not help. A Dag author — who controls a task instance's <code>next_kwargs</code> through the task execution API — can therefore cause an arb [...]
+<h3 id="references-9">References</h3>
+<ul>
+<li><a href="https://github.com/apache/airflow/pull/70704">https://github.com/apache/airflow/pull/70704</a></li>
+<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-58076">https://www.cve.org/CVERecord?id=CVE-2026-58076</a></li>
+<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-67260">https://www.cve.org/CVERecord?id=CVE-2026-67260</a></li>
+<li><a href="https://lists.apache.org/thread/o00ww4n69qojvsckb464dtwd2nhzy6t0">https://lists.apache.org/thread/o00ww4n69qojvsckb464dtwd2nhzy6t0</a></li>
+</ul>
+<h3 id="credits-9">Credits</h3>
+<ul>
+<li>Nguyen Van Hiep (@hypnguyen1209), MBBank (finder)</li>
+<li>Jarek Potiuk (remediation developer)</li>
+</ul>
+<h2 id="CVE-2026-67260">DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization</h2>
+<p>CVE-2026-67260 <a href="https://cve.org/CVERecord?id=CVE-2026-67260">[CVE]</a> <a href="./CVE-2026-67260.cve.json">[CVE json]</a> <a href="./CVE-2026-67260.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-12T15:33:01.084Z</em></p>
+<h3 id="affected-10">Affected</h3>
+<ul>
+<li>Apache Airflow from 3.3.0 before 3.3.1</li>
+</ul>
+<h3 id="description-10">Description</h3>
+<p>Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new <code>awaiting_input</code> task state swept by the scheduler. That sweep deserializes the task instance's <code>next_kwargs</code> without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job. No non-default configuration is required: the sweep runs [...]
+<h3 id="references-10">References</h3>
+<ul>
+<li><a href="https://github.com/apache/airflow/pull/70685">https://github.com/apache/airflow/pull/70685</a></li>
+<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-58076">https://www.cve.org/CVERecord?id=CVE-2026-58076</a></li>
+<li><a href="https://lists.apache.org/thread/vygr0fh82cjzjp5k4vtfmboxryvm3lyn">https://lists.apache.org/thread/vygr0fh82cjzjp5k4vtfmboxryvm3lyn</a></li>
+</ul>
+<h3 id="credits-10">Credits</h3>
+<ul>
+<li>Erik Villegas (GitHub: @erik-451) (finder)</li>
+<li>Jarek Potiuk (remediation developer)</li>
+</ul>
+<h2 id="CVE-2026-65017">Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)</h2>
+<p>CVE-2026-65017 <a href="https://cve.org/CVERecord?id=CVE-2026-65017">[CVE]</a> <a href="./CVE-2026-65017.cve.json">[CVE json]</a> <a href="./CVE-2026-65017.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-12T15:31:24.771Z</em></p>
+<h3 id="affected-11">Affected</h3>
+<ul>
+<li>Apache Airflow from 3.3.0 before 3.3.1</li>
+</ul>
+<h3 id="description-11">Description</h3>
+<p>Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets masker matched only base section an [...]
+<h3 id="references-11">References</h3>
+<ul>
+<li><a href="https://github.com/apache/airflow/pull/70755">https://github.com/apache/airflow/pull/70755</a></li>
+<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-48828">https://www.cve.org/CVERecord?id=CVE-2026-48828</a></li>
+<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-48892">https://www.cve.org/CVERecord?id=CVE-2026-48892</a></li>
+<li><a href="https://lists.apache.org/thread/kykn94kjf0tntx4wywtvjowh5bzdgf38">https://lists.apache.org/thread/kykn94kjf0tntx4wywtvjowh5bzdgf38</a></li>
+</ul>
+<h3 id="credits-11">Credits</h3>
+<ul>
+<li>Andrew Rukin (Arenadata) (finder)</li>
+<li>Jarek Potiuk (remediation developer)</li>
+</ul>
<h2 id="CVE-2026-59245">FAB auth manager: a DAG named “DAGs” hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision)</h2>
<p>CVE-2026-59245 <a href="https://cve.org/CVERecord?id=CVE-2026-59245">[CVE]</a> <a href="./CVE-2026-59245.cve.json">[CVE json]</a> <a href="./CVE-2026-59245.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-07-19T16:30:45.992Z</em></p>
-<h3 id="affected">Affected</h3>
+<h3 id="affected-12">Affected</h3>
<ul>
<li>Apache Airflow FAB provider before 3.7.2</li>
</ul>
-<h3 id="description">Description</h3>
+<h3 id="description-12">Description</h3>
<p>In the Apache Airflow FAB auth manager, a DAG whose <code>dag_id</code> is <code>DAGs</code> collided with the global all-DAGs permission resource name produced by <code>resource_name()</code>, so a user granted per-DAG <code>access_control</code> on that one DAG was silently granted the global all-DAGs permission (privilege escalation). The escalation triggers when a DAG named <code>DAGs</code> exists and a lower-privileged user is given per-DAG access to it, granting that user read/ [...]
-<h3 id="references">References</h3>
+<h3 id="references-12">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/69106">https://github.com/apache/airflow/pull/69106</a></li>
<li><a href="https://lists.apache.org/thread/70f37q3mwov1vm3zolrfxlzds278c78h">https://lists.apache.org/thread/70f37q3mwov1vm3zolrfxlzds278c78h</a></li>
</ul>
-<h3 id="credits">Credits</h3>
+<h3 id="credits-12">Credits</h3>
<ul>
<li>Tran Hieu (h1tr3xnull) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
</ul>
+<h2 id="CVE-2026-59244">Secrets masker: <code>var.json</code> Variable values not masked in the Rendered Templates UI</h2>
+<p>CVE-2026-59244 <a href="https://cve.org/CVERecord?id=CVE-2026-59244">[CVE]</a> <a href="./CVE-2026-59244.cve.json">[CVE json]</a> <a href="./CVE-2026-59244.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-12T15:43:15.962Z</em></p>
+<h3 id="affected-13">Affected</h3>
+<ul>
+<li>Apache Airflow before 3.3.1</li>
+</ul>
+<h3 id="description-13">Description</h3>
+<p>Apache Airflow's secrets masker did not mask <code>var.json</code> Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an <code>isinstance(str)</code> guard — so a secret stored as a JSON Variable and referenced in a template via <code>var.json</code> was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardles [...]
+<h3 id="references-13">References</h3>
+<ul>
+<li><a href="https://github.com/apache/airflow/pull/68975">https://github.com/apache/airflow/pull/68975</a></li>
+<li><a href="https://lists.apache.org/thread/fncod6vttfo5fvmfs3h9r8s2kmm9j1n6">https://lists.apache.org/thread/fncod6vttfo5fvmfs3h9r8s2kmm9j1n6</a></li>
+</ul>
+<h3 id="credits-13">Credits</h3>
+<ul>
+<li>Juan Pablo Guereca (@jpgerek) (finder)</li>
+<li>Juan Pablo Guereca (@jpgerek) (remediation developer)</li>
+</ul>
<h2 id="CVE-2026-59243">FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (<code>verify_signature</code> defaults to <code>False</code>)</h2>
<p>CVE-2026-59243 <a href="https://cve.org/CVERecord?id=CVE-2026-59243">[CVE]</a> <a href="./CVE-2026-59243.cve.json">[CVE json]</a> <a href="./CVE-2026-59243.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-07-28T10:25:25.203Z</em></p>
-<h3 id="affected-1">Affected</h3>
+<h3 id="affected-14">Affected</h3>
<ul>
<li>Apache Airflow FAB provider before 3.7.3</li>
</ul>
-<h3 id="description-1">Description</h3>
+<h3 id="description-14">Description</h3>
<p>The FAB auth manager's Azure AD OAuth login defaulted <code>verify_signature=False</code> when decoding the ID token, so an attacker able to present a forged or unsigned (<code>alg:none</code>) ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role (CWE-347). Deployments running the FAB auth manager with the Azure AD OAuth login path under its default configuration are affected; the Authentik path already defaul [...]
-<h3 id="references-1">References</h3>
+<h3 id="references-14">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/69374">https://github.com/apache/airflow/pull/69374</a></li>
<li><a href="https://lists.apache.org/thread/x4784l7z00tl3gw4tv2dmvoon77rxgpl">https://lists.apache.org/thread/x4784l7z00tl3gw4tv2dmvoon77rxgpl</a></li>
</ul>
-<h3 id="credits-1">Credits</h3>
+<h3 id="credits-14">Credits</h3>
<ul>
<li>MalHyuk (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
</ul>
+<h2 id="CVE-2026-59242">Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint</h2>
+<p>CVE-2026-59242 <a href="https://cve.org/CVERecord?id=CVE-2026-59242">[CVE]</a> <a href="./CVE-2026-59242.cve.json">[CVE json]</a> <a href="./CVE-2026-59242.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-12T15:34:59.496Z</em></p>
+<h3 id="affected-15">Affected</h3>
+<ul>
+<li>Apache Airflow before 3.3.1</li>
+</ul>
+<h3 id="description-15">Description</h3>
+<p>Apache Airflow's XCom <code>GET /api/v2/{...}/xcomEntries/{key}?deserialize=true</code> endpoint passed a string-literal payload through <code>BaseXCom.deserialize_value</code> without the <code>_check_forbidden_xcom_keys</code> guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary <code>airflow.*</code> classes on the API server (CWE-502). An authenticated user who can write an XCom value and then read it back with <code>deserialize=true</ [...]
+<h3 id="references-15">References</h3>
+<ul>
+<li><a href="https://github.com/apache/airflow/pull/69378">https://github.com/apache/airflow/pull/69378</a></li>
+<li><a href="https://lists.apache.org/thread/dm0520yhh4mn7qknyoh45r2w6c5qg2mg">https://lists.apache.org/thread/dm0520yhh4mn7qknyoh45r2w6c5qg2mg</a></li>
+</ul>
+<h3 id="credits-15">Credits</h3>
+<ul>
+<li>localhost-detect (@localhost-detect) (finder)</li>
+<li>Jarek Potiuk (remediation developer)</li>
+</ul>
+<h2 id="CVE-2026-58076">Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server</h2>
+<p>CVE-2026-58076 <a href="https://cve.org/CVERecord?id=CVE-2026-58076">[CVE]</a> <a href="./CVE-2026-58076.cve.json">[CVE json]</a> <a href="./CVE-2026-58076.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-12T15:40:58.403Z</em></p>
+<h3 id="affected-16">Affected</h3>
+<ul>
+<li>Apache Airflow from 3.0.0 before 3.3.1</li>
+</ul>
+<h3 id="description-16">Description</h3>
+<p>Apache Airflow's serialization layer reconstructed exception nodes by calling <code>import_string()</code> on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's <code>executor_config</code> reaches that branch, so a Dag author could place a value there that causes an arbitrary callable to be imported and invoked – for example <code>subprocess.check_output</code>, or <cod [...]
+<h3 id="references-16">References</h3>
+<ul>
+<li><a href="https://github.com/apache/airflow/pull/68511">https://github.com/apache/airflow/pull/68511</a></li>
+<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-33264">https://www.cve.org/CVERecord?id=CVE-2026-33264</a></li>
+<li><a href="https://lists.apache.org/thread/t81p688t15jozxsng8521o60nh2kfsos">https://lists.apache.org/thread/t81p688t15jozxsng8521o60nh2kfsos</a></li>
+</ul>
+<h3 id="credits-16">Credits</h3>
+<ul>
+<li>Jan Kahmen (turingpoint), GitHub: @kah-ja (finder)</li>
+<li>Jarek Potiuk (remediation developer)</li>
+</ul>
<h2 id="CVE-2026-58065">Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key verification</h2>
<p>CVE-2026-58065 <a href="https://cve.org/CVERecord?id=CVE-2026-58065">[CVE]</a> <a href="./CVE-2026-58065.cve.json">[CVE json]</a> <a href="./CVE-2026-58065.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-07-19T16:29:11.369Z</em></p>
-<h3 id="affected-2">Affected</h3>
+<h3 id="affected-17">Affected</h3>
<ul>
<li>Apache Airflow Git provider before 0.4.1</li>
</ul>
-<h3 id="description-2">Description</h3>
+<h3 id="description-17">Description</h3>
<p>The Apache Airflow Git provider runs its git-over-SSH operations with <code>StrictHostKeyChecking=no</code> by default, disabling SSH host-key verification. An attacker who can intercept the network path between an Airflow worker and the Git server can impersonate the server (man-in-the-middle), capturing the SSH deploy key or injecting malicious repository content. Deployments that use the Git DAG bundle or Git provider to clone over SSH with a deploy key are affected. The fix change [...]
-<h3 id="references-2">References</h3>
+<h3 id="references-17">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/69103">https://github.com/apache/airflow/pull/69103</a></li>
<li><a href="https://lists.apache.org/thread/fjmclngfksz2kp7llpcjxzdz568h0zhc">https://lists.apache.org/thread/fjmclngfksz2kp7llpcjxzdz568h0zhc</a></li>
</ul>
-<h3 id="credits-2">Credits</h3>
+<h3 id="credits-17">Credits</h3>
<ul>
<li>Siyang Wu (independent researcher) (finder)</li>
<li>Ephraim Anierobi (remediation developer)</li>
</ul>
+<h2 id="CVE-2026-54183">Airflow Variables were not masked in the UI for authenticated users</h2>
+<p>CVE-2026-54183 <a href="https://cve.org/CVERecord?id=CVE-2026-54183">[CVE]</a> <a href="./CVE-2026-54183.cve.json">[CVE json]</a> <a href="./CVE-2026-54183.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-12T15:34:17.762Z</em></p>
+<h3 id="affected-18">Affected</h3>
+<ul>
+<li>Apache Airflow before 3.3.1</li>
+</ul>
+<h3 id="description-18">Description</h3>
+<p>Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was shown unmasked in the Variables UI. The exposure is limited to the UI: any authenticated user who can see the Variable in the UI can already read its full value through the Variables REST API, so [...]
+<h3 id="references-18">References</h3>
+<ul>
+<li><a href="https://github.com/apache/airflow/pull/68422">https://github.com/apache/airflow/pull/68422</a></li>
+<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-42358">https://www.cve.org/CVERecord?id=CVE-2026-42358</a></li>
+<li><a href="https://lists.apache.org/thread/z5mrdq6c60f2wyx4cc64cj8nv0dxd9lo">https://lists.apache.org/thread/z5mrdq6c60f2wyx4cc64cj8nv0dxd9lo</a></li>
+</ul>
+<h3 id="credits-18">Credits</h3>
+<ul>
+<li>Omkhar Arasaratnam (@omkhar) (finder)</li>
+<li>Jarek Potiuk (remediation developer)</li>
+</ul>
<h2 id="CVE-2026-50203">Path traversal in SFTPHook.retrieve_directory allows local file write outside the destination directory via malicious server-supplied directory-entry names</h2>
<p>CVE-2026-50203 <a href="https://cve.org/CVERecord?id=CVE-2026-50203">[CVE]</a> <a href="./CVE-2026-50203.cve.json">[CVE json]</a> <a href="./CVE-2026-50203.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-17T01:48:06.460Z</em></p>
-<h3 id="affected-3">Affected</h3>
+<h3 id="affected-19">Affected</h3>
<ul>
<li>Apache Airflow SFTP provider before 5.8.1</li>
</ul>
-<h3 id="description-3">Description</h3>
+<h3 id="description-19">Description</h3>
<p>A path traversal in the SFTP provider (<code>SFTPHook.retrieve_directory</code> / <code>SFTPOperator(operation=get)</code>) let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is any deployment downloading directories from an untrusted SFTP server. Upgrade <code>apache-airflow-providers-sftp</code> to 5.8.1 or later.</p>
-<h3 id="references-3">References</h3>
+<h3 id="references-19">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67985">https://github.com/apache/airflow/pull/67985</a></li>
<li><a href="https://lists.apache.org/thread/7f4b284oh44c1n95oq8mh1qc7y1lr9dx">https://lists.apache.org/thread/7f4b284oh44c1n95oq8mh1qc7y1lr9dx</a></li>
</ul>
-<h3 id="credits-3">Credits</h3>
+<h3 id="credits-19">Credits</h3>
<ul>
<li>secuholic (finder)</li>
<li>Venkatraman Kumar (r3dw0lfsec), Securin (finder)</li>
@@ -189,18 +504,18 @@
<h2 id="CVE-2026-49818">Path traversal in GCSToSambaOperator via GCS object names</h2>
<p>CVE-2026-49818 <a href="https://cve.org/CVERecord?id=CVE-2026-49818">[CVE]</a> <a href="./CVE-2026-49818.cve.json">[CVE json]</a> <a href="./CVE-2026-49818.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-10T17:37:51.189Z</em></p>
-<h3 id="affected-4">Affected</h3>
+<h3 id="affected-20">Affected</h3>
<ul>
<li>Apache Airflow Samba provider before 4.12.6</li>
</ul>
-<h3 id="description-4">Description</h3>
+<h3 id="description-20">Description</h3>
<p>The Apache Airflow Samba provider's <code>GCSToSambaOperator</code> joined GCS object names to the SMB destination path without a containment check, so an object named with <code>../</code> segments resolved a write path outside the configured <code>destination_path</code>. An attacker able to write objects into the source GCS bucket — typically an external data producer distinct from the trusted DAG author — could write files to arbitrary locations on the Samba target when the operat [...]
-<h3 id="references-4">References</h3>
+<h3 id="references-20">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67857">https://github.com/apache/airflow/pull/67857</a></li>
<li><a href="https://lists.apache.org/thread/3vs0m3p51psgf54tts18d6336g24x3sf">https://lists.apache.org/thread/3vs0m3p51psgf54tts18d6336g24x3sf</a></li>
</ul>
-<h3 id="credits-4">Credits</h3>
+<h3 id="credits-20">Credits</h3>
<ul>
<li>secuholic (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -208,18 +523,18 @@
<h2 id="CVE-2026-49487">Task-instance API exposes secrets in deferred trigger kwargs</h2>
<p>CVE-2026-49487 <a href="https://cve.org/CVERecord?id=CVE-2026-49487">[CVE]</a> <a href="./CVE-2026-49487.cve.json">[CVE json]</a> <a href="./CVE-2026-49487.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-07-07T12:26:03.726Z</em></p>
-<h3 id="affected-5">Affected</h3>
+<h3 id="affected-21">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.0</li>
</ul>
-<h3 id="description-5">Description</h3>
+<h3 id="description-21">Description</h3>
<p>In Apache Airflow before 3.3.0, the REST API task-instance detail and list<br>endpoints returned a deferred task's trigger kwargs without masking. When a<br>deferred operator passed a secret (for example a provider API key) into its<br>trigger, any authenticated user with DAG-scoped task-instance read access for<br>that DAG could read that secret in clear text while the task was deferred.<br>Users should upgrade to apache-airflow 3.3.0 or later, which masks sensitive<br>values in trig [...]
-<h3 id="references-5">References</h3>
+<h3 id="references-21">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67868">https://github.com/apache/airflow/pull/67868</a></li>
<li><a href="https://lists.apache.org/thread/qlw6pozlzlfhkvmbgqsbjlq6vj4v0pc4">https://lists.apache.org/thread/qlw6pozlzlfhkvmbgqsbjlq6vj4v0pc4</a></li>
</ul>
-<h3 id="credits-5">Credits</h3>
+<h3 id="credits-21">Credits</h3>
<ul>
<li>Andrew Rukin (Arenadata) (finder)</li>
<li>Jarek Potiuk (@potiuk) (remediation developer)</li>
@@ -227,18 +542,18 @@
<h2 id="CVE-2026-49486">FTP Provider does not protect FTPS data channel (missing PROT_P)</h2>
<p>CVE-2026-49486 <a href="https://cve.org/CVERecord?id=CVE-2026-49486">[CVE]</a> <a href="./CVE-2026-49486.cve.json">[CVE json]</a> <a href="./CVE-2026-49486.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-26T07:20:08.333Z</em></p>
-<h3 id="affected-6">Affected</h3>
+<h3 id="affected-22">Affected</h3>
<ul>
<li>Apache Airflow FTP provider before 3.15.1</li>
</ul>
-<h3 id="description-6">Description</h3>
+<h3 id="description-22">Description</h3>
<p>The Apache Airflow FTP provider's <code>FTPSHook.get_conn()</code> created an <code>ftplib.FTP_TLS</code> connection but never called <code>prot_p()</code>, so although the control channel was TLS-protected the data channel was transmitted in cleartext. Any deployment using <code>FTPSHook</code> or <code>FTPSFileTransmitOperator</code> to move files over FTPS exposed file contents and credentials-in-transit to a network attacker able to observe the data connection. Upgrade apache-airf [...]
-<h3 id="references-6">References</h3>
+<h3 id="references-22">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67946">https://github.com/apache/airflow/pull/67946</a></li>
<li><a href="https://lists.apache.org/thread/gwnsxlt9hfj5pc543wxtogbnjdn04xj1">https://lists.apache.org/thread/gwnsxlt9hfj5pc543wxtogbnjdn04xj1</a></li>
</ul>
-<h3 id="credits-6">Credits</h3>
+<h3 id="credits-22">Credits</h3>
<ul>
<li>Andrew Rukin (Arenadata) (finder)</li>
<li>Shubham Raj (remediation developer)</li>
@@ -246,18 +561,18 @@
<h2 id="CVE-2026-49298">JWT Token Exposure in KubernetesExecutor Command-Line Arguments</h2>
<p>CVE-2026-49298 <a href="https://cve.org/CVERecord?id=CVE-2026-49298">[CVE]</a> <a href="./CVE-2026-49298.cve.json">[CVE json]</a> <a href="./CVE-2026-49298.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:34:31.163Z</em></p>
-<h3 id="affected-7">Affected</h3>
+<h3 id="affected-23">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.2</li>
</ul>
-<h3 id="description-7">Description</h3>
+<h3 id="description-23">Description</h3>
<p>A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate against the Execution API to be passed to the worker container as command-line arguments visible in the pod spec. An authenticated UI/API user with Kubernetes read-only access to the cluster (e.g. <code>pods/get</code> in the Airflow namespace) could harvest the JWT from <code>kubectl describe pod</code> output and then call state-mutating Execution API endpoints — triggering Dag runs, c [...]
-<h3 id="references-7">References</h3>
+<h3 id="references-23">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/60108">https://github.com/apache/airflow/pull/60108</a></li>
<li><a href="https://lists.apache.org/thread/wo09vrks8189dzsot39rvrx3vnx102tt">https://lists.apache.org/thread/wo09vrks8189dzsot39rvrx3vnx102tt</a></li>
</ul>
-<h3 id="credits-7">Credits</h3>
+<h3 id="credits-23">Credits</h3>
<ul>
<li>Nikolai Dvoinishnikov (<a href="mailto:nikdvy@gmail.com">nikdvy@gmail.com</a>) (finder)</li>
<li>Anton Kuznetsov (<a href="mailto:piratusxp@gmail.com">piratusxp@gmail.com</a>) (finder)</li>
@@ -266,18 +581,18 @@
<h2 id="CVE-2026-49297">Path traversal via GCS object names → local/SFTP filesystem (GCSToSFTPOperator + GCSTimeSpanFileTransformOperator)</h2>
<p>CVE-2026-49297 <a href="https://cve.org/CVERecord?id=CVE-2026-49297">[CVE]</a> <a href="./CVE-2026-49297.cve.json">[CVE json]</a> <a href="./CVE-2026-49297.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-07-04T05:57:06.977Z</em></p>
-<h3 id="affected-8">Affected</h3>
+<h3 id="affected-24">Affected</h3>
<ul>
<li>Apache Airflow Google provider before 22.2.1</li>
</ul>
-<h3 id="description-8">Description</h3>
+<h3 id="description-24">Description</h3>
<p>Apache Airflow's Google provider operators <code>GCSToSFTPOperator</code> and <code>GCSTimeSpanFileTransformOperator</code> joined GCS object names returned by the bucket listing API directly to a destination filesystem path without normalisation or containment check. A user with write access to the source GCS bucket (typically a different trust principal than the DAG author — partner uploads, ingest-only service accounts, public-data buckets) could create an object whose name contain [...]
-<h3 id="references-8">References</h3>
+<h3 id="references-24">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67667">https://github.com/apache/airflow/pull/67667</a></li>
<li><a href="https://lists.apache.org/thread/cb5nvoxsj1q7rv878cyqgtg150w0zglq?users@airflow.apache.org">https://lists.apache.org/thread/cb5nvoxsj1q7rv878cyqgtg150w0zglq?users@airflow.apache.org</a></li>
</ul>
-<h3 id="credits-8">Credits</h3>
+<h3 id="credits-24">Credits</h3>
<ul>
<li>anonymous (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -285,18 +600,18 @@
<h2 id="CVE-2026-49296">Per-DAG read bypass discloses co-located DAGs’ source via GET /api/v2/dagSources/{dag_id}</h2>
<p>CVE-2026-49296 <a href="https://cve.org/CVERecord?id=CVE-2026-49296">[CVE]</a> <a href="./CVE-2026-49296.cve.json">[CVE json]</a> <a href="./CVE-2026-49296.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-07-07T12:26:02.148Z</em></p>
-<h3 id="affected-9">Affected</h3>
+<h3 id="affected-25">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.3.0</li>
</ul>
-<h3 id="description-9">Description</h3>
+<h3 id="description-25">Description</h3>
<p>Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. <code>GET /api/v2/dagSources/{dag_id}</code> — and the equivalent Dag-source view in the UI — returned the entire source file without redacting Dags the caller was not authorized to read, bypassing per-DAG read authorization. Deployments that co-locate multiple Dags in a single file and rely on per-DAG access control to limit source visibility are [...]
-<h3 id="references-9">References</h3>
+<h3 id="references-25">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67662">https://github.com/apache/airflow/pull/67662</a></li>
<li><a href="https://lists.apache.org/thread/qqv41t3oydkn9o14r2rfz1wkdrsp5jzn">https://lists.apache.org/thread/qqv41t3oydkn9o14r2rfz1wkdrsp5jzn</a></li>
</ul>
-<h3 id="credits-9">Credits</h3>
+<h3 id="credits-25">Credits</h3>
<ul>
<li>Matteo Panzeri (Università di Pavia), GitHub @matte1782 (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -304,18 +619,18 @@
<h2 id="CVE-2026-49267">No certificate validation on SMTP STARTTLS connections</h2>
<p>CVE-2026-49267 <a href="https://cve.org/CVERecord?id=CVE-2026-49267">[CVE]</a> <a href="./CVE-2026-49267.cve.json">[CVE json]</a> <a href="./CVE-2026-49267.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:53:11.785Z</em></p>
-<h3 id="affected-10">Affected</h3>
+<h3 id="affected-26">Affected</h3>
<ul>
<li>Apache Airflow from 2.0.0 before 3.2.2</li>
</ul>
-<h3 id="description-10">Description</h3>
+<h3 id="description-26">Description</h3>
<p>Apache Airflow's EmailOperator and the underlying <code>airflow.utils.email</code> helpers established SMTP STARTTLS connections without verifying the remote certificate when the deployment used <code>[email] smtp_starttls=True</code> without <code>[email] smtp_ssl</code>. An attacker positioned between the worker and the configured SMTP server (network MITM — typical hostile-network attack-surface for environments where the SMTP relay sits outside the worker's trust boundary) could p [...]
-<h3 id="references-10">References</h3>
+<h3 id="references-26">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65346">https://github.com/apache/airflow/pull/65346</a></li>
<li><a href="https://lists.apache.org/thread/6v2ds757000msmjmovnnqryqzks83ps0">https://lists.apache.org/thread/6v2ds757000msmjmovnnqryqzks83ps0</a></li>
</ul>
-<h3 id="credits-10">Credits</h3>
+<h3 id="credits-26">Credits</h3>
<ul>
<li>Francis Bergin (@francisbergin) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -323,18 +638,18 @@
<h2 id="CVE-2026-48892">Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options</h2>
<p>CVE-2026-48892 <a href="https://cve.org/CVERecord?id=CVE-2026-48892">[CVE]</a> <a href="./CVE-2026-48892.cve.json">[CVE json]</a> <a href="./CVE-2026-48892.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-07-07T12:25:58.879Z</em></p>
-<h3 id="affected-11">Affected</h3>
+<h3 id="affected-27">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.0</li>
</ul>
-<h3 id="description-11">Description</h3>
+<h3 id="description-27">Description</h3>
<p>The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like <code>AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID</code> and <code>AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID</code>) as synthetic config options whose option names were not in <code>sensitive_config_values</code>, so the masker did not redact them. An authenticated UI/API user with Config read permission could retrieve plaintext secrets-backend credentials (Vault <code>role_ [...]
-<h3 id="references-11">References</h3>
+<h3 id="references-27">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67622">https://github.com/apache/airflow/pull/67622</a></li>
<li><a href="https://lists.apache.org/thread/pq5yy40079h6tzh3fxvw28dd8dbk72hk">https://lists.apache.org/thread/pq5yy40079h6tzh3fxvw28dd8dbk72hk</a></li>
</ul>
-<h3 id="credits-11">Credits</h3>
+<h3 id="credits-27">Credits</h3>
<ul>
<li>Omkhar Arasaratnam (@omkhar) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -342,19 +657,19 @@
<h2 id="CVE-2026-48891">/ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target</h2>
<p>CVE-2026-48891 <a href="https://cve.org/CVERecord?id=CVE-2026-48891">[CVE]</a> <a href="./CVE-2026-48891.cve.json">[CVE json]</a> <a href="./CVE-2026-48891.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-07-07T12:26:00.634Z</em></p>
-<h3 id="affected-12">Affected</h3>
+<h3 id="affected-28">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.0</li>
</ul>
-<h3 id="description-12">Description</h3>
+<h3 id="description-28">Description</h3>
<p>A bug in Apache Airflow's <code>/ui/dependencies</code> scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the <code>dep.source</code> and <code>dep.target</code> fields of trigger / sensor dependency entries. An authenticated UI user with read permission on some Dags could enumerate the identifiers of other Dags they were not authorized to read by inspecting the dependency graph for trigg [...]
-<h3 id="references-12">References</h3>
+<h3 id="references-28">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67627">https://github.com/apache/airflow/pull/67627</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-28563">https://www.cve.org/CVERecord?id=CVE-2026-28563</a></li>
<li><a href="https://lists.apache.org/thread/wzc8nflg94rq6w8f5tvtlo0o3g4wjrfl">https://lists.apache.org/thread/wzc8nflg94rq6w8f5tvtlo0o3g4wjrfl</a></li>
</ul>
-<h3 id="credits-12">Credits</h3>
+<h3 id="credits-28">Credits</h3>
<ul>
<li>Mitchell Benjamin / Revamp Studio (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -362,18 +677,18 @@
<h2 id="CVE-2026-48828">Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key</h2>
<p>CVE-2026-48828 <a href="https://cve.org/CVERecord?id=CVE-2026-48828">[CVE]</a> <a href="./CVE-2026-48828.cve.json">[CVE json]</a> <a href="./CVE-2026-48828.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-07-07T12:25:57.319Z</em></p>
-<h3 id="affected-13">Affected</h3>
+<h3 id="affected-29">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.0</li>
</ul>
-<h3 id="description-13">Description</h3>
+<h3 id="description-29">Description</h3>
<p>The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based <code>should_hide_value_for_key</code> check (which triggers on secret-suffixed key names like <code>*_password</code> / <code>*_token</code> / <code>*_secret</code>) could not fire for JSON-decodable variable values. An authenticated UI/API user with bulk Variable read permission could retrieve plaintext values from JSON variables whose key would otherwise trigger redacti [...]
-<h3 id="references-13">References</h3>
+<h3 id="references-29">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67495">https://github.com/apache/airflow/pull/67495</a></li>
<li><a href="https://lists.apache.org/thread/y9kf314t6dhnv994hr11wj3tbow847yc">https://lists.apache.org/thread/y9kf314t6dhnv994hr11wj3tbow847yc</a></li>
</ul>
-<h3 id="credits-13">Credits</h3>
+<h3 id="credits-29">Credits</h3>
<ul>
<li>Omkhar Arasaratnam (@omkhar) (finder)</li>
<li>Shubham Raj (@shubhamraj-git) (remediation developer)</li>
@@ -381,19 +696,19 @@
<h2 id="CVE-2026-48726">revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path</h2>
<p>CVE-2026-48726 <a href="https://cve.org/CVERecord?id=CVE-2026-48726">[CVE]</a> <a href="./CVE-2026-48726.cve.json">[CVE json]</a> <a href="./CVE-2026-48726.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:35:18.096Z</em></p>
-<h3 id="affected-14">Affected</h3>
+<h3 id="affected-30">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.2</li>
</ul>
-<h3 id="description-14">Description</h3>
+<h3 id="description-30">Description</h3>
<p>A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for <code>FabAuthManager</code> and <code>KeycloakAuthManager</code> did not actually reach the underlying <code>revoke_token()</code> call, so the JWT remained accepted by the API server until its natural expiry. An attacker holding a previously-issued JWT for a logged-out user could continue to make authenticated API calls as that us [...]
-<h3 id="references-14">References</h3>
+<h3 id="references-30">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67289">https://github.com/apache/airflow/pull/67289</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2025-57735">https://www.cve.org/CVERecord?id=CVE-2025-57735</a></li>
<li><a href="https://lists.apache.org/thread/630jg4z6cjkv4m2yv2ljgmf1zhdj1vqx">https://lists.apache.org/thread/630jg4z6cjkv4m2yv2ljgmf1zhdj1vqx</a></li>
</ul>
-<h3 id="credits-14">Credits</h3>
+<h3 id="credits-30">Credits</h3>
<ul>
<li>Bernardo Curi (r3ngar_bugado) (finder)</li>
<li>pierrejeambrun (remediation developer)</li>
@@ -401,18 +716,18 @@
<h2 id="CVE-2026-46764">Event Log detail endpoint bypasses DAG-scoped event log permission filter</h2>
<p>CVE-2026-46764 <a href="https://cve.org/CVERecord?id=CVE-2026-46764">[CVE]</a> <a href="./CVE-2026-46764.cve.json">[CVE json]</a> <a href="./CVE-2026-46764.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:45:46.820Z</em></p>
-<h3 id="affected-15">Affected</h3>
+<h3 id="affected-31">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.2</li>
</ul>
-<h3 id="description-15">Description</h3>
+<h3 id="description-31">Description</h3>
<p>The Event Log detail endpoint <code>GET /api/v2/eventLogs/{event_log_id}</code> in Apache Airflow fetched audit-log rows directly by numeric ID after only the generic Audit Log permission check, while the collection endpoint <code>GET /api/v2/eventLogs</code> applied per-Dag scoping. An authenticated UI/API user with audit-log read permission for one Dag could retrieve audit-log entries for any other Dag by guessing or enumerating the numeric event log ID. Affects deployments that rel [...]
-<h3 id="references-15">References</h3>
+<h3 id="references-31">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67112">https://github.com/apache/airflow/pull/67112</a></li>
<li><a href="https://lists.apache.org/thread/ctrbj7q3m86g4qxmo9ponojgmzrcoqpv">https://lists.apache.org/thread/ctrbj7q3m86g4qxmo9ponojgmzrcoqpv</a></li>
</ul>
-<h3 id="credits-15">Credits</h3>
+<h3 id="credits-31">Credits</h3>
<ul>
<li>Stoyan Stoyanov Trendafilov (trstoyan), independent security researcher (finder)</li>
<li>Pierre Jeambrun (@pierrejeambrun) (remediation developer)</li>
@@ -420,18 +735,18 @@
<h2 id="CVE-2026-46745">LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token</h2>
<p>CVE-2026-46745 <a href="https://cve.org/CVERecord?id=CVE-2026-46745">[CVE]</a> <a href="./CVE-2026-46745.cve.json">[CVE json]</a> <a href="./CVE-2026-46745.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-25T11:30:22.680Z</em></p>
-<h3 id="affected-16">Affected</h3>
+<h3 id="affected-32">Affected</h3>
<ul>
<li>Apache Airflow FAB provider before 3.6.4</li>
</ul>
-<h3 id="description-16">Description</h3>
+<h3 id="description-32">Description</h3>
<p>Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.</p>
-<h3 id="references-16">References</h3>
+<h3 id="references-32">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/66417">https://github.com/apache/airflow/pull/66417</a></li>
<li><a href="https://lists.apache.org/thread/dvfy0bs181xwsrjrd3y5c55ztbzm8yhh">https://lists.apache.org/thread/dvfy0bs181xwsrjrd3y5c55ztbzm8yhh</a></li>
</ul>
-<h3 id="credits-16">Credits</h3>
+<h3 id="credits-32">Credits</h3>
<ul>
<li>Venkatraman Kumar (r3dw0lfsec), Securin (finder)</li>
<li>orbisai0security (automated scanner — Orbis Security AI) (remediation developer)</li>
@@ -439,18 +754,18 @@
<h2 id="CVE-2026-45426">Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access</h2>
<p>CVE-2026-45426 <a href="https://cve.org/CVERecord?id=CVE-2026-45426">[CVE]</a> <a href="./CVE-2026-45426.cve.json">[CVE json]</a> <a href="./CVE-2026-45426.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:47:13.162Z</em></p>
-<h3 id="affected-17">Affected</h3>
+<h3 id="affected-33">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.2</li>
</ul>
-<h3 id="description-17">Description</h3>
+<h3 id="description-33">Description</h3>
<p>Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued for at least one Dag. Apache Airflow's Log server authorized JWT tokens against Dag IDs by applying Python's <code>str.lstrip()</code> to the requested path segment when verifying the JWT's <code>sub</code> claim. <code>str.lstrip()</code> strips any of a <em>set</em> of characters from the left (not a prefix), so a JWT issued for a Dag named e.g. <code>dag_a</code> w [...]
-<h3 id="references-17">References</h3>
+<h3 id="references-33">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/66749">https://github.com/apache/airflow/pull/66749</a></li>
<li><a href="https://lists.apache.org/thread/hz1q7vg65vq2h4fobv5ww8tp257fbqj9">https://lists.apache.org/thread/hz1q7vg65vq2h4fobv5ww8tp257fbqj9</a></li>
</ul>
-<h3 id="credits-17">Credits</h3>
+<h3 id="credits-33">Credits</h3>
<ul>
<li>Michael Lip (theluckystrike) (finder)</li>
<li>Jarek Potiuk (@potiuk) (remediation developer)</li>
@@ -458,18 +773,18 @@
<h2 id="CVE-2026-45361">SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)</h2>
<p>CVE-2026-45361 <a href="https://cve.org/CVERecord?id=CVE-2026-45361">[CVE]</a> <a href="./CVE-2026-45361.cve.json">[CVE json]</a> <a href="./CVE-2026-45361.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T15:48:33.023Z</em></p>
-<h3 id="affected-18">Affected</h3>
+<h3 id="affected-34">Affected</h3>
<ul>
<li>Apache Airflow Google provider before 22.0.0</li>
</ul>
-<h3 id="description-18">Description</h3>
+<h3 id="description-34">Description</h3>
<p>Apache Airflow providers-google's <code>ComputeEngineSSHHook</code> disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to <code>apache-airflow-providers-google</code> 22.0.0 or later.</p>
-<h3 id="references-18">References</h3>
+<h3 id="references-34">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/66746">https://github.com/apache/airflow/pull/66746</a></li>
<li><a href="https://lists.apache.org/thread/3lpj7ppwxp7jtp81rnxk75xvln7qd7h2?users@airflow.apache.org">https://lists.apache.org/thread/3lpj7ppwxp7jtp81rnxk75xvln7qd7h2?users@airflow.apache.org</a></li>
</ul>
-<h3 id="credits-18">Credits</h3>
+<h3 id="credits-34">Credits</h3>
<ul>
<li>anonymous (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -477,36 +792,36 @@
<h2 id="CVE-2026-45360">Arbitrary import in custom deadline-reference deserialization</h2>
<p>CVE-2026-45360 <a href="https://cve.org/CVERecord?id=CVE-2026-45360">[CVE]</a> <a href="./CVE-2026-45360.cve.json">[CVE json]</a> <a href="./CVE-2026-45360.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:48:10.959Z</em></p>
-<h3 id="affected-19">Affected</h3>
+<h3 id="affected-35">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.2</li>
</ul>
-<h3 id="description-19">Description</h3>
+<h3 id="description-35">Description</h3>
<p>Apache Airflow's scheduler-side deadline-reference decoder (<code>SerializedCustomReference.deserialize_reference</code>) imported and dispatched arbitrary class paths drawn from DAG-author-controlled serialized state without an allowlist or plugin-registry gate. A DAG author whose code reaches the scheduler — the default on single-host deployments where the DAG bundle is importable from the scheduler process — could embed a custom <code>DeadlineReference</code> whose serialized form [...]
-<h3 id="references-19">References</h3>
+<h3 id="references-35">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/66737">https://github.com/apache/airflow/pull/66737</a></li>
<li><a href="https://lists.apache.org/thread/q227dghjwgfz8xsxrf2pwpz4wk43zm83">https://lists.apache.org/thread/q227dghjwgfz8xsxrf2pwpz4wk43zm83</a></li>
</ul>
-<h3 id="credits-19">Credits</h3>
+<h3 id="credits-35">Credits</h3>
<ul>
<li>Jarek Potiuk (remediation developer)</li>
</ul>
<h2 id="CVE-2026-45192">Incomplete Redaction of Sensitive Fields in Connection Extra API Response</h2>
<p>CVE-2026-45192 <a href="https://cve.org/CVERecord?id=CVE-2026-45192">[CVE]</a> <a href="./CVE-2026-45192.cve.json">[CVE json]</a> <a href="./CVE-2026-45192.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T06:51:50.457Z</em></p>
-<h3 id="affected-20">Affected</h3>
+<h3 id="affected-36">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.2</li>
</ul>
-<h3 id="description-20">Description</h3>
+<h3 id="description-36">Description</h3>
<p>A bug in the GET <code>/api/v2/connections/{connection_id}</code> REST API endpoint in Apache Airflow allowed an authenticated UI/API user with Connection-read permission to retrieve secrets stored in a Connection's <code>extra</code> JSON blob under field names not present in the redaction allowlist (<code>DEFAULT_SENSITIVE_FIELDS</code>) — for example, official Slack-provider credential field names were returned in plaintext. Affects deployments that store credentials in Connection [...]
-<h3 id="references-20">References</h3>
+<h3 id="references-36">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/66673">https://github.com/apache/airflow/pull/66673</a></li>
<li><a href="https://lists.apache.org/thread/r2q93dg2wp5h9sd9vh6y4y5ljqd9crdd">https://lists.apache.org/thread/r2q93dg2wp5h9sd9vh6y4y5ljqd9crdd</a></li>
</ul>
-<h3 id="credits-20">Credits</h3>
+<h3 id="credits-36">Credits</h3>
<ul>
<li>Or Sahar, Secure From Scratch (finder)</li>
<li>Jarek Potiuk (@potiuk) (remediation developer)</li>
@@ -514,18 +829,18 @@
<h2 id="CVE-2026-43826">OpenSearch task-log handler leaks credentials embedded in the host URL</h2>
<p>CVE-2026-43826 <a href="https://cve.org/CVERecord?id=CVE-2026-43826">[CVE]</a> <a href="./CVE-2026-43826.cve.json">[CVE json]</a> <a href="./CVE-2026-43826.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-10T20:27:25.758Z</em></p>
-<h3 id="affected-21">Affected</h3>
+<h3 id="affected-37">Affected</h3>
<ul>
<li>Apache Airflow Providers OpenSearch before 1.9.1</li>
</ul>
-<h3 id="description-21">Description</h3>
+<h3 id="description-37">Description</h3>
<p>The OpenSearch logging provider, when configured with a <code>host</code> URL that embeds credentials (for example <code>https://user:password@server.example.com:9200</code>), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to <code>apache-airflow-providers-opensearch</code> 1.9.1 or later and, as a defense-in-depth measure, configure the backend cr [...]
-<h3 id="references-21">References</h3>
+<h3 id="references-37">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65509">https://github.com/apache/airflow/pull/65509</a></li>
<li><a href="https://lists.apache.org/thread/bxsrqx1vwssovnwnrvgh9xcosptmf73y">https://lists.apache.org/thread/bxsrqx1vwssovnwnrvgh9xcosptmf73y</a></li>
</ul>
-<h3 id="credits-21">Credits</h3>
+<h3 id="credits-37">Credits</h3>
<ul>
<li>Aleksandr Sozinov (finder)</li>
<li>Owen-CH-Leung (finder)</li>
@@ -534,36 +849,36 @@
<h2 id="CVE-2026-42526">Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends</h2>
<p>CVE-2026-42526 <a href="https://cve.org/CVERecord?id=CVE-2026-42526">[CVE]</a> <a href="./CVE-2026-42526.cve.json">[CVE json]</a> <a href="./CVE-2026-42526.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-20T01:48:06.454Z</em></p>
-<h3 id="affected-22">Affected</h3>
+<h3 id="affected-38">Affected</h3>
<ul>
<li>Apache Airflow Amazon provider before 9.28.0</li>
</ul>
-<h3 id="description-22">Description</h3>
+<h3 id="description-38">Description</h3>
<p>In the AWS Secrets Manager and SSM Parameter Store secrets backends of <code>apache-airflow-providers-amazon</code> prior to 9.28.0, the team-scoping logic could resolve a <code>conn_id</code> containing a <code>/</code> (e.g. <code>&quot;my_team/conn&quot;</code>) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding <code>conn_i [...]
-<h3 id="references-22">References</h3>
+<h3 id="references-38">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65703">https://github.com/apache/airflow/pull/65703</a></li>
<li><a href="https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtyn">https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtyn</a></li>
</ul>
-<h3 id="credits-22">Credits</h3>
+<h3 id="credits-38">Credits</h3>
<ul>
<li>Justin Pakzad (remediation developer)</li>
</ul>
<h2 id="CVE-2026-42360">Rendered template truncation bypasses nested sensitive-key masking</h2>
<p>CVE-2026-42360 <a href="https://cve.org/CVERecord?id=CVE-2026-42360">[CVE]</a> <a href="./CVE-2026-42360.cve.json">[CVE json]</a> <a href="./CVE-2026-42360.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:50:36.896Z</em></p>
-<h3 id="affected-23">Affected</h3>
+<h3 id="affected-39">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.2</li>
</ul>
-<h3 id="description-23">Description</h3>
+<h3 id="description-39">Description</h3>
<p>A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g. nested <code>password</code> / <code>token</code> / <code>secret</code> / <code>api_key</code> keys inside a JSON template structure) to be bypassed when the rendered field exceeded <code>[core] max_templated_field_length</code>: Airflow stringified the structure before redaction, losing the nested key context, and persisted the plaintext value into <code>rendered_fields</code>. An aut [...]
-<h3 id="references-23">References</h3>
+<h3 id="references-39">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65906">https://github.com/apache/airflow/pull/65906</a></li>
<li><a href="https://lists.apache.org/thread/obj79bpxnl7r5olz1gsn0g94y88glnl4">https://lists.apache.org/thread/obj79bpxnl7r5olz1gsn0g94y88glnl4</a></li>
</ul>
-<h3 id="credits-23">Credits</h3>
+<h3 id="credits-39">Credits</h3>
<ul>
<li>Vincent55 (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -571,19 +886,19 @@
<h2 id="CVE-2026-42359">Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator</h2>
<p>CVE-2026-42359 <a href="https://cve.org/CVERecord?id=CVE-2026-42359">[CVE]</a> <a href="./CVE-2026-42359.cve.json">[CVE json]</a> <a href="./CVE-2026-42359.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T15:13:25.919Z</em></p>
-<h3 id="affected-24">Affected</h3>
+<h3 id="affected-40">Affected</h3>
<ul>
<li>Apache Airflow from 3.2.0 before 3.2.2</li>
</ul>
-<h3 id="description-24">Description</h3>
+<h3 id="description-40">Description</h3>
<p>A bug in Apache Airflow's XCom PATCH endpoint <code>PATCH /api/v2/xcomEntries/{key}</code> allowed an authenticated UI/API user with XCom write permission on a Dag to set XCom entries under reserved key names (e.g. <code>return_value</code>) that the matching POST endpoint already validated against <code>FORBIDDEN_XCOM_KEYS</code>. The endpoint also accepted serialized payload shapes the triggerer's deserializer treats as code; combined, this allowed RCE on the triggerer when the affe [...]
-<h3 id="references-24">References</h3>
+<h3 id="references-40">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65915">https://github.com/apache/airflow/pull/65915</a></li>
<li><a href="https://lists.apache.org/thread/g8dqykpf1p90tysq8tln4qtkqwb1038s">https://lists.apache.org/thread/g8dqykpf1p90tysq8tln4qtkqwb1038s</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-33858">https://www.cve.org/CVERecord?id=CVE-2026-33858</a></li>
</ul>
-<h3 id="credits-24">Credits</h3>
+<h3 id="credits-40">Credits</h3>
<ul>
<li>Jeff Vier (@boinger) (finder)</li>
<li>Anisto Mejin (Izat) (finder)</li>
@@ -593,18 +908,18 @@
<h2 id="CVE-2026-42358">Variable masker depth-limit bypass returns cleartext nested secrets</h2>
<p>CVE-2026-42358 <a href="https://cve.org/CVERecord?id=CVE-2026-42358">[CVE]</a> <a href="./CVE-2026-42358.cve.json">[CVE json]</a> <a href="./CVE-2026-42358.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:49:56.426Z</em></p>
-<h3 id="affected-25">Affected</h3>
+<h3 id="affected-41">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.2</li>
</ul>
-<h3 id="description-25">Description</h3>
+<h3 id="description-41">Description</h3>
<p>A bug in Apache Airflow's Variable response masker caused nested-key redaction (triggered by secret-suffixed key names like <code>password</code>, <code>token</code>, <code>secret</code>, <code>api_key</code>) to be bypassed when the JSON value's nesting depth exceeded the shared secrets masker's recursion limit: the masker returned the original nested item before checking the sensitive key name. An authenticated UI/API user with Variable read permission could harvest plaintext secret [...]
-<h3 id="references-25">References</h3>
+<h3 id="references-41">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65912">https://github.com/apache/airflow/pull/65912</a></li>
<li><a href="https://lists.apache.org/thread/33635mv3zjb75wn5453c5yf9trs8x2om">https://lists.apache.org/thread/33635mv3zjb75wn5453c5yf9trs8x2om</a></li>
</ul>
-<h3 id="credits-25">Credits</h3>
+<h3 id="credits-41">Credits</h3>
<ul>
<li>Vincent55 (confirmed in original report sign-off) (finder)</li>
<li>Aymane MAZGUITI – unclej4ck (finder)</li>
@@ -614,18 +929,18 @@
<h2 id="CVE-2026-42252">BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern</h2>
<p>CVE-2026-42252 <a href="https://cve.org/CVERecord?id=CVE-2026-42252">[CVE]</a> <a href="./CVE-2026-42252.cve.json">[CVE json]</a> <a href="./CVE-2026-42252.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:51:17.651Z</em></p>
-<h3 id="affected-26">Affected</h3>
+<h3 id="affected-42">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.2</li>
</ul>
-<h3 id="description-26">Description</h3>
+<h3 id="description-42">Description</h3>
<p>Apache Airflow's official documentation at <code>core-concepts/dag-run.html</code> ("Passing Parameters when triggering Dags") showed a verbatim <code>BashOperator(bash_command=&quot;echo value: {{ dag_run.conf[&#x27;conf1&#x27;] }}&quot;)</code> example without any quoting / sanitization warning. Dag authors who copied the pattern verbatim into deployments where users had <code>Dag.can_trigger</code> permission on the affected Dag (typical multi-team deploym [...]
-<h3 id="references-26">References</h3>
+<h3 id="references-42">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/64129">https://github.com/apache/airflow/pull/64129</a></li>
<li><a href="https://lists.apache.org/thread/8f4sc0rfn154jprmnwtmlst4p9zfw3w7">https://lists.apache.org/thread/8f4sc0rfn154jprmnwtmlst4p9zfw3w7</a></li>
</ul>
-<h3 id="credits-26">Credits</h3>
+<h3 id="credits-42">Credits</h3>
<ul>
<li>anonymous (finder)</li>
<li>Kevin Yang (sjyangkevin) (remediation developer)</li>
@@ -633,18 +948,18 @@
<h2 id="CVE-2026-41084">API authorization bypass: bulk TaskInstances allows cross-DAG mutation</h2>
<p>CVE-2026-41084 <a href="https://cve.org/CVERecord?id=CVE-2026-41084">[CVE]</a> <a href="./CVE-2026-41084.cve.json">[CVE json]</a> <a href="./CVE-2026-41084.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:51:55.264Z</em></p>
-<h3 id="affected-27">Affected</h3>
+<h3 id="affected-43">Affected</h3>
<ul>
<li>Apache Airflow from 3.2.0 before 3.2.2</li>
</ul>
-<h3 id="description-27">Description</h3>
+<h3 id="description-43">Description</h3>
<p>A bug in Apache Airflow's bulk Task Instances API (<code>PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances</code>) evaluated authorization against the <code>dag_id</code> resolved from the URL path while operating on the <code>dag_id</code> / <code>dag_run_id</code> extracted from request-body entity fields. An authenticated UI/API user with edit permission on one Dag could mutate Task Instance state in any other Dag by keeping the authorized Dag's ID in the URL pa [...]
-<h3 id="references-27">References</h3>
+<h3 id="references-43">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/64288">https://github.com/apache/airflow/pull/64288</a></li>
<li><a href="https://lists.apache.org/thread/w0hdcqfr71hf9rl1bwvpjs7q9yp1bldk">https://lists.apache.org/thread/w0hdcqfr71hf9rl1bwvpjs7q9yp1bldk</a></li>
</ul>
-<h3 id="credits-27">Credits</h3>
+<h3 id="credits-43">Credits</h3>
<ul>
<li>Pirikara (finder)</li>
<li>GPK (gopidesupavan) (remediation developer)</li>
@@ -652,18 +967,18 @@
<h2 id="CVE-2026-41018">Elasticsearch task-log handler leaks credentials embedded in the host URL</h2>
<p>CVE-2026-41018 <a href="https://cve.org/CVERecord?id=CVE-2026-41018">[CVE]</a> <a href="./CVE-2026-41018.cve.json">[CVE json]</a> <a href="./CVE-2026-41018.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-10T20:38:57.776Z</em></p>
-<h3 id="affected-28">Affected</h3>
+<h3 id="affected-44">Affected</h3>
<ul>
<li>Apache Airflow Providers Elasticsearch before 6.5.3</li>
</ul>
-<h3 id="description-28">Description</h3>
+<h3 id="description-44">Description</h3>
<p>The Elasticsearch logging provider, when configured with a <code>host</code> URL that embeds credentials (for example <code>https://user:password@server.example.com:9200</code>), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to <code>apache-airflow-providers-elasticsearch</code> 6.5.3 or later and, as a defense-in-depth measure, configure the back [...]
-<h3 id="references-28">References</h3>
+<h3 id="references-44">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65349">https://github.com/apache/airflow/pull/65349</a></li>
<li><a href="https://lists.apache.org/thread/wz5l58drprmwlv6jxnq466x24jqbbhp7">https://lists.apache.org/thread/wz5l58drprmwlv6jxnq466x24jqbbhp7</a></li>
</ul>
-<h3 id="credits-28">Credits</h3>
+<h3 id="credits-44">Credits</h3>
<ul>
<li>Aleksandr Sozinov (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -671,18 +986,18 @@
<h2 id="CVE-2026-41017">JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy</h2>
<p>CVE-2026-41017 <a href="https://cve.org/CVERecord?id=CVE-2026-41017">[CVE]</a> <a href="./CVE-2026-41017.cve.json">[CVE json]</a> <a href="./CVE-2026-41017.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:52:32.340Z</em></p>
-<h3 id="affected-29">Affected</h3>
+<h3 id="affected-45">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.2</li>
</ul>
-<h3 id="description-29">Description</h3>
+<h3 id="description-45">Description</h3>
<p>Apache Airflow's <code>JWTRefreshMiddleware</code> set the JWT auth cookie without the <code>Secure</code> flag, so deployments running the Airflow API server behind an HTTPS-terminating reverse proxy (e.g. nginx / Envoy / a managed load balancer that terminates TLS and forwards plaintext to the API server, the default cloud-native topology) would have the user's session JWT replayed over any cleartext HTTP request to the same host. A network-positioned attacker (Wi-Fi MITM, hostile L [...]
-<h3 id="references-29">References</h3>
+<h3 id="references-45">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65348">https://github.com/apache/airflow/pull/65348</a></li>
<li><a href="https://lists.apache.org/thread/9jx0sk49c1250zflx0q3clc717qgjdch">https://lists.apache.org/thread/9jx0sk49c1250zflx0q3clc717qgjdch</a></li>
</ul>
-<h3 id="credits-29">Credits</h3>
+<h3 id="credits-45">Credits</h3>
<ul>
<li>Ran (@eddieran) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -690,18 +1005,18 @@
<h2 id="CVE-2026-41016">No certificate validation on SMTP STARTTLS connections (SMTP provider — split from #265) ##</h2>
<p>CVE-2026-41016 <a href="https://cve.org/CVERecord?id=CVE-2026-41016">[CVE]</a> <a href="./CVE-2026-41016.cve.json">[CVE json]</a> <a href="./CVE-2026-41016.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-29T08:45:19.890Z</em></p>
-<h3 id="affected-30">Affected</h3>
+<h3 id="affected-46">Affected</h3>
<ul>
<li>Apache Airflow Providers SMTP from 2.0.0 before 3.0.0</li>
</ul>
-<h3 id="description-30">Description</h3>
+<h3 id="description-46">Description</h3>
<p>Apache Airflow’s SMTP provider <code>SmtpHook</code> called Python’s <code>smtplib.SMTP.starttls()</code> without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS upgrade, and capture the SMTP credentials sent during the subsequent <code>login()</code> call. Users are advised to upgrade to the <code>apache-airflow-p [...]
-<h3 id="references-30">References</h3>
+<h3 id="references-46">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65346">https://github.com/apache/airflow/pull/65346</a></li>
<li><a href="https://lists.apache.org/thread/gb202qy5r31bgdd3d51d7s5o1jh40kc4">https://lists.apache.org/thread/gb202qy5r31bgdd3d51d7s5o1jh40kc4</a></li>
</ul>
-<h3 id="credits-30">Credits</h3>
+<h3 id="credits-46">Credits</h3>
<ul>
<li>Francis Bergin (@francisbergin) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -709,18 +1024,18 @@
<h2 id="CVE-2026-41014">per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints</h2>
<p>CVE-2026-41014 <a href="https://cve.org/CVERecord?id=CVE-2026-41014">[CVE]</a> <a href="./CVE-2026-41014.cve.json">[CVE json]</a> <a href="./CVE-2026-41014.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:53:50.879Z</em></p>
-<h3 id="affected-31">Affected</h3>
+<h3 id="affected-47">Affected</h3>
<ul>
<li>Apache Airflow from 3.2.0 before 3.2.2</li>
</ul>
-<h3 id="description-31">Description</h3>
+<h3 id="description-47">Description</h3>
<p>The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization. An authenticated UI/API user with global Asset:read permission could enumerate partition run state, schedule configuration, and asset wiring for Dags they were not authorized to read. Affects deployments that rely on per-Dag read scoping while granting users broader Asset access. Users are advised to upgrade to <code>apache-airflow</code> 3.2.2 or later.</p>
-<h3 id="references-31">References</h3>
+<h3 id="references-47">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65344">https://github.com/apache/airflow/pull/65344</a></li>
<li><a href="https://lists.apache.org/thread/12nbzwwby7g883w2j13gn7ny1545xob9">https://lists.apache.org/thread/12nbzwwby7g883w2j13gn7ny1545xob9</a></li>
</ul>
-<h3 id="credits-31">Credits</h3>
+<h3 id="credits-47">Credits</h3>
<ul>
<li>Yalguun Tumenkhuu (fg0x0) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -728,18 +1043,18 @@
<h2 id="CVE-2026-40963">DAG authorization bypass on /ui/structure/structure_data</h2>
<p>CVE-2026-40963 <a href="https://cve.org/CVERecord?id=CVE-2026-40963">[CVE]</a> <a href="./CVE-2026-40963.cve.json">[CVE json]</a> <a href="./CVE-2026-40963.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:54:32.443Z</em></p>
-<h3 id="affected-32">Affected</h3>
+<h3 id="affected-48">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.2</li>
</ul>
-<h3 id="description-32">Description</h3>
+<h3 id="description-48">Description</h3>
<p>The structure_data endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking whether the caller had read permission on those linked Dags. An authenticated UI/API user authorized for one Dag could enumerate linked Dag IDs and dependency metadata for other Dags they were not authorized to read. Affects deployments that rely on per-Dag read scoping to keep Dag dependency topology private across teams. Users are advised to upgrade to <code>apache [...]
-<h3 id="references-32">References</h3>
+<h3 id="references-48">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65342">https://github.com/apache/airflow/pull/65342</a></li>
<li><a href="https://lists.apache.org/thread/s907bhsksc37m59f0loqjcp1ryobrr60">https://lists.apache.org/thread/s907bhsksc37m59f0loqjcp1ryobrr60</a></li>
</ul>
-<h3 id="credits-32">Credits</h3>
+<h3 id="credits-48">Credits</h3>
<ul>
<li>Masamune - Unit515 OPSWAT (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -747,18 +1062,18 @@
<h2 id="CVE-2026-40961">Open Redirect Bypass Vulnerability</h2>
<p>CVE-2026-40961 <a href="https://cve.org/CVERecord?id=CVE-2026-40961">[CVE]</a> <a href="./CVE-2026-40961.cve.json">[CVE json]</a> <a href="./CVE-2026-40961.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:55:03.222Z</em></p>
-<h3 id="affected-33">Affected</h3>
+<h3 id="affected-49">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.2</li>
</ul>
-<h3 id="description-33">Description</h3>
+<h3 id="description-49">Description</h3>
<p>A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the <code>is_safe_url</code> check, enabling redirection from a trusted Airflow domain to an attacker-controlled origin. Users are advised to upgrade to <code>apache-airflow</code> 3.2.2 or later. As a defense-in-depth mitigation, deployment operators can place Airflow behind a reverse proxy that strips off-domain <code>next=</code> query parameters before they reach the login e [...]
-<h3 id="references-33">References</h3>
+<h3 id="references-49">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65557">https://github.com/apache/airflow/pull/65557</a></li>
<li><a href="https://lists.apache.org/thread/qmt8ksh7gty6b8hr9w294t94j36jdv1q">https://lists.apache.org/thread/qmt8ksh7gty6b8hr9w294t94j36jdv1q</a></li>
</ul>
-<h3 id="credits-33">Credits</h3>
+<h3 id="credits-49">Credits</h3>
<ul>
<li>Fushuling@secsys (finder)</li>
<li>RacerZ@secsys (finder)</li>
@@ -767,36 +1082,36 @@
<h2 id="CVE-2026-40948">OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager</h2>
<p>CVE-2026-40948 <a href="https://cve.org/CVERecord?id=CVE-2026-40948">[CVE]</a> <a href="./CVE-2026-40948.cve.json">[CVE json]</a> <a href="./CVE-2026-40948.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-19T23:44:07.936Z</em></p>
-<h3 id="affected-34">Affected</h3>
+<h3 id="affected-50">Affected</h3>
<ul>
<li>Apache Airflow Providers Keycloak from 0.0.1 before 0.7.0</li>
</ul>
-<h3 id="description-34">Description</h3>
+<h3 id="description-50">Description</h3>
<p>The Keycloak authentication manager in <code>apache-airflow-providers-keycloak</code> did not generate or validate the OAuth 2.0 <code>state</code> parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim’s browser and cause the victim to be logged into the attacker’s Airflow session (login-CSRF / session fixation), where any credentials the victim subsequently [...]
-<h3 id="references-34">References</h3>
+<h3 id="references-50">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/64114">https://github.com/apache/airflow/pull/64114</a></li>
<li><a href="https://lists.apache.org/thread/kc0odpr70hbqhdb9ksnz42fkqz2xld9q">https://lists.apache.org/thread/kc0odpr70hbqhdb9ksnz42fkqz2xld9q</a></li>
</ul>
-<h3 id="credits-34">Credits</h3>
+<h3 id="credits-50">Credits</h3>
<ul>
<li>Haruki Oyama (Waseda University) (finder)</li>
</ul>
<h2 id="CVE-2026-40861">Arbitrary File Read via Log Symlink following in FileTaskHandler</h2>
<p>CVE-2026-40861 <a href="https://cve.org/CVERecord?id=CVE-2026-40861">[CVE]</a> <a href="./CVE-2026-40861.cve.json">[CVE json]</a> <a href="./CVE-2026-40861.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:55:36.142Z</em></p>
-<h3 id="affected-35">Affected</h3>
+<h3 id="affected-51">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.2</li>
</ul>
-<h3 id="description-35">Description</h3>
+<h3 id="description-51">Description</h3>
<p>A Dag author could either (a) create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process (read-path attack — e.g. <code>/etc/passwd</code> or <code>airflow.cfg</code>) or (b) supply a <code>task_id</code> containing <code>..</code> sequences accepted by the Task SDK's <code>KEY_REGEX</code> (write-path attack), and in both cases the FileTaskHandler resolves the log path outside the configured <code>base_log_folder</code>, leaking [...]
-<h3 id="references-35">References</h3>
+<h3 id="references-51">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65325">https://github.com/apache/airflow/pull/65325</a></li>
<li><a href="https://lists.apache.org/thread/823334db2559xjlwt59gpzjz47thnscl">https://lists.apache.org/thread/823334db2559xjlwt59gpzjz47thnscl</a></li>
</ul>
-<h3 id="credits-35">Credits</h3>
+<h3 id="credits-51">Credits</h3>
<ul>
<li>Silas Boch (finder)</li>
<li>Lakshmikanthan K (letchupkt) (finder)</li>
@@ -805,18 +1120,18 @@
<h2 id="CVE-2026-40690">Assets graph view bypasses DAG level access control displaying unrelated topologies and all DAGs names to unauthorized users</h2>
<p>CVE-2026-40690 <a href="https://cve.org/CVERecord?id=CVE-2026-40690">[CVE]</a> <a href="./CVE-2026-40690.cve.json">[CVE json]</a> <a href="./CVE-2026-40690.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-24T12:35:28.702Z</em></p>
-<h3 id="affected-36">Affected</h3>
+<h3 id="affected-52">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.1</li>
</ul>
-<h3 id="description-36">Description</h3>
+<h3 id="description-52">Description</h3>
<p>The asset dependency graph did not restrict nodes by the viewer’s DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment and learn the existence and names of DAGs and assets outside their authorized scope.<br><br>Users are recommended to upgrade to version 3.2.1, which fixes this issue.<br></p>
-<h3 id="references-36">References</h3>
+<h3 id="references-52">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65273">https://github.com/apache/airflow/pull/65273</a></li>
<li><a href="https://lists.apache.org/thread/bqt7y4g2cpj396b0sd20lv510ff19ndl">https://lists.apache.org/thread/bqt7y4g2cpj396b0sd20lv510ff19ndl</a></li>
</ul>
-<h3 id="credits-36">Credits</h3>
+<h3 id="credits-52">Credits</h3>
<ul>
<li>Saurabh (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -824,18 +1139,18 @@
<h2 id="CVE-2026-38743">Dags endpoint might provide access to otherwise inaccessible entities</h2>
<p>CVE-2026-38743 <a href="https://cve.org/CVERecord?id=CVE-2026-38743">[CVE]</a> <a href="./CVE-2026-38743.cve.json">[CVE json]</a> <a href="./CVE-2026-38743.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-24T12:36:37.917Z</em></p>
-<h3 id="affected-37">Affected</h3>
+<h3 id="affected-53">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.1</li>
</ul>
-<h3 id="description-37">Description</h3>
+<h3 id="description-53">Description</h3>
<p></p><span style="background-color: rgb(255, 255, 255);">The authenticated </span><code>/ui/dags</code><span style="background-color: rgb(255, 255, 255);"> endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance records: a logged-in Airflow user with read access to at least one DAG could retrieve HITL prompts (including their request parameters) and full TaskInstance details for DAGs outside their authorized scope. Because HITL prompts [...]
-<h3 id="references-37">References</h3>
+<h3 id="references-53">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/64822">https://github.com/apache/airflow/pull/64822</a></li>
<li><a href="https://lists.apache.org/thread/sk2wj0x48o8qb4p7c47gvnhjbm0mg396">https://lists.apache.org/thread/sk2wj0x48o8qb4p7c47gvnhjbm0mg396</a></li>
</ul>
-<h3 id="credits-37">Credits</h3>
+<h3 id="credits-53">Credits</h3>
<ul>
<li>Jed Cunningham (finder)</li>
<li>Kevin Yang (remediation developer)</li>
@@ -843,18 +1158,18 @@
<h2 id="CVE-2026-34538">Authorization bypass in DagRun wait endpoint (XCom exposure)</h2>
<p>CVE-2026-34538 <a href="https://cve.org/CVERecord?id=CVE-2026-34538">[CVE]</a> <a href="./CVE-2026-34538.cve.json">[CVE json]</a> <a href="./CVE-2026-34538.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-09T09:09:19.260Z</em></p>
-<h3 id="affected-38">Affected</h3>
+<h3 id="affected-54">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.0</li>
</ul>
-<h3 id="description-38">Description</h3>
+<h3 id="description-54">Description</h3>
<p>Apache Airflow versions 3.0.0 through 3.1.8 <span style="background-color: rgb(255, 255, 255);">DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.<span style="background-color: rgb(255, 255, 255);">This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security model documentation that defines the Viewer role as read-only.</span><br></span><br><span st [...]
-<h3 id="references-38">References</h3>
+<h3 id="references-54">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/64415">https://github.com/apache/airflow/pull/64415</a></li>
<li><a href="https://lists.apache.org/thread/9mq3msqhmgjwdzbr6bgthj4brb3oz9fl">https://lists.apache.org/thread/9mq3msqhmgjwdzbr6bgthj4brb3oz9fl</a></li>
</ul>
-<h3 id="credits-38">Credits</h3>
+<h3 id="credits-54">Credits</h3>
<ul>
<li>selen (finder)</li>
<li>Kevin Yang (remediation developer)</li>
@@ -862,18 +1177,18 @@
<h2 id="CVE-2026-33858">Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API</h2>
<p>CVE-2026-33858 <a href="https://cve.org/CVERecord?id=CVE-2026-33858">[CVE]</a> <a href="./CVE-2026-33858.cve.json">[CVE json]</a> <a href="./CVE-2026-33858.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-13T14:36:29.251Z</em></p>
-<h3 id="affected-39">Affected</h3>
+<h3 id="affected-55">Affected</h3>
<ul>
<li>Apache Airflow from 3.1.8 before 3.2.0</li>
</ul>
-<h3 id="description-39">Description</h3>
+<h3 id="description-55">Description</h3>
<p>Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low.</p><br>Users are recommended to upgrade to Apache Airflow 3.2.0, which resolves this issue.<br><br><br><br>
-<h3 id="references-39">References</h3>
+<h3 id="references-55">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/64148">https://github.com/apache/airflow/pull/64148</a></li>
<li><a href="https://lists.apache.org/thread/1npt3o2x81s0gw9tmfcv4n7p1z9hdmy0">https://lists.apache.org/thread/1npt3o2x81s0gw9tmfcv4n7p1z9hdmy0</a></li>
</ul>
-<h3 id="credits-39">Credits</h3>
+<h3 id="credits-55">Credits</h3>
<ul>
<li>wooseokdotkim (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -881,19 +1196,19 @@
<h2 id="CVE-2026-33264">DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()</h2>
<p>CVE-2026-33264 <a href="https://cve.org/CVERecord?id=CVE-2026-33264">[CVE]</a> <a href="./CVE-2026-33264.cve.json">[CVE json]</a> <a href="./CVE-2026-33264.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-07-07T12:25:55.676Z</em></p>
-<h3 id="affected-40">Affected</h3>
+<h3 id="affected-56">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.0</li>
</ul>
-<h3 id="description-40">Description</h3>
+<h3 id="description-56">Description</h3>
<p>A bug in <code>BaseSerialization.deserialize()</code> allowed unrestricted <code>import_string()</code> of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Users are advised to upgrade to <code>apache-airflow</code> 3.3.0 or [...]
-<h3 id="references-40">References</h3>
+<h3 id="references-56">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/66002">https://github.com/apache/airflow/pull/66002</a></li>
<li><a href="https://github.com/apache/airflow/pull/68528">https://github.com/apache/airflow/pull/68528</a></li>
<li><a href="https://lists.apache.org/thread/otvdw8qt2y7xy2n5nq9xby9ky4rf5ltj">https://lists.apache.org/thread/otvdw8qt2y7xy2n5nq9xby9ky4rf5ltj</a></li>
</ul>
-<h3 id="credits-40">Credits</h3>
+<h3 id="credits-56">Credits</h3>
<ul>
<li>Ziyu Lin (finder)</li>
<li>bugbunny.ai (tool)</li>
@@ -905,18 +1220,18 @@
<h2 id="CVE-2026-32794">TLS Certificate Verification Disabled in Databricks Provider K8s Token Exchange</h2>
<p>CVE-2026-32794 <a href="https://cve.org/CVERecord?id=CVE-2026-32794">[CVE]</a> <a href="./CVE-2026-32794.cve.json">[CVE json]</a> <a href="./CVE-2026-32794.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-30T21:43:36.022Z</em></p>
-<h3 id="affected-41">Affected</h3>
+<h3 id="affected-57">Affected</h3>
<ul>
<li>Apache Airflow Provider for Databricks from 1.10.0 before 1.12.0</li>
</ul>
-<h3 id="description-41">Description</h3>
+<h3 id="description-57">Description</h3>
<p>Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o notice.</p><p>This issue affects Apache Airflow Provider for Databricks: from 1.10.0 before 1.12.0.</p><p>Users are recommended to upgrade to version 1.12.0, which fixes the issue.</p>
-<h3 id="references-41">References</h3>
+<h3 id="references-57">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/63704">https://github.com/apache/airflow/pull/63704</a></li>
<li><a href="https://lists.apache.org/thread/hn17yqsgsdtl81llvhf80rkp53hnz5nb">https://lists.apache.org/thread/hn17yqsgsdtl81llvhf80rkp53hnz5nb</a></li>
</ul>
-<h3 id="credits-41">Credits</h3>
+<h3 id="credits-57">Credits</h3>
<ul>
<li>Kai Aizen (reporter)</li>
<li>Marcin Wojtyczka (remediation developer)</li>
@@ -924,18 +1239,18 @@
<h2 id="CVE-2026-32690">3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1</h2>
<p>CVE-2026-32690 <a href="https://cve.org/CVERecord?id=CVE-2026-32690">[CVE]</a> <a href="./CVE-2026-32690.cve.json">[CVE json]</a> <a href="./CVE-2026-32690.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-18T02:36:09.517Z</em></p>
-<h3 id="affected-42">Affected</h3>
+<h3 id="affected-58">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.0</li>
</ul>
-<h3 id="description-42">Description</h3>
+<h3 id="description-58">Description</h3>
<p>Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked.<br><br>If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to Apache Airflow 3.2.0 that has the fix implemented<br><br></p>
-<h3 id="references-42">References</h3>
+<h3 id="references-58">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/63480">https://github.com/apache/airflow/pull/63480</a></li>
<li><a href="https://lists.apache.org/thread/7rnzxofntcznqxnhsmjvvlvygwph7rn5">https://lists.apache.org/thread/7rnzxofntcznqxnhsmjvvlvygwph7rn5</a></li>
</ul>
-<h3 id="credits-42">Credits</h3>
+<h3 id="credits-58">Credits</h3>
<ul>
<li>Nguyen Anh Binh [IA Lab – FPT University] (finder)</li>
<li>Kevin Yang (remediation developer)</li>
@@ -943,18 +1258,18 @@
<h2 id="CVE-2026-32228">Users with asset materialization permisssions could trigger Dags they had no access to</h2>
<p>CVE-2026-32228 <a href="https://cve.org/CVERecord?id=CVE-2026-32228">[CVE]</a> <a href="./CVE-2026-32228.cve.json">[CVE json]</a> <a href="./CVE-2026-32228.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-18T02:42:30.328Z</em></p>
-<h3 id="affected-43">Affected</h3>
+<h3 id="affected-59">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.0</li>
</ul>
-<h3 id="description-43">Description</h3>
+<h3 id="description-59">Description</h3>
<p>UI / API User with asset materialize permission could trigger dags they had no access to.<br>Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.</p>
-<h3 id="references-43">References</h3>
+<h3 id="references-59">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/63338">https://github.com/apache/airflow/pull/63338</a></li>
<li><a href="https://lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0nj">https://lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0nj</a></li>
</ul>
-<h3 id="credits-43">Credits</h3>
+<h3 id="credits-59">Credits</h3>
<ul>
<li>Masamune - Unit515 OPSWAT (finder)</li>
<li>Ahmad Abuzaid (finder)</li>
@@ -963,20 +1278,20 @@
<h2 id="CVE-2026-31987">JWT token appearing in logs</h2>
<p>CVE-2026-31987 <a href="https://cve.org/CVERecord?id=CVE-2026-31987">[CVE]</a> <a href="./CVE-2026-31987.cve.json">[CVE json]</a> <a href="./CVE-2026-31987.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-16T17:49:35.608Z</em></p>
-<h3 id="affected-44">Affected</h3>
+<h3 id="affected-60">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.0</li>
</ul>
-<h3 id="description-44">Description</h3>
+<h3 id="description-60">Description</h3>
<p>JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. <br>Users are advised to upgrade to Airflow version that contains fix.<br><br>Users are recommended to upgrade to version 3.2.0, which fixes this issue. <br><br></p>
-<h3 id="references-44">References</h3>
+<h3 id="references-60">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/62964">https://github.com/apache/airflow/pull/62964</a></li>
<li><a href="https://github.com/apache/airflow/issues/62428">https://github.com/apache/airflow/issues/62428</a></li>
<li><a href="https://github.com/apache/airflow/issues/62773">https://github.com/apache/airflow/issues/62773</a></li>
<li><a href="https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g">https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g</a></li>
</ul>
-<h3 id="credits-44">Credits</h3>
+<h3 id="credits-60">Credits</h3>
<ul>
<li>unixengineer (finder)</li>
<li>Jason Imison (finder)</li>
@@ -985,18 +1300,18 @@
<h2 id="CVE-2026-30912">Exposing stack trace in case of constraint error</h2>
<p>CVE-2026-30912 <a href="https://cve.org/CVERecord?id=CVE-2026-30912">[CVE]</a> <a href="./CVE-2026-30912.cve.json">[CVE json]</a> <a href="./CVE-2026-30912.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-18T02:41:53.492Z</em></p>
-<h3 id="affected-45">Affected</h3>
+<h3 id="affected-61">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.0</li>
</ul>
-<h3 id="description-45">Description</h3>
+<h3 id="description-61">Description</h3>
<p>In case of SQL errors, exception/stack trace of errors was exposed in API even if “api/expose_stack_traces” was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.</p>
-<h3 id="references-45">References</h3>
+<h3 id="references-61">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/63028">https://github.com/apache/airflow/pull/63028</a></li>
<li><a href="https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9">https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9</a></li>
</ul>
-<h3 id="credits-45">Credits</h3>
+<h3 id="credits-61">Credits</h3>
<ul>
<li>Masamune - Unit515 OPSWAT (finder)</li>
<li>Jason(Zhe-You) Liu (remediation developer)</li>
@@ -1004,18 +1319,18 @@
<h2 id="CVE-2026-30911">Execution API HITL Endpoints Missing Per-Task Authorization</h2>
<p>CVE-2026-30911 <a href="https://cve.org/CVERecord?id=CVE-2026-30911">[CVE]</a> <a href="./CVE-2026-30911.cve.json">[CVE json]</a> <a href="./CVE-2026-30911.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-17T10:53:00.535Z</em></p>
-<h3 id="affected-46">Affected</h3>
+<h3 id="affected-62">Affected</h3>
<ul>
<li>Apache Airflow from 3.1.0 before 3.1.8</li>
</ul>
-<h3 id="description-46">Description</h3>
+<h3 id="description-62">Description</h3>
<p>Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API’s Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance.<br><br><br>Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.<br><br></p>
-<h3 id="references-46">References</h3>
+<h3 id="references-62">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/62886">https://github.com/apache/airflow/pull/62886</a></li>
<li><a href="https://lists.apache.org/thread/1rs2v7fcko2otl6n9ytthcj87cmsgx51">https://lists.apache.org/thread/1rs2v7fcko2otl6n9ytthcj87cmsgx51</a></li>
</ul>
-<h3 id="credits-46">Credits</h3>
+<h3 id="credits-62">Credits</h3>
<ul>
<li>Kai Aizen (finder)</li>
<li>Aritra Basu (remediation developer)</li>
@@ -1023,18 +1338,18 @@
<h2 id="CVE-2026-30898">Bad example of BashOperator shell injection via dag_run.conf</h2>
<p>CVE-2026-30898 <a href="https://cve.org/CVERecord?id=CVE-2026-30898">[CVE]</a> <a href="./CVE-2026-30898.cve.json">[CVE json]</a> <a href="./CVE-2026-30898.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-18T02:40:37.049Z</em></p>
-<h3 id="affected-47">Affected</h3>
+<h3 id="affected-63">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.0</li>
</ul>
-<h3 id="description-47">Description</h3>
+<h3 id="description-63">Description</h3>
<p>An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker. Users should review if any of their own DAGs have adopted this incorrect advice.<br></p>
-<h3 id="references-47">References</h3>
+<h3 id="references-63">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/64129">https://github.com/apache/airflow/pull/64129</a></li>
<li><a href="https://lists.apache.org/thread/26zmhfj1t95c1hld2r14ho81nzh1bdc8">https://lists.apache.org/thread/26zmhfj1t95c1hld2r14ho81nzh1bdc8</a></li>
</ul>
-<h3 id="credits-47">Credits</h3>
+<h3 id="credits-63">Credits</h3>
<ul>
<li>Peyton Kennedy (p80n-sec) from Endor Labs (finder)</li>
<li>Kevin Yang (remediation developer)</li>
@@ -1042,18 +1357,18 @@
<h2 id="CVE-2026-28779">Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications</h2>
<p>CVE-2026-28779 <a href="https://cve.org/CVERecord?id=CVE-2026-28779">[CVE]</a> <a href="./CVE-2026-28779.cve.json">[CVE json]</a> <a href="./CVE-2026-28779.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-17T10:43:18.236Z</em></p>
-<h3 id="affected-48">Affected</h3>
+<h3 id="affected-64">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.1.8</li>
</ul>
-<h3 id="description-48">Description</h3>
+<h3 id="description-64">Description</h3>
<p>Apache Airflow versions 3.1.0 through 3.1.7 <span style="background-color: rgb(255, 255, 255);">session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.<br><p>This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itself.</p></span>Users are recommended to upgrade to Apache Airflow 3.1.8 or later [...]
-<h3 id="references-48">References</h3>
+<h3 id="references-64">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/62771">https://github.com/apache/airflow/pull/62771</a></li>
<li><a href="https://lists.apache.org/thread/r4n5znb8mcq14wo9v8ndml36nxlksdqb">https://lists.apache.org/thread/r4n5znb8mcq14wo9v8ndml36nxlksdqb</a></li>
</ul>
-<h3 id="credits-48">Credits</h3>
+<h3 id="credits-64">Credits</h3>
<ul>
<li>Daniel Wolf (finder)</li>
<li>Daniel Wolf (remediation developer)</li>
@@ -1061,18 +1376,18 @@
<h2 id="CVE-2026-28563">DAG authorization bypass</h2>
<p>CVE-2026-28563 <a href="https://cve.org/CVERecord?id=CVE-2026-28563">[CVE]</a> <a href="./CVE-2026-28563.cve.json">[CVE json]</a> <a href="./CVE-2026-28563.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-17T10:54:55.864Z</em></p>
-<h3 id="affected-49">Affected</h3>
+<h3 id="affected-65">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.1.8</li>
</ul>
-<h3 id="description-49">Description</h3>
+<h3 id="description-65">Description</h3>
<p>Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authorized to view.<br><br><br>Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.<br><br><br></p>
-<h3 id="references-49">References</h3>
+<h3 id="references-65">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/62046">https://github.com/apache/airflow/pull/62046</a></li>
<li><a href="https://lists.apache.org/thread/dwzf62qg9z8wvfsjknpfd8bvtwghd49s">https://lists.apache.org/thread/dwzf62qg9z8wvfsjknpfd8bvtwghd49s</a></li>
</ul>
-<h3 id="credits-49">Credits</h3>
+<h3 id="credits-65">Credits</h3>
<ul>
<li>Masamune - Unit515 OPSWAT (finder)</li>
<li>Shubham Raj (remediation developer)</li>
@@ -1080,18 +1395,18 @@
<h2 id="CVE-2026-27173">JWT Token Exposure in KubernetesExecutor Command-Line Arguments</h2>
<p>CVE-2026-27173 <a href="https://cve.org/CVERecord?id=CVE-2026-27173">[CVE]</a> <a href="./CVE-2026-27173.cve.json">[CVE json]</a> <a href="./CVE-2026-27173.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-22T18:42:19.144Z</em></p>
-<h3 id="affected-50">Affected</h3>
+<h3 id="affected-66">Affected</h3>
<ul>
<li>Apache Airflow CNCF Kubernetes provider before 10.17.0</li>
</ul>
-<h3 id="description-50">Description</h3>
+<h3 id="description-66">Description</h3>
<p>JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform actions that were only available to running tasks via Task SDK and potentially allow to modify state of Airflow Database for tasks.</p>
-<h3 id="references-50">References</h3>
+<h3 id="references-66">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/60108">https://github.com/apache/airflow/pull/60108</a></li>
<li><a href="https://lists.apache.org/thread/pk3m2z4s2rkmc0v6gh9hnch9spc6stqw">https://lists.apache.org/thread/pk3m2z4s2rkmc0v6gh9hnch9spc6stqw</a></li>
</ul>
-<h3 id="credits-50">Credits</h3>
+<h3 id="credits-66">Credits</h3>
<ul>
<li>Nikolai Dvoinishnikov, Welltory (finder)</li>
<li>Anton Kuznetsov, Welltory (finder)</li>
@@ -1100,36 +1415,36 @@
<h2 id="CVE-2026-26929">Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata</h2>
<p>CVE-2026-26929 <a href="https://cve.org/CVERecord?id=CVE-2026-26929">[CVE]</a> <a href="./CVE-2026-26929.cve.json">[CVE json]</a> <a href="./CVE-2026-26929.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-17T10:54:03.388Z</em></p>
-<h3 id="affected-51">Affected</h3>
+<h3 id="affected-67">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.1.8</li>
</ul>
-<h3 id="description-51">Description</h3>
+<h3 id="description-67">Description</h3>
<p>Apache Airflow versions 3.0.0 through 3.1.7<span style="background-color: rgb(255, 255, 255);"> FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to “~” (wildcard for all DAGs). As a result, version metadata of DAGs that the requester is not authorized to access is returned.</span><br><br><br>Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.<br><br><br></p>
-<h3 id="references-51">References</h3>
+<h3 id="references-67">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/61675">https://github.com/apache/airflow/pull/61675</a></li>
<li><a href="https://lists.apache.org/thread/g5o6khx83jwqvdyn0mlyb0krt35cs9ss">https://lists.apache.org/thread/g5o6khx83jwqvdyn0mlyb0krt35cs9ss</a></li>
</ul>
-<h3 id="credits-51">Credits</h3>
+<h3 id="credits-67">Credits</h3>
<ul>
<li>Pierre Jeambrun (remediation developer)</li>
</ul>
<h2 id="CVE-2026-25917">API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)</h2>
<p>CVE-2026-25917 <a href="https://cve.org/CVERecord?id=CVE-2026-25917">[CVE]</a> <a href="./CVE-2026-25917.cve.json">[CVE json]</a> <a href="./CVE-2026-25917.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-17T20:19:53.511Z</em></p>
-<h3 id="affected-52">Affected</h3>
+<h3 id="affected-68">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.0</li>
</ul>
-<h3 id="description-52">Description</h3>
+<h3 id="description-68">Description</h3>
<p>Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low.<br><br>Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.<br></p>
-<h3 id="references-52">References</h3>
+<h3 id="references-68">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/61641">https://github.com/apache/airflow/pull/61641</a></li>
<li><a href="https://lists.apache.org/thread/6whgpkqbh12rvpfmvcg8b0vwlv4hq3po">https://lists.apache.org/thread/6whgpkqbh12rvpfmvcg8b0vwlv4hq3po</a></li>
</ul>
-<h3 id="credits-52">Credits</h3>
+<h3 id="credits-68">Credits</h3>
<ul>
<li>Mahammad Huseynkhanli (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -1137,73 +1452,73 @@
<h2 id="CVE-2026-25604">Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass</h2>
<p>CVE-2026-25604 <a href="https://cve.org/CVERecord?id=CVE-2026-25604">[CVE]</a> <a href="./CVE-2026-25604.cve.json">[CVE json]</a> <a href="./CVE-2026-25604.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-09T10:39:37.628Z</em></p>
-<h3 id="affected-53">Affected</h3>
+<h3 id="affected-69">Affected</h3>
<ul>
<li>Apache Airflow Providers Amazon from 8.0.0 before 9.22.0</li>
</ul>
-<h3 id="description-53">Description</h3>
+<h3 id="description-69">Description</h3>
<p>In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. <br>This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.</p>You should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.<br><br>
-<h3 id="references-53">References</h3>
+<h3 id="references-69">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/61368">https://github.com/apache/airflow/pull/61368</a></li>
<li><a href="https://lists.apache.org/thread/spwwrsmwxod7fpttcd7n7zs46j839l77">https://lists.apache.org/thread/spwwrsmwxod7fpttcd7n7zs46j839l77</a></li>
</ul>
-<h3 id="credits-53">Credits</h3>
+<h3 id="credits-69">Credits</h3>
<ul>
<li>Sungwuk Jung (finder)</li>
</ul>
<h2 id="CVE-2026-25219">Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access</h2>
<p>CVE-2026-25219 <a href="https://cve.org/CVERecord?id=CVE-2026-25219">[CVE]</a> <a href="./CVE-2026-25219.cve.json">[CVE json]</a> <a href="./CVE-2026-25219.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-15T13:14:51.470Z</em></p>
-<h3 id="affected-54">Affected</h3>
+<h3 id="affected-70">Affected</h3>
<ul>
<li>Apache Airflow before 3.1.8</li>
</ul>
-<h3 id="description-54">Description</h3>
+<h3 id="description-70">Description</h3>
<p>The <code>access_key</code> and <code>connection_string</code> connection properties were not marked as sensitive names in secrets masker. This means that user with read permission could see the values in Connection UI, as well as when Connection was accidentaly logged to logs, those values could be seen in the logs. Azure Service Bus used those properties to store sensitive values. Possibly other providers could be also affected if they used the same fields to store sensitive data.<b [...]
-<h3 id="references-54">References</h3>
+<h3 id="references-70">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/61580">https://github.com/apache/airflow/pull/61580</a></li>
<li><a href="https://github.com/apache/airflow/pull/61582">https://github.com/apache/airflow/pull/61582</a></li>
<li><a href="https://lists.apache.org/thread/t4dlmqkn0njz4chk3g7mdgzb96y4ttqh">https://lists.apache.org/thread/t4dlmqkn0njz4chk3g7mdgzb96y4ttqh</a></li>
</ul>
-<h3 id="credits-54">Credits</h3>
+<h3 id="credits-70">Credits</h3>
<ul>
<li>Saurabh Banawar (finder)</li>
</ul>
<h2 id="CVE-2026-24098">Assigning single DAG permission leaked all DAGs Import Errors</h2>
<p>CVE-2026-24098 <a href="https://cve.org/CVERecord?id=CVE-2026-24098">[CVE]</a> <a href="./CVE-2026-24098.cve.json">[CVE json]</a> <a href="./CVE-2026-24098.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-10T18:13:52.941Z</em></p>
-<h3 id="affected-55">Affected</h3>
+<h3 id="affected-71">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.1.7</li>
</ul>
-<h3 id="description-55">Description</h3>
+<h3 id="description-71">Description</h3>
<p>Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. <br><br>Users are advised to upgrade to 3.1.7 or later, which resolves this issue</p>
-<h3 id="references-55">References</h3>
+<h3 id="references-71">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/60801">https://github.com/apache/airflow/pull/60801</a></li>
<li><a href="https://lists.apache.org/thread/nx96435v77xdst7ls5lk57kqvqyj095x">https://lists.apache.org/thread/nx96435v77xdst7ls5lk57kqvqyj095x</a></li>
</ul>
-<h3 id="credits-55">Credits</h3>
+<h3 id="credits-71">Credits</h3>
<ul>
<li>Saurabh (finder)</li>
</ul>
<h2 id="CVE-2026-22922">Airflow externalLogUrl Permission Bypass</h2>
<p>CVE-2026-22922 <a href="https://cve.org/CVERecord?id=CVE-2026-22922">[CVE]</a> <a href="./CVE-2026-22922.cve.json">[CVE json]</a> <a href="./CVE-2026-22922.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-02-09T10:33:48.256Z</em></p>
-<h3 id="affected-56">Affected</h3>
+<h3 id="affected-72">Affected</h3>
<ul>
<li>Apache Airflow from 3.1.0 before 3.1.7</li>
</ul>
-<h3 id="description-56">Description</h3>
+<h3 id="description-72">Description</h3>
<p>Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. <br><br>Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.<br></p>
-<h3 id="references-56">References</h3>
+<h3 id="references-72">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/60412">https://github.com/apache/airflow/pull/60412</a></li>
<li><a href="https://lists.apache.org/thread/gdb7vffhpmrj5hp1j0oj1j13o4vmsq40">https://lists.apache.org/thread/gdb7vffhpmrj5hp1j0oj1j13o4vmsq40</a></li>
</ul>
-<h3 id="credits-56">Credits</h3>
+<h3 id="credits-72">Credits</h3>
<ul>
<li>34selen (finder)</li>
<li>Shubham Raj (remediation developer)</li>
@@ -1211,18 +1526,18 @@
<h2 id="CVE-2025-69219">Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperator</h2>
<p>CVE-2025-69219 <a href="https://cve.org/CVERecord?id=CVE-2025-69219">[CVE]</a> <a href="./CVE-2025-69219.cve.json">[CVE json]</a> <a href="./CVE-2025-69219.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-09T10:19:56.479Z</em></p>
-<h3 id="affected-57">Affected</h3>
+<h3 id="affected-73">Affected</h3>
<ul>
<li>Apache Airflow Providers Http from 5.1.0 before 6.0.0</li>
</ul>
-<h3 id="description-57">Description</h3>
+<h3 id="description-73">Description</h3>
<p>A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same permissions as Dag Author. Since direct DB access is not usual and recommended for Airflow, the likelihood of it making any damage is low.<br><br>You should upgrade to version 6.0.0 of the provider to avoid even that risk.</p>
-<h3 id="references-57">References</h3>
+<h3 id="references-73">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/61662">https://github.com/apache/airflow/pull/61662</a></li>
<li><a href="https://lists.apache.org/thread/zjkfb2njklro68tqzym092r4w65m5dq0">https://lists.apache.org/thread/zjkfb2njklro68tqzym092r4w65m5dq0</a></li>
</ul>
-<h3 id="credits-57">Credits</h3>
+<h3 id="credits-73">Credits</h3>
<ul>
<li>skypher (finder)</li>
<li>Shauryae1337 (GitHub: <a href="https://github.com/Shauryae1337">https://github.com/Shauryae1337</a>) (finder)</li>
@@ -1231,19 +1546,19 @@
<h2 id="CVE-2025-68675">proxy credentials for various providers might leak in task logs</h2>
<p>CVE-2025-68675 <a href="https://cve.org/CVERecord?id=CVE-2025-68675">[CVE]</a> <a href="./CVE-2025-68675.cve.json">[CVE json]</a> <a href="./CVE-2025-68675.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-02-24T05:48:09.000Z</em></p>
-<h3 id="affected-58">Affected</h3>
+<h3 id="affected-74">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.1.6</li>
<li>Apache Airflow before 2.11.1</li>
</ul>
-<h3 id="description-58">Description</h3>
+<h3 id="description-74">Description</h3>
<p>In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result, when such connections are rendered or printed to logs, proxy credentials embedded in these fields could be exposed.<br><br>Users are recommended to upgrade to 3.1.6 or later for Airflow 3, an [...]
-<h3 id="references-58">References</h3>
+<h3 id="references-74">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/x6kply4nqd4vc4wgxtm6g9r2tt63s8c5">https://lists.apache.org/thread/x6kply4nqd4vc4wgxtm6g9r2tt63s8c5</a></li>
<li><a href="https://github.com/apache/airflow/pull/59688">https://github.com/apache/airflow/pull/59688</a></li>
</ul>
-<h3 id="credits-58">Credits</h3>
+<h3 id="credits-74">Credits</h3>
<ul>
<li>lwlkr <a href="https://github.com/kwkr">https://github.com/kwkr</a> (finder)</li>
<li>Ankit Chaurasia (remediation developer)</li>
@@ -1251,17 +1566,17 @@
<h2 id="CVE-2025-68438">Secrets in rendered templates could contain parts of sensitive values when truncated</h2>
<p>CVE-2025-68438 <a href="https://cve.org/CVERecord?id=CVE-2025-68438">[CVE]</a> <a href="./CVE-2025-68438.cve.json">[CVE json]</a> <a href="./CVE-2025-68438.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-01-16T10:06:05.336Z</em></p>
-<h3 id="affected-59">Affected</h3>
+<h3 id="affected-75">Affected</h3>
<ul>
<li>Apache Airflow from 3.1.0 before 3.1.6</li>
</ul>
-<h3 id="description-59">Description</h3>
+<h3 id="description-75">Description</h3>
<p>In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] <code>max_templated_field_length</code>, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include user-registered <code>mask_secret()</code> patterns, so secrets were not reliably masked before truncation and display.<br><br>Users are recommended to upgrade to 3.1.6 or l [...]
-<h3 id="references-59">References</h3>
+<h3 id="references-75">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/55n7b4nlsz3vo5n4h5lrj9bfsk8ctyff">https://lists.apache.org/thread/55n7b4nlsz3vo5n4h5lrj9bfsk8ctyff</a></li>
</ul>
-<h3 id="credits-59">Credits</h3>
+<h3 id="credits-75">Credits</h3>
<ul>
<li>William Ashe (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -1269,36 +1584,36 @@
<h2 id="CVE-2025-67895">Edge3 Worker RPC RCE on Airflow 2</h2>
<p>CVE-2025-67895 <a href="https://cve.org/CVERecord?id=CVE-2025-67895">[CVE]</a> <a href="./CVE-2025-67895.cve.json">[CVE json]</a> <a href="./CVE-2025-67895.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-12-17T11:48:30.034Z</em></p>
-<h3 id="affected-60">Affected</h3>
+<h3 id="affected-76">Affected</h3>
<ul>
<li>Apache Airflow Providers Edge3 before 2.0.0</li>
</ul>
-<h3 id="description-60">Description</h3>
+<h3 id="description-76">Description</h3>
<p>Edge3 Worker RPC RCE on Airflow 2.</p><p>This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if you installed and configured it on Airflow 2.</p><p></p><p>The Edge3 provider support in Airflow 2 has been always development-only and not officially released, however if you installed and configured Edge3 provider in Airflow 2, it implicitly enabled non-public (normally) API which was used to test Edge Provider in Airflow 2 during the development. This API allowed D [...]
-<h3 id="references-60">References</h3>
+<h3 id="references-76">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/59143">https://github.com/apache/airflow/pull/59143</a></li>
<li><a href="https://lists.apache.org/thread/hhnmmzkj5qx5gbk6pdkh8tcsx5oj1nqs">https://lists.apache.org/thread/hhnmmzkj5qx5gbk6pdkh8tcsx5oj1nqs</a></li>
</ul>
-<h3 id="credits-60">Credits</h3>
+<h3 id="credits-76">Credits</h3>
<ul>
<li>Lee (finder)</li>
</ul>
<h2 id="CVE-2025-66388">Secrets in rendered templates not redacted properly and exposed in the UI</h2>
<p>CVE-2025-66388 <a href="https://cve.org/CVERecord?id=CVE-2025-66388">[CVE]</a> <a href="./CVE-2025-66388.cve.json">[CVE json]</a> <a href="./CVE-2025-66388.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-12-15T11:30:42.649Z</em></p>
-<h3 id="affected-61">Affected</h3>
+<h3 id="affected-77">Affected</h3>
<ul>
<li>Apache Airflow from 3.1.0 before 3.1.4</li>
</ul>
-<h3 id="description-61">Description</h3>
+<h3 id="description-77">Description</h3>
<p>A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without the appropriate authorization.<br><br>Users are recommended to upgrade to version 3.1.4, which fixes this issue.</p>
-<h3 id="references-61">References</h3>
+<h3 id="references-77">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/58772">https://github.com/apache/airflow/pull/58772</a></li>
<li><a href="https://lists.apache.org/thread/mv9hzsx8grjf7gdlkxwppnpbtogtls2g">https://lists.apache.org/thread/mv9hzsx8grjf7gdlkxwppnpbtogtls2g</a></li>
</ul>
-<h3 id="credits-61">Credits</h3>
+<h3 id="credits-77">Credits</h3>
<ul>
<li>William Ashe (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -1306,18 +1621,18 @@
<h2 id="CVE-2025-66236">Secrets from Airflow config file logged in plain text in DAG run logs UI</h2>
<p>CVE-2025-66236 <a href="https://cve.org/CVERecord?id=CVE-2025-66236">[CVE]</a> <a href="./CVE-2025-66236.cve.json">[CVE json]</a> <a href="./CVE-2025-66236.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-13T14:20:35.201Z</em></p>
-<h3 id="affected-62">Affected</h3>
+<h3 id="affected-78">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.0</li>
</ul>
-<h3 id="description-62">Description</h3>
+<h3 id="description-78">Description</h3>
<p>Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay attention to security details and security model of Airflow. Some assumptions the Deployment Manager could make were not clear or explicit enough, even though Airflow's intentions and security model of Airflow did not suggest different assumptions. The overall security model [1], workload isolation [2], and JWT authentication details [3] are now descr [...]
-<h3 id="references-62">References</h3>
+<h3 id="references-78">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/58662">https://github.com/apache/airflow/pull/58662</a></li>
<li><a href="https://lists.apache.org/thread/g8fyy1tkmxkkfk7tx2v6h8mvwzpyykbo">https://lists.apache.org/thread/g8fyy1tkmxkkfk7tx2v6h8mvwzpyykbo</a></li>
</ul>
-<h3 id="credits-62">Credits</h3>
+<h3 id="credits-78">Credits</h3>
<ul>
<li>Saurabh Banawar (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -1325,20 +1640,20 @@
<h2 id="CVE-2025-65995">Disclosure of secrets to UI via kwargs</h2>
<p>CVE-2025-65995 <a href="https://cve.org/CVERecord?id=CVE-2025-65995">[CVE]</a> <a href="./CVE-2025-65995.cve.json">[CVE json]</a> <a href="./CVE-2025-65995.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-08T19:08:56.440Z</em></p>
-<h3 id="affected-63">Affected</h3>
+<h3 id="affected-79">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.1.4</li>
<li>Apache Airflow before 2.11.1</li>
</ul>
-<h3 id="description-63">Description</h3>
+<h3 id="description-79">Description</h3>
<p>When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG. <br><br>The issue has been fixed in Airflow 3.1.4 and 2.11.1, and users are strongly advised to upgrade to prevent potential disclosure of sensitive information.</p>
-<h3 id="references-63">References</h3>
+<h3 id="references-79">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/58252">https://github.com/apache/airflow/pull/58252</a></li>
<li><a href="https://lists.apache.org/thread/1qzlrjo2wmlzs0rrgzgslj2pzkor0dr2">https://lists.apache.org/thread/1qzlrjo2wmlzs0rrgzgslj2pzkor0dr2</a></li>
<li><a href="https://github.com/apache/airflow/pull/61883">https://github.com/apache/airflow/pull/61883</a></li>
</ul>
-<h3 id="credits-63">Credits</h3>
+<h3 id="credits-79">Credits</h3>
<ul>
<li>Frieder Gottman (Cariad) (finder)</li>
<li>Jens Scheffler (Bosch) (reporter)</li>
@@ -1347,53 +1662,53 @@
<h2 id="CVE-2025-62503">Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)</h2>
<p>CVE-2025-62503 <a href="https://cve.org/CVERecord?id=CVE-2025-62503">[CVE]</a> <a href="./CVE-2025-62503.cve.json">[CVE json]</a> <a href="./CVE-2025-62503.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-10-30T09:11:15.486Z</em></p>
-<h3 id="affected-64">Affected</h3>
+<h3 id="affected-80">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.1.1</li>
</ul>
-<h3 id="description-64">Description</h3>
+<h3 id="description-80">Description</h3>
<p>User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.<br><br><br></p>
-<h3 id="references-64">References</h3>
+<h3 id="references-80">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/3v58249qscyn1hg240gh8hqg9pb4okcr">https://lists.apache.org/thread/3v58249qscyn1hg240gh8hqg9pb4okcr</a></li>
</ul>
-<h3 id="credits-64">Credits</h3>
+<h3 id="credits-80">Credits</h3>
<ul>
<li>Maciej Kawka (finder)</li>
</ul>
<h2 id="CVE-2025-62402">Airflow 3 API: /api/v2/dagReports executes DAG Python in API</h2>
<p>CVE-2025-62402 <a href="https://cve.org/CVERecord?id=CVE-2025-62402">[CVE]</a> <a href="./CVE-2025-62402.cve.json">[CVE json]</a> <a href="./CVE-2025-62402.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-10-30T09:14:24.818Z</em></p>
-<h3 id="affected-65">Affected</h3>
+<h3 id="affected-81">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.1.1</li>
</ul>
-<h3 id="description-65">Description</h3>
+<h3 id="description-81">Description</h3>
<p>API users via <code>/api/v2/dagReports</code> could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.<br></p>
-<h3 id="references-65">References</h3>
+<h3 id="references-81">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/vbzxnxn031wb998hsd7vqnvh4z8nx6rs">https://lists.apache.org/thread/vbzxnxn031wb998hsd7vqnvh4z8nx6rs</a></li>
</ul>
-<h3 id="credits-65">Credits</h3>
+<h3 id="credits-81">Credits</h3>
<ul>
<li>kwkr (<a href="https://github.com/kwkr">https://github.com/kwkr</a>) (reporter)</li>
</ul>
<h2 id="CVE-2025-57735">Airflow Logout Not Invalidating JWT</h2>
<p>CVE-2025-57735 <a href="https://cve.org/CVERecord?id=CVE-2025-57735">[CVE]</a> <a href="./CVE-2025-57735.cve.json">[CVE json]</a> <a href="./CVE-2025-57735.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-09T11:12:40.266Z</em></p>
-<h3 id="affected-66">Affected</h3>
+<h3 id="affected-82">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.0</li>
</ul>
-<h3 id="description-66">Description</h3>
+<h3 id="description-82">Description</h3>
<p>When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+</p><br><br>Users are recommended to upgrade to version 3.2.0, which fixes this issue.
-<h3 id="references-66">References</h3>
+<h3 id="references-82">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/61339">https://github.com/apache/airflow/pull/61339</a></li>
<li><a href="https://github.com/apache/airflow/pull/56633">https://github.com/apache/airflow/pull/56633</a></li>
<li><a href="https://lists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98">https://lists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98</a></li>
</ul>
-<h3 id="credits-66">Credits</h3>
+<h3 id="credits-82">Credits</h3>
<ul>
<li>Saurabh Banawar (finder)</li>
<li>Anish Giri (remediation developer)</li>
@@ -1402,159 +1717,159 @@
<h2 id="CVE-2025-54941">Command injection in “example_dag_decorator”</h2>
<p>CVE-2025-54941 <a href="https://cve.org/CVERecord?id=CVE-2025-54941">[CVE]</a> <a href="./CVE-2025-54941.cve.json">[CVE json]</a> <a href="./CVE-2025-54941.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-10-30T09:45:25.170Z</em></p>
-<h3 id="affected-67">Affected</h3>
+<h3 id="affected-83">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before < 3.0.5</li>
</ul>
-<h3 id="description-67">Description</h3>
+<h3 id="description-83">Description</h3>
<p>An example dag <code>example_dag_decorator</code> had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on worker. This however required that the example dags are enabled in production (not default) or the example dag code copied to build your own similar dag. If you used the <code>example_dag_decorator</code> please review it and apply the changes implemented in Airflow 3.0.5 accordingly.<br><br><br></p>
-<h3 id="references-67">References</h3>
+<h3 id="references-83">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/c6q6nofc6xl5bms039ks9b34v0v36df1">https://lists.apache.org/thread/c6q6nofc6xl5bms039ks9b34v0v36df1</a></li>
</ul>
-<h3 id="credits-67">Credits</h3>
+<h3 id="credits-83">Credits</h3>
<ul>
<li>Nacl (reporter)</li>
</ul>
<h2 id="CVE-2025-54831">Connection sensitive details exposed to users with READ permissions</h2>
<p>CVE-2025-54831 <a href="https://cve.org/CVERecord?id=CVE-2025-54831">[CVE]</a> <a href="./CVE-2025-54831.cve.json">[CVE json]</a> <a href="./CVE-2025-54831.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-09-26T07:28:57.402Z</em></p>
-<h3 id="affected-68">Affected</h3>
+<h3 id="affected-84">Affected</h3>
<ul>
<li>Apache Airflow at 3.0.3</li>
</ul>
-<h3 id="description-68">Description</h3>
+<h3 id="description-84">Description</h3>
<p></p><p>Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to <em>Connection Editing Users</em>, effectively applying a "write-only" model for sensitive values.</p>
<p>In Airflow 3.0.3, this model was unintentionally violated: sensitive connection information could be viewed by users with READ permissions through both the API and the UI. This behavior also bypassed the `<code>AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS`</code> configuration option.</p>
<p>This issue does not affect Airflow 2.x, where exposing sensitive information to connection editors was the intended and documented behavior.</p><p></p><p><br></p><p>Users of Airflow 3.0.3 are advised to upgrade Airflow to >=3.0.4.</p>
-<h3 id="references-68">References</h3>
+<h3 id="references-84">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/vblmfqtydrp5zgn2q8tj3slk5podxspf">https://lists.apache.org/thread/vblmfqtydrp5zgn2q8tj3slk5podxspf</a></li>
</ul>
<h2 id="CVE-2025-54550">RCE by race condition in example_xcom dag</h2>
<p>CVE-2025-54550 <a href="https://cve.org/CVERecord?id=CVE-2025-54550">[CVE]</a> <a href="./CVE-2025-54550.cve.json">[CVE json]</a> <a href="./CVE-2025-54550.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-19T23:47:06.426Z</em></p>
-<h3 id="affected-69">Affected</h3>
+<h3 id="affected-85">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.0</li>
</ul>
-<h3 id="description-69">Description</h3>
+<h3 id="description-85">Description</h3>
<p>The example <code>example_xcom</code> that was included in airflow documentation implemented unsafe pattern of reading value<br>from xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary<br>execution of code on the worker. Since the UI users are already highly trusted, this is a Low severity vulnerability.</p><p>It does not affect Airflow release - example_dags are not supposed to be enabled in production environment, however [...]
-<h3 id="references-69">References</h3>
+<h3 id="references-85">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/3mf4cfx070ofsnf9qy0s2v5gqb5sc2g1">https://lists.apache.org/thread/3mf4cfx070ofsnf9qy0s2v5gqb5sc2g1</a></li>
<li><a href="https://github.com/apache/airflow/pull/63200">https://github.com/apache/airflow/pull/63200</a></li>
</ul>
-<h3 id="credits-68">Credits</h3>
+<h3 id="credits-84">Credits</h3>
<ul>
<li>Vincent55 Yang (finder)</li>
</ul>
<h2 id="CVE-2025-50213">Potential SQL injection in CopyFromExternalStageToSnowflakeOperator</h2>
<p>CVE-2025-50213 <a href="https://cve.org/CVERecord?id=CVE-2025-50213">[CVE]</a> <a href="./CVE-2025-50213.cve.json">[CVE json]</a> <a href="./CVE-2025-50213.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-06-24T07:06:50.934Z</em></p>
-<h3 id="affected-70">Affected</h3>
+<h3 id="affected-86">Affected</h3>
<ul>
<li>Apache Airflow Providers Snowflake before 6.4.0</li>
</ul>
-<h3 id="description-70">Description</h3>
+<h3 id="description-86">Description</h3>
<p>Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.</p><p>This issue affects Apache Airflow Providers Snowflake: before 6.4.0.</p><span style="background-color: rgb(255, 255, 255);"><span style="background-color: rgb(255, 255, 255);">Sanitation of table and stage parameters were added in</span> CopyFromExternalStageToSnowflakeOperator <span style="background-color: rgb(255, 255, 255);">t [...]
-<h3 id="references-70">References</h3>
+<h3 id="references-86">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/51734">https://github.com/apache/airflow/pull/51734</a></li>
<li><a href="https://lists.apache.org/thread/2kqfmyt2pghg5f6797g8hzvq331v8qx3">https://lists.apache.org/thread/2kqfmyt2pghg5f6797g8hzvq331v8qx3</a></li>
</ul>
-<h3 id="credits-69">Credits</h3>
+<h3 id="credits-85">Credits</h3>
<ul>
<li>Nhien Pham (@nhienit) at Galaxy One (finder)</li>
</ul>
<h2 id="CVE-2025-30473">Remote Code Execution via Sql Injection</h2>
<p>CVE-2025-30473 <a href="https://cve.org/CVERecord?id=CVE-2025-30473">[CVE]</a> <a href="./CVE-2025-30473.cve.json">[CVE json]</a> <a href="./CVE-2025-30473.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-04-07T08:31:55.441Z</em></p>
-<h3 id="affected-71">Affected</h3>
+<h3 id="affected-87">Affected</h3>
<ul>
<li>Apache Airflow Common SQL Provider before 1.24.1</li>
</ul>
-<h3 id="description-71">Description</h3>
+<h3 id="description-87">Description</h3>
<p>Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow Common SQL Provider.<br><br><span style="background-color: rgb(255, 255, 255);">When using the partition clause in SQLTableCheckOperator as parameter (which was a recommended pattern), Authenticated UI User could inject arbitrary SQL command when triggering DAG exposing partition_clause to the user.<br></span><span style="background-color: rgb(255, 255, 255);">This allo [...]
-<h3 id="references-71">References</h3>
+<h3 id="references-87">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/48098">https://github.com/apache/airflow/pull/48098</a></li>
<li><a href="https://lists.apache.org/thread/53klkv790cylqcop0350w7nfq1y6h0t2">https://lists.apache.org/thread/53klkv790cylqcop0350w7nfq1y6h0t2</a></li>
</ul>
-<h3 id="credits-70">Credits</h3>
+<h3 id="credits-86">Credits</h3>
<ul>
<li>nxczje (reporter)</li>
</ul>
<h2 id="CVE-2025-27555">Connection Secrets not masked in UI when Connection are added via Airflow cli</h2>
<p>CVE-2025-27555 <a href="https://cve.org/CVERecord?id=CVE-2025-27555">[CVE]</a> <a href="./CVE-2025-27555.cve.json">[CVE json]</a> <a href="./CVE-2025-27555.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-11T15:10:00.713Z</em></p>
-<h3 id="affected-72">Affected</h3>
+<h3 id="affected-88">Affected</h3>
<ul>
<li>Apache Airflow before 2.11.1</li>
</ul>
-<h3 id="description-72">Description</h3>
+<h3 id="description-88">Description</h3>
<p>Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive connection parameters were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow database. While this risk is limited to users with audit log access, it is recommended to upgrade to Airflow 2.11.1 or a later version, which addresses this iss [...]
-<h3 id="references-72">References</h3>
+<h3 id="references-88">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/61882">https://github.com/apache/airflow/pull/61882</a></li>
<li><a href="https://lists.apache.org/thread/nxovkp319jo8vg498gql1yswtb2frbkw">https://lists.apache.org/thread/nxovkp319jo8vg498gql1yswtb2frbkw</a></li>
</ul>
-<h3 id="credits-71">Credits</h3>
+<h3 id="credits-87">Credits</h3>
<ul>
<li>sw0rd1ight (finder)</li>
</ul>
<h2 id="CVE-2025-27018">SQL injection in MySQL provider core function</h2>
<p>CVE-2025-27018 <a href="https://cve.org/CVERecord?id=CVE-2025-27018">[CVE]</a> <a href="./CVE-2025-27018.cve.json">[CVE json]</a> <a href="./CVE-2025-27018.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-03-19T09:06:05.242Z</em></p>
-<h3 id="affected-73">Affected</h3>
+<h3 id="affected-89">Affected</h3>
<ul>
<li>Apache Airflow MySQL Provider before 6.2.0</li>
</ul>
-<h3 id="description-73">Description</h3>
+<h3 id="description-89">Description</h3>
<p>Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow MySQL Provider.</p><span style="background-color: rgb(255, 255, 255);">When user triggered a DAG with dump_sql or load_sql functions they could pass a table parameter from a UI, that could cause SQL injection by running SQL that was not intended.<br>It could lead to data corruption, modification and others.</span><br><p>This issue affects Apache Airflow MySQL Provider: [...]
-<h3 id="references-73">References</h3>
+<h3 id="references-89">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/47254">https://github.com/apache/airflow/pull/47254</a></li>
<li><a href="https://github.com/apache/airflow/pull/47255">https://github.com/apache/airflow/pull/47255</a></li>
<li><a href="https://lists.apache.org/thread/m8ohgkwz4mq9njohf66sjwqjdy28gvzf">https://lists.apache.org/thread/m8ohgkwz4mq9njohf66sjwqjdy28gvzf</a></li>
</ul>
-<h3 id="credits-72">Credits</h3>
+<h3 id="credits-88">Credits</h3>
<ul>
<li>Vincent55 (DEVCORE Internship Program) (finder)</li>
</ul>
<h2 id="CVE-2024-56373">SSTI to Code Execution in Airflow through Shared DB Information</h2>
<p>CVE-2024-56373 <a href="https://cve.org/CVERecord?id=CVE-2024-56373">[CVE]</a> <a href="./CVE-2024-56373.cve.json">[CVE json]</a> <a href="./CVE-2024-56373.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-02-24T10:06:39.270Z</em></p>
-<h3 id="affected-74">Affected</h3>
+<h3 id="affected-90">Affected</h3>
<ul>
<li>Apache Airflow before 2.11.1</li>
</ul>
-<h3 id="description-74">Description</h3>
+<h3 id="description-90">Description</h3>
<p>DAG Author (who already has quite a lot of permissions) could manipulate database of Airflow 2 in the way to execute arbitrary code in the web-server context, which they should normally not be able to do, leading to potentially remote code execution in the context of web-server (server-side) as a result of a user viewing historical task information.</p>The functionality responsible for that (log template history) has been disabled by default in 2.11.1 and users should upgrade to Airfl [...]
-<h3 id="references-74">References</h3>
+<h3 id="references-90">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/61880">https://github.com/apache/airflow/pull/61880</a></li>
<li><a href="https://lists.apache.org/thread/2vrmrhcht6g7cp5yjxpnrk2wtrncm6cy">https://lists.apache.org/thread/2vrmrhcht6g7cp5yjxpnrk2wtrncm6cy</a></li>
</ul>
-<h3 id="credits-73">Credits</h3>
+<h3 id="credits-89">Credits</h3>
<ul>
<li>Seokchan Yoon. (finder)</li>
</ul>
<h2 id="CVE-2024-50378">Secrets not masked in UI when sensitive variables are set via Airflow cli</h2>
<p>CVE-2024-50378 <a href="https://cve.org/CVERecord?id=CVE-2024-50378">[CVE]</a> <a href="./CVE-2024-50378.cve.json">[CVE json]</a> <a href="./CVE-2024-50378.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-11-08T14:37:07.862Z</em></p>
-<h3 id="affected-75">Affected</h3>
+<h3 id="affected-91">Affected</h3>
<ul>
<li>Apache Airflow before 2.10.3</li>
</ul>
-<h3 id="description-75">Description</h3>
+<h3 id="description-91">Description</h3>
<p>Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive variables were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow database. While this risk is limited to users with audit log access, it is recommended to upgrade to Airflow 2.10.3 or a later version, which addresses this issue. Users wh [...]
-<h3 id="references-75">References</h3>
+<h3 id="references-91">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/43123">https://github.com/apache/airflow/pull/43123</a></li>
<li><a href="https://lists.apache.org/thread/17rxys384lzfd6nhm3fztzgvk47zy7jb">https://lists.apache.org/thread/17rxys384lzfd6nhm3fztzgvk47zy7jb</a></li>
</ul>
-<h3 id="credits-74">Credits</h3>
+<h3 id="credits-90">Credits</h3>
<ul>
<li>Saurabh Banawar (finder)</li>
<li>Shubham Raj (remediation developer)</li>
@@ -1562,18 +1877,18 @@
<h2 id="CVE-2024-45784">Sensitive configuration values are not masked in the logs by default</h2>
<p>CVE-2024-45784 <a href="https://cve.org/CVERecord?id=CVE-2024-45784">[CVE]</a> <a href="./CVE-2024-45784.cve.json">[CVE json]</a> <a href="./CVE-2024-45784.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-11-15T08:20:02.608Z</em></p>
-<h3 id="affected-76">Affected</h3>
+<h3 id="affected-92">Affected</h3>
<ul>
<li>Apache Airflow before 2.10.3</li>
</ul>
-<h3 id="description-76">Description</h3>
+<h3 id="description-92">Description</h3>
<p>Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG authors to unintentionally or intentionally log sensitive configuration variables. Unauthorized users could access these logs, potentially exposing critical data that could be exploited to compromise the security of the Airflow deployment. In version 2.10.3, secrets are now masked in task logs to prevent sensitive configuration v [...]
-<h3 id="references-76">References</h3>
+<h3 id="references-92">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/43040">https://github.com/apache/airflow/pull/43040</a></li>
<li><a href="https://lists.apache.org/thread/k2jm55jztlbmk4zrlh10syvq3n57hl4h">https://lists.apache.org/thread/k2jm55jztlbmk4zrlh10syvq3n57hl4h</a></li>
</ul>
-<h3 id="credits-75">Credits</h3>
+<h3 id="credits-91">Credits</h3>
<ul>
<li>Saurabh Banawar (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -1581,18 +1896,18 @@
<h2 id="CVE-2024-45498">Command Injection in an example DAG</h2>
<p>CVE-2024-45498 <a href="https://cve.org/CVERecord?id=CVE-2024-45498">[CVE]</a> <a href="./CVE-2024-45498.cve.json">[CVE json]</a> <a href="./CVE-2024-45498.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-09-07T07:43:42.216Z</em></p>
-<h3 id="affected-77">Affected</h3>
+<h3 id="affected-93">Affected</h3>
<ul>
<li>Apache Airflow at 2.10.0</li>
</ul>
-<h3 id="description-77">Description</h3>
+<h3 id="description-93">Description</h3>
<p>Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the dangerous example; see <a target="_blank" rel="nofollow" href="https://github.com/apache/airflow/pull/41873"><a href="https://github.com/apache/airflow/pull/41873">https://github.com/apache [...]
-<h3 id="references-77">References</h3>
+<h3 id="references-93">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/41873">https://github.com/apache/airflow/pull/41873</a></li>
<li><a href="https://lists.apache.org/thread/tl7lzczcqdmqj2pcpbvtjdpd2tb9561n">https://lists.apache.org/thread/tl7lzczcqdmqj2pcpbvtjdpd2tb9561n</a></li>
</ul>
-<h3 id="credits-76">Credits</h3>
+<h3 id="credits-92">Credits</h3>
<ul>
<li>Nhien Pham (aka nhienit) at Galaxy One (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -1600,18 +1915,18 @@
<h2 id="CVE-2024-45034">Authenticated DAG authors could execute code on scheduler nodes</h2>
<p>CVE-2024-45034 <a href="https://cve.org/CVERecord?id=CVE-2024-45034">[CVE]</a> <a href="./CVE-2024-45034.cve.json">[CVE json]</a> <a href="./CVE-2024-45034.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-09-07T07:45:26.032Z</em></p>
-<h3 id="affected-78">Affected</h3>
+<h3 id="affected-94">Affected</h3>
<ul>
<li>Apache Airflow before 2.10.1</li>
</ul>
-<h3 id="description-78">Description</h3>
+<h3 id="description-94">Description</h3>
<p>Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. <br>Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.</p>
-<h3 id="references-78">References</h3>
+<h3 id="references-94">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/41672">https://github.com/apache/airflow/pull/41672</a></li>
<li><a href="https://lists.apache.org/thread/b4fcw33vh60yfg9990n5vmc7sy2dcgjx">https://lists.apache.org/thread/b4fcw33vh60yfg9990n5vmc7sy2dcgjx</a></li>
</ul>
-<h3 id="credits-77">Credits</h3>
+<h3 id="credits-93">Credits</h3>
<ul>
<li>Seokchan Yoon: <a href="https://github.com/ch4n3-yoon">https://github.com/ch4n3-yoon</a> (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -1619,31 +1934,31 @@
<h2 id="CVE-2024-45033">Application does not invalidate session after password change via Airflow cli</h2>
<p>CVE-2024-45033 <a href="https://cve.org/CVERecord?id=CVE-2024-45033">[CVE]</a> <a href="./CVE-2024-45033.cve.json">[CVE json]</a> <a href="./CVE-2024-45033.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-01-08T08:41:37.392Z</em></p>
-<h3 id="affected-79">Affected</h3>
+<h3 id="affected-95">Affected</h3>
<ul>
<li>Apache Airflow Fab Provider before 1.5.2</li>
</ul>
-<h3 id="description-79">Description</h3>
+<h3 id="description-95">Description</h3>
<p>Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider.</p><p>This issue affects Apache Airflow Fab Provider: before 1.5.2.<br><br><span style="background-color: rgb(255, 255, 255);">When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password was changed. This only happened when the password was changed wit [...]
-<h3 id="references-79">References</h3>
+<h3 id="references-95">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/45139">https://github.com/apache/airflow/pull/45139</a></li>
<li><a href="https://lists.apache.org/thread/yw535346rk766ybzpqtvrl36sjj789st">https://lists.apache.org/thread/yw535346rk766ybzpqtvrl36sjj789st</a></li>
</ul>
-<h3 id="credits-78">Credits</h3>
+<h3 id="credits-94">Credits</h3>
<ul>
<li>Saurabh Banawar (reporter)</li>
</ul>
<h2 id="CVE-2024-42447">FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow</h2>
<p>CVE-2024-42447 <a href="https://cve.org/CVERecord?id=CVE-2024-42447">[CVE]</a> <a href="./CVE-2024-42447.cve.json">[CVE json]</a> <a href="./CVE-2024-42447.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-08-04T20:03:30.234Z</em></p>
-<h3 id="affected-80">Affected</h3>
+<h3 id="affected-96">Affected</h3>
<ul>
<li>Apache Airflow Providers FAB from 1.2.0 through 1.2.1</li>
</ul>
-<h3 id="description-80">Description</h3>
+<h3 id="description-96">Description</h3>
<p>Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB.</p><p>This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out. </p><p>* FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected)</p><p>* FAB provider 1.2.0 affected all versions of Airflow.<br></p><p><span style="backgroun [...]
-<h3 id="references-80">References</h3>
+<h3 id="references-96">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/40784">https://github.com/apache/airflow/pull/40784</a></li>
<li><a href="https://lists.apache.org/thread/2zoo8cjlwfjhbfdxfgltcm0hnc0qmc52">https://lists.apache.org/thread/2zoo8cjlwfjhbfdxfgltcm0hnc0qmc52</a></li>
@@ -1651,18 +1966,18 @@
<h2 id="CVE-2024-41937">Stored XSS Vulnerability on provider link</h2>
<p>CVE-2024-41937 <a href="https://cve.org/CVERecord?id=CVE-2024-41937">[CVE]</a> <a href="./CVE-2024-41937.cve.json">[CVE json]</a> <a href="./CVE-2024-41937.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-08-21T15:31:11.725Z</em></p>
-<h3 id="affected-81">Affected</h3>
+<h3 id="affected-97">Affected</h3>
<ul>
<li>Apache Airflow before 2.10.0</li>
</ul>
-<h3 id="description-81">Description</h3>
+<h3 id="description-97">Description</h3>
<p>Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This would require the provider to be installed on the web server and the user to click the provider link.<br>Users should upgrade to 2.10.0 or later, which fixes this vulnerability.</p>
-<h3 id="references-81">References</h3>
+<h3 id="references-97">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/40933">https://github.com/apache/airflow/pull/40933</a></li>
<li><a href="https://lists.apache.org/thread/lwlmgg6hqfmkpvw5py4w53hxyl37jl6d">https://lists.apache.org/thread/lwlmgg6hqfmkpvw5py4w53hxyl37jl6d</a></li>
</ul>
-<h3 id="credits-79">Credits</h3>
+<h3 id="credits-95">Credits</h3>
<ul>
<li>sw0rd1ight (<a href="https://github.com/sw0rd1ight">https://github.com/sw0rd1ight</a>) (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -1670,18 +1985,18 @@
<h2 id="CVE-2024-39877">DAG Author Code Execution possibility in airflow-scheduler</h2>
<p>CVE-2024-39877 <a href="https://cve.org/CVERecord?id=CVE-2024-39877">[CVE]</a> <a href="./CVE-2024-39877.cve.json">[CVE json]</a> <a href="./CVE-2024-39877.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-07-17T07:54:23.158Z</em></p>
-<h3 id="affected-82">Affected</h3>
+<h3 id="affected-98">Affected</h3>
<ul>
<li>Apache Airflow from 2.4.0 before 2.9.3</li>
</ul>
-<h3 id="description-82">Description</h3>
+<h3 id="description-98">Description</h3>
<p>Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability.</p>
-<h3 id="references-82">References</h3>
+<h3 id="references-98">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/40522">https://github.com/apache/airflow/pull/40522</a></li>
<li><a href="https://lists.apache.org/thread/1xhj9dkp37d6pzn24ll2mf94wbqnb2y1">https://lists.apache.org/thread/1xhj9dkp37d6pzn24ll2mf94wbqnb2y1</a></li>
</ul>
-<h3 id="credits-80">Credits</h3>
+<h3 id="credits-96">Credits</h3>
<ul>
<li>Seokchan Yoon (<a href="https://github.com/ch4n3-yoon">https://github.com/ch4n3-yoon</a>) (finder)</li>
<li>Wei Lee (remediation developer)</li>
@@ -1689,18 +2004,18 @@
<h2 id="CVE-2024-39863">Potential XSS Vulnerability</h2>
<p>CVE-2024-39863 <a href="https://cve.org/CVERecord?id=CVE-2024-39863">[CVE]</a> <a href="./CVE-2024-39863.cve.json">[CVE json]</a> <a href="./CVE-2024-39863.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-07-22T08:50:05.686Z</em></p>
-<h3 id="affected-83">Affected</h3>
+<h3 id="affected-99">Affected</h3>
<ul>
<li>Apache Airflow before 2.9.3</li>
</ul>
-<h3 id="description-83">Description</h3>
+<h3 id="description-99">Description</h3>
<p>Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue.<br></p>
-<h3 id="references-83">References</h3>
+<h3 id="references-99">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/40475">https://github.com/apache/airflow/pull/40475</a></li>
<li><a href="https://lists.apache.org/thread/gxkvs279f1mbvckv5q65worr6how20o3">https://lists.apache.org/thread/gxkvs279f1mbvckv5q65worr6how20o3</a></li>
</ul>
-<h3 id="credits-81">Credits</h3>
+<h3 id="credits-97">Credits</h3>
<ul>
<li>Seokchan Yoon (<a href="https://github.com/ch4n3-yoon">https://github.com/ch4n3-yoon</a>) (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -1708,18 +2023,18 @@
<h2 id="CVE-2024-32077">XSS vulnerability in Task Instance Log/Log Details</h2>
<p>CVE-2024-32077 <a href="https://cve.org/CVERecord?id=CVE-2024-32077">[CVE]</a> <a href="./CVE-2024-32077.cve.json">[CVE json]</a> <a href="./CVE-2024-32077.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-05-14T10:43:17.698Z</em></p>
-<h3 id="affected-84">Affected</h3>
+<h3 id="affected-100">Affected</h3>
<ul>
<li>Apache Airflow from 2.9.0 before 2.9.1</li>
</ul>
-<h3 id="description-84">Description</h3>
+<h3 id="description-100">Description</h3>
<p>Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs. <br>Users are recommended to upgrade to version 2.9.1, which fixes this issue.<br></p>
-<h3 id="references-84">References</h3>
+<h3 id="references-100">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/38882">https://github.com/apache/airflow/pull/38882</a></li>
<li><a href="https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77">https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77</a></li>
</ul>
-<h3 id="credits-82">Credits</h3>
+<h3 id="credits-98">Credits</h3>
<ul>
<li>Ming (finder)</li>
<li>Jens Scheffler (remediation developer)</li>
@@ -1727,18 +2042,18 @@
<h2 id="CVE-2024-31869">Sensitive configuration for providers displayed when “non-sensitive-only” config used</h2>
<p>CVE-2024-31869 <a href="https://cve.org/CVERecord?id=CVE-2024-31869">[CVE]</a> <a href="./CVE-2024-31869.cve.json">[CVE json]</a> <a href="./CVE-2024-31869.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-04-18T07:18:58.062Z</em></p>
-<h3 id="affected-85">Affected</h3>
+<h3 id="affected-101">Affected</h3>
<ul>
<li>Apache Airflow from 2.7.0 through 2.8.4</li>
</ul>
-<h3 id="description-85">Description</h3>
+<h3 id="description-101">Description</h3>
<p>Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration <span style="background-color: rgb(255, 255, 255);">via the “configuration” UI page </span>when “non-sensitive-only” was set as “webserver.expose_config” configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your &ldquo [...]
-<h3 id="references-85">References</h3>
+<h3 id="references-101">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/38795">https://github.com/apache/airflow/pull/38795</a></li>
<li><a href="https://lists.apache.org/thread/pz6vg7wcjk901rmsgt86h76g6kfcgtk3">https://lists.apache.org/thread/pz6vg7wcjk901rmsgt86h76g6kfcgtk3</a></li>
</ul>
-<h3 id="credits-83">Credits</h3>
+<h3 id="credits-99">Credits</h3>
<ul>
<li>Manmeet Rangoola (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -1746,56 +2061,56 @@
<h2 id="CVE-2024-29735">Potentially harmful permission changing by log task handler</h2>
<p>CVE-2024-29735 <a href="https://cve.org/CVERecord?id=CVE-2024-29735">[CVE]</a> <a href="./CVE-2024-29735.cve.json">[CVE json]</a> <a href="./CVE-2024-29735.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-03-26T16:52:39.118Z</em></p>
-<h3 id="affected-86">Affected</h3>
+<h3 id="affected-102">Affected</h3>
<ul>
<li>Apache Airflow from 2.8.2 through 2.8.3</li>
</ul>
-<h3 id="description-86">Description</h3>
+<h3 id="description-102">Description</h3>
<p>Improper Preservation of Permissions vulnerability in Apache Airflow.<p>This issue affects Apache Airflow from 2.8.2 through 2.8.3.</p><p></p><p>Airflow’s local file task handler in Airflow incorrectly set permissions for all parent folders of log folder, in default configuration adding write access to Unix <code>group</code> of the folders. In the case Airflow is run with the root user (not recommended) it added group write permission to all folders up to the root of the filesy [...]
-<h3 id="references-86">References</h3>
+<h3 id="references-102">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/37310">https://github.com/apache/airflow/pull/37310</a></li>
<li><a href="https://lists.apache.org/thread/8khb1rtbznh100o325fb8xw5wjvtv536">https://lists.apache.org/thread/8khb1rtbznh100o325fb8xw5wjvtv536</a></li>
</ul>
-<h3 id="credits-84">Credits</h3>
+<h3 id="credits-100">Credits</h3>
<ul>
<li>Matej Murin (finder)</li>
</ul>
<h2 id="CVE-2024-29733">FTP_TLS instance with unverified SSL context</h2>
<p>CVE-2024-29733 <a href="https://cve.org/CVERecord?id=CVE-2024-29733">[CVE]</a> <a href="./CVE-2024-29733.cve.json">[CVE json]</a> <a href="./CVE-2024-29733.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-04-21T17:21:52.458Z</em></p>
-<h3 id="affected-87">Affected</h3>
+<h3 id="affected-103">Affected</h3>
<ul>
<li>Apache Airflow FTP Provider before 3.7.0</li>
</ul>
-<h3 id="description-87">Description</h3>
+<h3 id="description-103">Description</h3>
<p>Improper Certificate Validation vulnerability in Apache Airflow FTP Provider.<br><br><p>The FTP hook lacks complete certificate validation in FTP_TLS connections, which can potentially be leveraged. Implementing proper certificate validation by passing context=ssl.create_default_context() during FTP_TLS instantiation is used as mitigation to validate the certificates properly.</p><p><span style="background-color: var(--wht);">This issue affects Apache Airflow FTP Provider: before 3.7. [...]
-<h3 id="references-87">References</h3>
+<h3 id="references-103">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/38266">https://github.com/apache/airflow/pull/38266</a></li>
<li><a href="https://github.com/apache/airflow/blob/95e26118b828c364755f3a8c96870f3591b01c31/airflow/providers/ftp/hooks/ftp.py#L280">https://github.com/apache/airflow/blob/95e26118b828c364755f3a8c96870f3591b01c31/airflow/providers/ftp/hooks/ftp.py#L280</a></li>
<li><a href="https://docs.python.org/3/library/ssl.html#best-defaults">https://docs.python.org/3/library/ssl.html#best-defaults</a></li>
<li><a href="https://lists.apache.org/thread/265t5zbmtjs6h9fkw52wtp03nsbplky2">https://lists.apache.org/thread/265t5zbmtjs6h9fkw52wtp03nsbplky2</a></li>
</ul>
-<h3 id="credits-85">Credits</h3>
+<h3 id="credits-101">Credits</h3>
<ul>
<li>Eric Brown of Secure Sauce LLC (finder)</li>
</ul>
<h2 id="CVE-2024-28746">Ignored Airflow Permissions</h2>
<p>CVE-2024-28746 <a href="https://cve.org/CVERecord?id=CVE-2024-28746">[CVE]</a> <a href="./CVE-2024-28746.cve.json">[CVE json]</a> <a href="./CVE-2024-28746.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-03-14T08:40:55.534Z</em></p>
-<h3 id="affected-88">Affected</h3>
+<h3 id="affected-104">Affected</h3>
<ul>
<li>Apache Airflow from 2.8.0 before 2.8.3</li>
</ul>
-<h3 id="description-88">Description</h3>
+<h3 id="description-104">Description</h3>
<p>Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access. <br><br>Users of Apache Airflow are recommended to upgrade to version 2.8.3 or newer to mitigate the risk associated with this vulnerability<br></p>
-<h3 id="references-88">References</h3>
+<h3 id="references-104">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/37881">https://github.com/apache/airflow/pull/37881</a></li>
<li><a href="https://lists.apache.org/thread/b4pffc7w7do6qgk4jjbyxvdz5odrvny7">https://lists.apache.org/thread/b4pffc7w7do6qgk4jjbyxvdz5odrvny7</a></li>
</ul>
-<h3 id="credits-86">Credits</h3>
+<h3 id="credits-102">Credits</h3>
<ul>
<li>Alex Liotta (finder)</li>
<li>Vincent(Vincbeck) (remediation developer)</li>
@@ -1803,19 +2118,19 @@
<h2 id="CVE-2024-27906">Dag Code and Import Error Permissions Ignored</h2>
<p>CVE-2024-27906 <a href="https://cve.org/CVERecord?id=CVE-2024-27906">[CVE]</a> <a href="./CVE-2024-27906.cve.json">[CVE json]</a> <a href="./CVE-2024-27906.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-05-06T13:12:04.279Z</em></p>
-<h3 id="affected-89">Affected</h3>
+<h3 id="affected-105">Affected</h3>
<ul>
<li>Apache Airflow before 2.8.2</li>
</ul>
-<h3 id="description-89">Description</h3>
+<h3 id="description-105">Description</h3>
<p>Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI.<br><br>Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability<br></p>
-<h3 id="references-89">References</h3>
+<h3 id="references-105">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/37290">https://github.com/apache/airflow/pull/37290</a></li>
<li><a href="https://github.com/apache/airflow/pull/37468">https://github.com/apache/airflow/pull/37468</a></li>
<li><a href="https://lists.apache.org/thread/on4f7t5sqr3vfgp1pvkck79wv7mq9st5">https://lists.apache.org/thread/on4f7t5sqr3vfgp1pvkck79wv7mq9st5</a></li>
</ul>
-<h3 id="credits-87">Credits</h3>
+<h3 id="credits-103">Credits</h3>
<ul>
<li>Alex Liotta (finder)</li>
<li>Sreenivasulu Suuda (finder)</li>
@@ -1825,75 +2140,75 @@
<h2 id="CVE-2024-26280">Overly broad default permissions for Viewer/Ops (audit logs)</h2>
<p>CVE-2024-26280 <a href="https://cve.org/CVERecord?id=CVE-2024-26280">[CVE]</a> <a href="./CVE-2024-26280.cve.json">[CVE json]</a> <a href="./CVE-2024-26280.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-03-01T11:05:52.165Z</em></p>
-<h3 id="affected-90">Affected</h3>
+<h3 id="affected-106">Affected</h3>
<ul>
<li>Apache Airflow before 2.8.2</li>
</ul>
-<h3 id="description-90">Description</h3>
+<h3 id="description-106">Description</h3>
<p>Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by default, they need to be explicitly granted permissions to see the logs. Only admin users have audit log permission by default.<br><br>Users of Apache Airflow are recommended to upgrade to version [...]
-<h3 id="references-90">References</h3>
+<h3 id="references-106">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/37501">https://github.com/apache/airflow/pull/37501</a></li>
<li><a href="https://lists.apache.org/thread/knskxxxml95091rsnpxkpo1jjp8rj0fh">https://lists.apache.org/thread/knskxxxml95091rsnpxkpo1jjp8rj0fh</a></li>
</ul>
-<h3 id="credits-88">Credits</h3>
+<h3 id="credits-104">Credits</h3>
<ul>
<li>Yusuf AYDIN (@h1_yusuf) (finder)</li>
</ul>
<h2 id="CVE-2024-25142">Cache Control - Storage of Sensitive Data in Browser Cache </h2>
<p>CVE-2024-25142 <a href="https://cve.org/CVERecord?id=CVE-2024-25142">[CVE]</a> <a href="./CVE-2024-25142.cve.json">[CVE json]</a> <a href="./CVE-2024-25142.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-06-14T08:25:32.229Z</em></p>
-<h3 id="affected-91">Affected</h3>
+<h3 id="affected-107">Affected</h3>
<ul>
<li>Apache Airflow before 2.9.2</li>
</ul>
-<h3 id="description-91">Description</h3>
+<h3 id="description-107">Description</h3>
<p>Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. </p><p>Airflow did not return "Cache-Control" header for dynamic content, which in case of some browsers could result in potentially storing sensitive data in local cache of the browser.</p><p>This issue affects Apache Airflow: before 2.9.2.</p><p>Users are recommended to upgrade to version 2.9.2, which fixes the issue.</p>
-<h3 id="references-91">References</h3>
+<h3 id="references-107">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/39550">https://github.com/apache/airflow/pull/39550</a></li>
<li><a href="https://lists.apache.org/thread/cg1j28lk0fhzthk0of1g7vy7p2n1j7nr">https://lists.apache.org/thread/cg1j28lk0fhzthk0of1g7vy7p2n1j7nr</a></li>
</ul>
-<h3 id="credits-89">Credits</h3>
+<h3 id="credits-105">Credits</h3>
<ul>
<li>Jens Scheffler (reporter)</li>
</ul>
<h2 id="CVE-2024-25141">Certificate validation isn’t respected even if SSL is enabled for apache-airflow-providers-mongo </h2>
<p>CVE-2024-25141 <a href="https://cve.org/CVERecord?id=CVE-2024-25141">[CVE]</a> <a href="./CVE-2024-25141.cve.json">[CVE json]</a> <a href="./CVE-2024-25141.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-02-20T20:30:25.779Z</em></p>
-<h3 id="affected-92">Affected</h3>
+<h3 id="affected-108">Affected</h3>
<ul>
<li>Apache Airflow Mongo Provider from 1.0.0 before 4.0.0</li>
</ul>
-<h3 id="description-92">Description</h3>
+<h3 id="description-108">Description</h3>
<p><span style="background-color: rgb(255, 255, 255);">When </span><code>ssl</code><span style="background-color: rgb(255, 255, 255);"> was enabled for Mongo Hook, default settings included “allow_insecure” which caused that certificates were not validated. This was unexpected and undocumented.</span><br>Users are recommended to upgrade to version 4.0.0, which fixes this issue.</p>
-<h3 id="references-92">References</h3>
+<h3 id="references-108">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/37214">https://github.com/apache/airflow/pull/37214</a></li>
<li><a href="https://lists.apache.org/thread/sqgbfqngjmn45ommmrgj7hvs7fgspsgm">https://lists.apache.org/thread/sqgbfqngjmn45ommmrgj7hvs7fgspsgm</a></li>
</ul>
-<h3 id="credits-90">Credits</h3>
+<h3 id="credits-106">Credits</h3>
<ul>
<li>Noah Stapp (reporter)</li>
</ul>
<h2 id="CVE-2023-51702">Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service</h2>
<p>CVE-2023-51702 <a href="https://cve.org/CVERecord?id=CVE-2023-51702">[CVE]</a> <a href="./CVE-2023-51702.cve.json">[CVE json]</a> <a href="./CVE-2023-51702.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-01-24T12:56:15.440Z</em></p>
-<h3 id="affected-93">Affected</h3>
+<h3 id="affected-109">Affected</h3>
<ul>
<li>Apache Airflow CNCF Kubernetes provider from 5.2.0 before 7.0.0</li>
<li>Apache Airflow from 2.3.0 before 2.6.1</li>
</ul>
-<h3 id="description-93">Description</h3>
+<h3 id="description-109">Description</h3>
<p>Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an Airflow version between 2.3.0 and 2.6.0, the configuration dictionary will be logged as plain text in the triggerer service without masking. This allows anyone with access to the metadata or t [...]
-<h3 id="references-93">References</h3>
+<h3 id="references-109">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29498">https://github.com/apache/airflow/pull/29498</a></li>
<li><a href="https://github.com/apache/airflow/pull/30110">https://github.com/apache/airflow/pull/30110</a></li>
<li><a href="https://github.com/apache/airflow/pull/36492">https://github.com/apache/airflow/pull/36492</a></li>
<li><a href="https://lists.apache.org/thread/89x3q6lz5pykrkr1fkr04k4rfn9pvnv9">https://lists.apache.org/thread/89x3q6lz5pykrkr1fkr04k4rfn9pvnv9</a></li>
</ul>
-<h3 id="credits-91">Credits</h3>
+<h3 id="credits-107">Credits</h3>
<ul>
<li>Hussein Awala (finder)</li>
<li>Hussein Awala (remediation developer)</li>
@@ -1901,36 +2216,36 @@
<h2 id="CVE-2023-50944">Bypass permission verification to read code of other dags</h2>
<p>CVE-2023-50944 <a href="https://cve.org/CVERecord?id=CVE-2023-50944">[CVE]</a> <a href="./CVE-2023-50944.cve.json">[CVE json]</a> <a href="./CVE-2023-50944.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-01-24T12:58:17.032Z</em></p>
-<h3 id="affected-94">Affected</h3>
+<h3 id="affected-110">Affected</h3>
<ul>
<li>Apache Airflow before 2.8.1</li>
</ul>
-<h3 id="description-94">Description</h3>
+<h3 id="description-110">Description</h3>
<p>Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don’t have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue.<br></p>
-<h3 id="references-94">References</h3>
+<h3 id="references-110">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/36257">https://github.com/apache/airflow/pull/36257</a></li>
<li><a href="https://lists.apache.org/thread/92krb5mpcq8qrw4t4j5oooqw7hgd8q7h">https://lists.apache.org/thread/92krb5mpcq8qrw4t4j5oooqw7hgd8q7h</a></li>
</ul>
-<h3 id="credits-92">Credits</h3>
+<h3 id="credits-108">Credits</h3>
<ul>
<li>Timon8 Zhang (finder)</li>
</ul>
<h2 id="CVE-2023-50943">Potential pickle deserialization vulnerability in XComs</h2>
<p>CVE-2023-50943 <a href="https://cve.org/CVERecord?id=CVE-2023-50943">[CVE]</a> <a href="./CVE-2023-50943.cve.json">[CVE json]</a> <a href="./CVE-2023-50943.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-01-24T12:57:05.049Z</em></p>
-<h3 id="affected-95">Affected</h3>
+<h3 id="affected-111">Affected</h3>
<ul>
<li>Apache Airflow before 2.8.1</li>
</ul>
-<h3 id="description-95">Description</h3>
+<h3 id="description-111">Description</h3>
<p>Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of “enable_xcom_pickling=False” configuration setting resulting in poisoned data after XCom deserialization. This vulnerability is considered low since it requires a DAG author to exploit it. Users are recommended to upgrade to version 2.8.1 or later, which fixes this issue.<br></p>
-<h3 id="references-95">References</h3>
+<h3 id="references-111">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/36255">https://github.com/apache/airflow/pull/36255</a></li>
<li><a href="https://lists.apache.org/thread/fx278v0twqzxkcts70tc04cp3f8p56pn">https://lists.apache.org/thread/fx278v0twqzxkcts70tc04cp3f8p56pn</a></li>
</ul>
-<h3 id="credits-93">Credits</h3>
+<h3 id="credits-109">Credits</h3>
<ul>
<li>Peng Zhou (<a href="mailto:zpbrent@gmail.com">zpbrent@gmail.com</a>) (finder)</li>
<li>Hussein Awala (remediation developer)</li>
@@ -1938,18 +2253,18 @@
<h2 id="CVE-2023-50783">Improper access control vulnerability on the “varimport” endpoint</h2>
<p>CVE-2023-50783 <a href="https://cve.org/CVERecord?id=CVE-2023-50783">[CVE]</a> <a href="./CVE-2023-50783.cve.json">[CVE json]</a> <a href="./CVE-2023-50783.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-12-21T09:28:46.089Z</em></p>
-<h3 id="affected-96">Affected</h3>
+<h3 id="affected-112">Affected</h3>
<ul>
<li>Apache Airflow before 2.8.0</li>
</ul>
-<h3 id="description-96">Description</h3>
+<h3 id="description-112">Description</h3>
<p>Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable.<br>This flaw compromises the integrity of variable management, potentially leading to unauthorized data modification.<br>Users are recommended to upgrade to 2.8.0, which fixes this issue</p>
-<h3 id="references-96">References</h3>
+<h3 id="references-112">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33932">https://github.com/apache/airflow/pull/33932</a></li>
<li><a href="https://lists.apache.org/thread/rs7cr3yp726mb89s1m844hy9pq7frgcn">https://lists.apache.org/thread/rs7cr3yp726mb89s1m844hy9pq7frgcn</a></li>
</ul>
-<h3 id="credits-94">Credits</h3>
+<h3 id="credits-110">Credits</h3>
<ul>
<li>balis0ng (finder)</li>
<li>Ephraim Anierobi (remediation developer)</li>
@@ -1957,18 +2272,18 @@
<h2 id="CVE-2023-49920">Missing CSRF protection on DAG/trigger</h2>
<p>CVE-2023-49920 <a href="https://cve.org/CVERecord?id=CVE-2023-49920">[CVE]</a> <a href="./CVE-2023-49920.cve.json">[CVE json]</a> <a href="./CVE-2023-49920.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-12-21T09:27:07.715Z</em></p>
-<h3 id="affected-97">Affected</h3>
+<h3 id="affected-113">Affected</h3>
<ul>
<li>Apache Airflow from 2.7.0 before 2.8.0</li>
</ul>
-<h3 id="description-97">Description</h3>
+<h3 id="description-113">Description</h3>
<p>Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user’s consent.<br>Users are advised to upgrade to version 2.8.0 or later which is not affected</p>
-<h3 id="references-97">References</h3>
+<h3 id="references-113">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/36026">https://github.com/apache/airflow/pull/36026</a></li>
<li><a href="https://lists.apache.org/thread/mnwd2vcfw3gms6ft6kl951vfbqrxsnjq">https://lists.apache.org/thread/mnwd2vcfw3gms6ft6kl951vfbqrxsnjq</a></li>
</ul>
-<h3 id="credits-95">Credits</h3>
+<h3 id="credits-111">Credits</h3>
<ul>
<li>Tareq Ahamed ( 0xt4req) (finder)</li>
<li>Jens Scheffler (remediation developer)</li>
@@ -1976,18 +2291,18 @@
<h2 id="CVE-2023-48291">Improper access control to DAG resources</h2>
<p>CVE-2023-48291 <a href="https://cve.org/CVERecord?id=CVE-2023-48291">[CVE]</a> <a href="./CVE-2023-48291.cve.json">[CVE json]</a> <a href="./CVE-2023-48291.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-12-21T09:30:40.260Z</em></p>
-<h3 id="affected-98">Affected</h3>
+<h3 id="affected-114">Affected</h3>
<ul>
<li>Apache Airflow before 2.8.0</li>
</ul>
-<h3 id="description-98">Description</h3>
+<h3 id="description-114">Description</h3>
<p>Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn’t.<br><br>This is a missing fix for CVE-2023-42792 in Apache Airflow 2.7.2 <br><br>Users of Apache Airflow are strongly advised to upgrade to version 2.8.0 or newe [...]
-<h3 id="references-98">References</h3>
+<h3 id="references-114">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/34366">https://github.com/apache/airflow/pull/34366</a></li>
<li><a href="https://lists.apache.org/thread/3nl0h014274yjlt1hd02z0q78ftyz0z3">https://lists.apache.org/thread/3nl0h014274yjlt1hd02z0q78ftyz0z3</a></li>
</ul>
-<h3 id="credits-96">Credits</h3>
+<h3 id="credits-112">Credits</h3>
<ul>
<li>balis0ng (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -1995,18 +2310,18 @@
<h2 id="CVE-2023-47265">DAG Params alllow to embed unchecked Javascript</h2>
<p>CVE-2023-47265 <a href="https://cve.org/CVERecord?id=CVE-2023-47265">[CVE]</a> <a href="./CVE-2023-47265.cve.json">[CVE json]</a> <a href="./CVE-2023-47265.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-12-21T09:28:05.966Z</em></p>
-<h3 id="affected-99">Affected</h3>
+<h3 id="affected-115">Affected</h3>
<ul>
<li>Apache Airflow from 2.6.0 before 2.8.0</li>
</ul>
-<h3 id="description-99">Description</h3>
+<h3 id="description-115">Description</h3>
<p>Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG. This Javascript can be executed on the client side of any of the user who looks at the tasks in the browser sandbox. While this issue does not allow to exit the browser sandbox or manipulation of the server-side data - more than the DAG author already has, it allows to modify what the user l [...]
-<h3 id="references-99">References</h3>
+<h3 id="references-115">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/35460">https://github.com/apache/airflow/pull/35460</a></li>
<li><a href="https://lists.apache.org/thread/128f3zl375vb1qv93k82zhnwkpl233pr">https://lists.apache.org/thread/128f3zl375vb1qv93k82zhnwkpl233pr</a></li>
</ul>
-<h3 id="credits-97">Credits</h3>
+<h3 id="credits-113">Credits</h3>
<ul>
<li>Jens Scheffler (finder)</li>
<li>Andrey Anshin (finder)</li>
@@ -2015,18 +2330,18 @@
<h2 id="CVE-2023-47037">Apache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access)</h2>
<p>CVE-2023-47037 <a href="https://cve.org/CVERecord?id=CVE-2023-47037">[CVE]</a> <a href="./CVE-2023-47037.cve.json">[CVE json]</a> <a href="./CVE-2023-47037.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-11-12T13:12:20.076Z</em></p>
-<h3 id="affected-100">Affected</h3>
+<h3 id="affected-116">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.3</li>
</ul>
-<h3 id="description-100">Description</h3>
+<h3 id="description-116">Description</h3>
<p><span style="background-color: rgb(255, 255, 255);">We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then. </span></p><p><span style="background-color: rgb(255, 255, 255);">Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, et [...]
-<h3 id="references-100">References</h3>
+<h3 id="references-116">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33413">https://github.com/apache/airflow/pull/33413</a></li>
<li><a href="https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0">https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0</a></li>
</ul>
-<h3 id="credits-98">Credits</h3>
+<h3 id="credits-114">Credits</h3>
<ul>
<li>Tareq Ahamed from Hackerone (reporter)</li>
<li>Augusto Hidalgo (remediation developer)</li>
@@ -2034,18 +2349,18 @@
<h2 id="CVE-2023-46288">Sensitive parameters exposed in API when “non-sensitive-only” configuration is set</h2>
<p>CVE-2023-46288 <a href="https://cve.org/CVERecord?id=CVE-2023-46288">[CVE]</a> <a href="./CVE-2023-46288.cve.json">[CVE json]</a> <a href="./CVE-2023-46288.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-10-23T18:13:01.162Z</em></p>
-<h3 id="affected-101">Affected</h3>
+<h3 id="affected-117">Affected</h3>
<ul>
<li>Apache Airflow from 2.4.0 before 2.7.0</li>
</ul>
-<h3 id="description-101">Description</h3>
+<h3 id="description-117">Description</h3>
<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.<p>This issue affects Apache Airflow from 2.4.0 to 2.7.0.</p><p>Sensitive configuration information has been exposed to authenticated users with the ability to read configuration via Airflow REST API for configuration even when the <code>expose_config</code> option is set to <code>non-sensitive-only</code>. The expose_config option is False by default. It is recommended to upgrade to a version t [...]
-<h3 id="references-101">References</h3>
+<h3 id="references-117">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/32261">https://github.com/apache/airflow/pull/32261</a></li>
<li><a href="https://lists.apache.org/thread/yw4vzm0c5lqkwm0bxv6qy03yfd1od4nw">https://lists.apache.org/thread/yw4vzm0c5lqkwm0bxv6qy03yfd1od4nw</a></li>
</ul>
-<h3 id="credits-99">Credits</h3>
+<h3 id="credits-115">Credits</h3>
<ul>
<li>id_No2015429 of 3H Secruity Team (finder)</li>
<li>Lee, Wei (finder)</li>
@@ -2054,37 +2369,37 @@
<h2 id="CVE-2023-46215">Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend</h2>
<p>CVE-2023-46215 <a href="https://cve.org/CVERecord?id=CVE-2023-46215">[CVE]</a> <a href="./CVE-2023-46215.cve.json">[CVE json]</a> <a href="./CVE-2023-46215.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-10-28T07:10:54.392Z</em></p>
-<h3 id="affected-102">Affected</h3>
+<h3 id="affected-118">Affected</h3>
<ul>
<li>Apache Airflow Celery provider from 3.3.0 through 3.4.0</li>
<li>Apache Airflow from 1.10.0 before 2.7.0</li>
</ul>
-<h3 id="description-102">Description</h3>
+<h3 id="description-118">Description</h3>
<p>Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow.<br><br><p>Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend<br>Note: the vulnerability is about the information exposed in the logs not about accessing the logs.</p><p>This issue affects Apache Airflow Celery provider: from 3.3.0 through 3.4.0; Apache Airflow: from 1.10.0 through 2.6.3.</p><p>Users are recommended [...]
-<h3 id="references-102">References</h3>
+<h3 id="references-118">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/34954">https://github.com/apache/airflow/pull/34954</a></li>
<li><a href="https://lists.apache.org/thread/wm1jfmks7r6m7bj0mq4lmw3998svn46n">https://lists.apache.org/thread/wm1jfmks7r6m7bj0mq4lmw3998svn46n</a></li>
</ul>
-<h3 id="credits-100">Credits</h3>
+<h3 id="credits-116">Credits</h3>
<ul>
<li>husseinawala (finder)</li>
</ul>
<h2 id="CVE-2023-45348">Configuration information leakage vulnerability</h2>
<p>CVE-2023-45348 <a href="https://cve.org/CVERecord?id=CVE-2023-45348">[CVE]</a> <a href="./CVE-2023-45348.cve.json">[CVE json]</a> <a href="./CVE-2023-45348.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-10-14T09:46:37.359Z</em></p>
-<h3 id="affected-103">Affected</h3>
+<h3 id="affected-119">Affected</h3>
<ul>
<li>Apache Airflow from 2.7.0 before 2.7.2</li>
</ul>
-<h3 id="description-103">Description</h3>
+<h3 id="description-119">Description</h3>
<p>Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when the “expose_config” option is set to “non-sensitive-only”. The <code>expose_config</code> option is False by default.<br>It is recommended to upgrade to a version that is not affected.</p>
-<h3 id="references-103">References</h3>
+<h3 id="references-119">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/34712">https://github.com/apache/airflow/pull/34712</a></li>
<li><a href="https://lists.apache.org/thread/sy4l5d6tn58hr8r61r2fkt1f0qock9z9">https://lists.apache.org/thread/sy4l5d6tn58hr8r61r2fkt1f0qock9z9</a></li>
</ul>
-<h3 id="credits-101">Credits</h3>
+<h3 id="credits-117">Credits</h3>
<ul>
<li>L3yx of Syclover Security Team (finder)</li>
<li>Hussein Awala (remediation developer)</li>
@@ -2092,18 +2407,18 @@
<h2 id="CVE-2023-42792">Improper access control to DAG resources</h2>
<p>CVE-2023-42792 <a href="https://cve.org/CVERecord?id=CVE-2023-42792">[CVE]</a> <a href="./CVE-2023-42792.cve.json">[CVE json]</a> <a href="./CVE-2023-42792.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-10-14T09:47:04.851Z</em></p>
-<h3 id="affected-104">Affected</h3>
+<h3 id="affected-120">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.2</li>
</ul>
-<h3 id="description-104">Description</h3>
+<h3 id="description-120">Description</h3>
<p>Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn’t.<br><br>Users of Apache Airflow are strongly advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.<br></p>
-<h3 id="references-104">References</h3>
+<h3 id="references-120">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/34366">https://github.com/apache/airflow/pull/34366</a></li>
<li><a href="https://lists.apache.org/thread/1spbo9nkn49fc2hnxqm9tf6mgqwp9tjq">https://lists.apache.org/thread/1spbo9nkn49fc2hnxqm9tf6mgqwp9tjq</a></li>
</ul>
-<h3 id="credits-102">Credits</h3>
+<h3 id="credits-118">Credits</h3>
<ul>
<li>balis0ng (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -2111,18 +2426,18 @@
<h2 id="CVE-2023-42781">Permission verification bypass allows viewing dagruns of other dags</h2>
<p>CVE-2023-42781 <a href="https://cve.org/CVERecord?id=CVE-2023-42781">[CVE]</a> <a href="./CVE-2023-42781.cve.json">[CVE json]</a> <a href="./CVE-2023-42781.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-11-12T13:14:05.928Z</em></p>
-<h3 id="affected-105">Affected</h3>
+<h3 id="affected-121">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.3</li>
</ul>
-<h3 id="description-105">Description</h3>
+<h3 id="description-121">Description</h3>
<p>Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. This is a different issue than CVE-2023-42663 but leading to similar outcome.<br>Users of Apache Airflow are advised to upgrade to version 2.7.3 or newer to mitigate the risk associated with this vulnerability.</p>
-<h3 id="references-105">References</h3>
+<h3 id="references-121">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/34939">https://github.com/apache/airflow/pull/34939</a></li>
<li><a href="https://lists.apache.org/thread/7dnl8nszdxqyns57f3dw0sloy5dfl9o1">https://lists.apache.org/thread/7dnl8nszdxqyns57f3dw0sloy5dfl9o1</a></li>
</ul>
-<h3 id="credits-103">Credits</h3>
+<h3 id="credits-119">Credits</h3>
<ul>
<li>balis0ng (finder)</li>
<li>Hussein Awala (remediation developer)</li>
@@ -2130,18 +2445,18 @@
<h2 id="CVE-2023-42780">Improper access control vulnerability in the “List dag warnings” feature</h2>
<p>CVE-2023-42780 <a href="https://cve.org/CVERecord?id=CVE-2023-42780">[CVE]</a> <a href="./CVE-2023-42780.cve.json">[CVE json]</a> <a href="./CVE-2023-42780.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-10-14T09:46:05.032Z</em></p>
-<h3 id="affected-106">Affected</h3>
+<h3 id="affected-122">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.2</li>
</ul>
-<h3 id="description-106">Description</h3>
+<h3 id="description-122">Description</h3>
<p>Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAGs. It would reveal the dag_ids and the stack-traces of import errors for those DAGs with import errors.<br>Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.<br><br></p>
-<h3 id="references-106">References</h3>
+<h3 id="references-122">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/34355">https://github.com/apache/airflow/pull/34355</a></li>
<li><a href="https://lists.apache.org/thread/h5tvsvov8j55wojt5sojdprs05oby34d">https://lists.apache.org/thread/h5tvsvov8j55wojt5sojdprs05oby34d</a></li>
</ul>
-<h3 id="credits-104">Credits</h3>
+<h3 id="credits-120">Credits</h3>
<ul>
<li>balis0ng (finder)</li>
<li>Hussein Awala (remediation developer)</li>
@@ -2149,18 +2464,18 @@
<h2 id="CVE-2023-42663">Bypass permission verification to view task instances of other dags</h2>
<p>CVE-2023-42663 <a href="https://cve.org/CVERecord?id=CVE-2023-42663">[CVE]</a> <a href="./CVE-2023-42663.cve.json">[CVE json]</a> <a href="./CVE-2023-42663.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-10-14T09:47:24.055Z</em></p>
-<h3 id="affected-107">Affected</h3>
+<h3 id="affected-123">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.2</li>
</ul>
-<h3 id="description-107">Description</h3>
+<h3 id="description-123">Description</h3>
<p>Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs.<br>Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.<br></p>
-<h3 id="references-107">References</h3>
+<h3 id="references-123">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/34315">https://github.com/apache/airflow/pull/34315</a></li>
<li><a href="https://lists.apache.org/thread/xj86cvfkxgd0cyqfmz6mh1bsfc61c6o9">https://lists.apache.org/thread/xj86cvfkxgd0cyqfmz6mh1bsfc61c6o9</a></li>
</ul>
-<h3 id="credits-105">Credits</h3>
+<h3 id="credits-121">Credits</h3>
<ul>
<li>balis0ng (finder)</li>
<li>Ephraim Anierobi (remediation developer)</li>
@@ -2168,74 +2483,74 @@
<h2 id="CVE-2023-41267">Apache HDFS Provider error message suggested installation of incorrect pip package</h2>
<p>CVE-2023-41267 <a href="https://cve.org/CVERecord?id=CVE-2023-41267">[CVE]</a> <a href="./CVE-2023-41267.cve.json">[CVE json]</a> <a href="./CVE-2023-41267.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-09-14T07:46:36.891Z</em></p>
-<h3 id="affected-108">Affected</h3>
+<h3 id="affected-124">Affected</h3>
<ul>
<li>Apache Airflow HDFS Provider before 4.1.1</li>
</ul>
-<h3 id="description-108">Description</h3>
+<h3 id="description-124">Description</h3>
<p><span style="background-color: rgb(255, 255, 255);">In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The Airflow team has since taken ownership of the package (neutralizing the risk), and fixed the doc strings in version 4.1.1</span><br></p>
-<h3 id="references-108">References</h3>
+<h3 id="references-124">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33813">https://github.com/apache/airflow/pull/33813</a></li>
<li><a href="https://lists.apache.org/thread/ggthr5pn42bn6wcr25hxnykjzh4ntw7z">https://lists.apache.org/thread/ggthr5pn42bn6wcr25hxnykjzh4ntw7z</a></li>
</ul>
-<h3 id="credits-106">Credits</h3>
+<h3 id="credits-122">Credits</h3>
<ul>
<li>AnupamAs01 (finder)</li>
</ul>
<h2 id="CVE-2023-40712">Secrets can be unmasked in the “Rendered Template” </h2>
<p>CVE-2023-40712 <a href="https://cve.org/CVERecord?id=CVE-2023-40712">[CVE]</a> <a href="./CVE-2023-40712.cve.json">[CVE json]</a> <a href="./CVE-2023-40712.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-09-12T11:05:46.999Z</em></p>
-<h3 id="affected-109">Affected</h3>
+<h3 id="affected-125">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.1</li>
</ul>
-<h3 id="description-109">Description</h3>
+<h3 id="description-125">Description</h3>
<p>Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI.<br><br>Users are strongly advised to upgrade to version 2.7.1 or later which has removed the vulnerability.</p>
-<h3 id="references-109">References</h3>
+<h3 id="references-125">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33512">https://github.com/apache/airflow/pull/33512</a></li>
<li><a href="https://github.com/apache/airflow/pull/33516">https://github.com/apache/airflow/pull/33516</a></li>
<li><a href="https://lists.apache.org/thread/jw1yv4lt6hpowqbb0x4o3tdp0jhx2bts">https://lists.apache.org/thread/jw1yv4lt6hpowqbb0x4o3tdp0jhx2bts</a></li>
</ul>
-<h3 id="credits-107">Credits</h3>
+<h3 id="credits-123">Credits</h3>
<ul>
<li>klexadoc (finder)</li>
</ul>
<h2 id="CVE-2023-40611">Apache Airflow Dag Runs Broken Access Control Vulnerability</h2>
<p>CVE-2023-40611 <a href="https://cve.org/CVERecord?id=CVE-2023-40611">[CVE]</a> <a href="./CVE-2023-40611.cve.json">[CVE json]</a> <a href="./CVE-2023-40611.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-09-12T11:05:20.884Z</em></p>
-<h3 id="affected-110">Affected</h3>
+<h3 id="affected-126">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.1</li>
</ul>
-<h3 id="description-110">Description</h3>
+<h3 id="description-126">Description</h3>
<p>Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.<br><br>Users should upgrade to version 2.7.1 or later which has removed the vulnerability.<br></p>
-<h3 id="references-110">References</h3>
+<h3 id="references-126">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33413">https://github.com/apache/airflow/pull/33413</a></li>
<li><a href="https://lists.apache.org/thread/8y9xk1s3j4qr36yzqn8ogbn9fl7pxrn0">https://lists.apache.org/thread/8y9xk1s3j4qr36yzqn8ogbn9fl7pxrn0</a></li>
</ul>
-<h3 id="credits-108">Credits</h3>
+<h3 id="credits-124">Credits</h3>
<ul>
<li>happyhacking (finder)</li>
</ul>
<h2 id="CVE-2023-40273">Session fixation in Apache Airflow web interface</h2>
<p>CVE-2023-40273 <a href="https://cve.org/CVERecord?id=CVE-2023-40273">[CVE]</a> <a href="./CVE-2023-40273.cve.json">[CVE json]</a> <a href="./CVE-2023-40273.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-09-12T06:41:25.454Z</em></p>
-<h3 id="affected-111">Affected</h3>
+<h3 id="affected-127">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.0</li>
</ul>
-<h3 id="description-111">Description</h3>
+<h3 id="description-127">Description</h3>
<p>The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database (for <code>database</code> session backend), or changing the secure_key and restarting the webserver, there were no mechanisms to force-logout the user (and all other users with that).</p><p>With this fix implement [...]
-<h3 id="references-111">References</h3>
+<h3 id="references-127">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33347">https://github.com/apache/airflow/pull/33347</a></li>
<li><a href="https://lists.apache.org/thread/9rdmv8ln4y4ncbyrlmjrsj903x4l80nj">https://lists.apache.org/thread/9rdmv8ln4y4ncbyrlmjrsj903x4l80nj</a></li>
<li><a href="https://www.openwall.com/lists/oss-security/2023/08/23/1">https://www.openwall.com/lists/oss-security/2023/08/23/1</a></li>
</ul>
-<h3 id="credits-109">Credits</h3>
+<h3 id="credits-125">Credits</h3>
<ul>
<li>Yusuf AYDIN (@h1_yusuf) (finder)</li>
<li>L3yx of Syclover Security Team. (finder)</li>
@@ -2245,53 +2560,53 @@
<h2 id="CVE-2023-40272">Apache Airflow Spark Provider Arbitrary File Read via JDBC</h2>
<p>CVE-2023-40272 <a href="https://cve.org/CVERecord?id=CVE-2023-40272">[CVE]</a> <a href="./CVE-2023-40272.cve.json">[CVE json]</a> <a href="./CVE-2023-40272.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-08-17T13:52:26.145Z</em></p>
-<h3 id="affected-112">Affected</h3>
+<h3 id="affected-128">Affected</h3>
<ul>
<li>Apache Airflow Spark Provider before 4.1.3</li>
</ul>
-<h3 id="description-112">Description</h3>
+<h3 id="description-128">Description</h3>
<p>Apache Airflow Spark Provider, versions before 4.1.3, is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection giving an opportunity to read files on the Airflow server.<br>It is recommended to upgrade to a version that is not affected.</p><p></p>
-<h3 id="references-112">References</h3>
+<h3 id="references-128">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/t03gktyzyor20rh06okd91jtqmw6k1l7">https://lists.apache.org/thread/t03gktyzyor20rh06okd91jtqmw6k1l7</a></li>
</ul>
-<h3 id="credits-110">Credits</h3>
+<h3 id="credits-126">Credits</h3>
<ul>
<li>sw0rd1ight (finder)</li>
</ul>
<h2 id="CVE-2023-40195">Apache Airflow Spark Provider Deserialization Vulnerability RCE</h2>
<p>CVE-2023-40195 <a href="https://cve.org/CVERecord?id=CVE-2023-40195">[CVE]</a> <a href="./CVE-2023-40195.cve.json">[CVE json]</a> <a href="./CVE-2023-40195.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-08-28T07:49:59.173Z</em></p>
-<h3 id="affected-113">Affected</h3>
+<h3 id="affected-129">Affected</h3>
<ul>
<li>Apache Airflow Spark Provider before 4.1.3</li>
</ul>
-<h3 id="description-113">Description</h3>
+<h3 id="description-129">Description</h3>
<p>Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Software Foundation Apache Airflow Spark Provider.<br><br><br><span style="background-color: rgb(255, 255, 255);">When the Apache Spark provider is installed on an Airflow deployment, an Airflow user that is authorized to configure Spark hooks can effectively run arbitrary code on the Airflow node by pointing it at a malicious Spark server. Prior to version 4.1.3, this w [...]
-<h3 id="references-113">References</h3>
+<h3 id="references-129">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33233">https://github.com/apache/airflow/pull/33233</a></li>
<li><a href="https://lists.apache.org/thread/fzy95b1d6zv31j5wrx3znhzcscck2o24">https://lists.apache.org/thread/fzy95b1d6zv31j5wrx3znhzcscck2o24</a></li>
</ul>
-<h3 id="credits-111">Credits</h3>
+<h3 id="credits-127">Credits</h3>
<ul>
<li>happyhacking-k (finder)</li>
</ul>
<h2 id="CVE-2023-39553">Apache Airflow Drill Provider Arbitrary File Read Vulnerability</h2>
<p>CVE-2023-39553 <a href="https://cve.org/CVERecord?id=CVE-2023-39553">[CVE]</a> <a href="./CVE-2023-39553.cve.json">[CVE json]</a> <a href="./CVE-2023-39553.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-08-11T18:42:20.040Z</em></p>
-<h3 id="affected-114">Affected</h3>
+<h3 id="affected-130">Affected</h3>
<ul>
<li>Apache Airflow Drill Provider before 2.4.3</li>
</ul>
-<h3 id="description-114">Description</h3>
+<h3 id="description-130">Description</h3>
<p>Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.<br><br><span style="background-color: rgb(255, 255, 255);">Apache Airflow Drill Provider is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection with DrillHook giving an opportunity to read files on the Airflow server.</span><br><p>This issue affects Apache Airflow Drill Provider: before 2.4.3.<br><span style="background-col [...]
-<h3 id="references-114">References</h3>
+<h3 id="references-130">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33074">https://github.com/apache/airflow/pull/33074</a></li>
<li><a href="https://lists.apache.org/thread/ozpl0opmob49rkcz8svo8wkxyw1395sf">https://lists.apache.org/thread/ozpl0opmob49rkcz8svo8wkxyw1395sf</a></li>
</ul>
-<h3 id="credits-112">Credits</h3>
+<h3 id="credits-128">Credits</h3>
<ul>
<li>sw0rd1ight of Caiji Sec Team and 4ra1n of Chaitin Tech (finder)</li>
<li>happyhacking (finder)</li>
@@ -2299,75 +2614,75 @@
<h2 id="CVE-2023-39508">Airflow “Run task” feature allows execution with unnecessary priviledges</h2>
<p>CVE-2023-39508 <a href="https://cve.org/CVERecord?id=CVE-2023-39508">[CVE]</a> <a href="./CVE-2023-39508.cve.json">[CVE json]</a> <a href="./CVE-2023-39508.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-08-05T06:47:11.955Z</em></p>
-<h3 id="affected-115">Affected</h3>
+<h3 id="affected-131">Affected</h3>
<ul>
<li>Apache Airflow before 2.6.0</li>
</ul>
-<h3 id="description-115">Description</h3>
+<h3 id="description-131">Description</h3>
<p>Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.<p>The “Run Task” feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the webserver context as well as allows to bypas limitation of access the user has to certain DAGs. The “Run Task” feature is considered dangerous and it has been removed enti [...]
-<h3 id="references-115">References</h3>
+<h3 id="references-131">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29706">https://github.com/apache/airflow/pull/29706</a></li>
<li><a href="https://lists.apache.org/thread/j2nkjd0zqvtqk85s6ywpx3c35pvzyx15">https://lists.apache.org/thread/j2nkjd0zqvtqk85s6ywpx3c35pvzyx15</a></li>
</ul>
-<h3 id="credits-113">Credits</h3>
+<h3 id="credits-129">Credits</h3>
<ul>
<li>balis0ng (finder)</li>
</ul>
<h2 id="CVE-2023-39441">SMTP/IMAP client components allowed MITM due to missing Certificate Validation</h2>
<p>CVE-2023-39441 <a href="https://cve.org/CVERecord?id=CVE-2023-39441">[CVE]</a> <a href="./CVE-2023-39441.cve.json">[CVE json]</a> <a href="./CVE-2023-39441.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-08-23T15:39:49.970Z</em></p>
-<h3 id="affected-116">Affected</h3>
+<h3 id="affected-132">Affected</h3>
<ul>
<li>Apache Airflow SMTP Provider before 1.30</li>
<li>Apache Airflow IMAP Provider before 3.3.0</li>
<li>Apache Airflow before 2.7.0</li>
</ul>
-<h3 id="description-116">Description</h3>
+<h3 id="description-132">Description</h3>
<p><span style="background-color: rgb(255, 255, 255);">Apache Airflow SMTP Provider </span><span style="background-color: rgb(255, 255, 255);">before 1.3.0</span><span style="background-color: rgb(255, 255, 255);">, Apache Airflow IMAP Provider </span><span style="background-color: rgb(255, 255, 255);">before 3.3.0, and</span><span style="background-color: rgb(255, 255, 255);"> Apache Airflow </span><span style="background-color: rgb(255, 255, 255);">before 2.7.0 are affected by the </sp [...]
-<h3 id="references-116">References</h3>
+<h3 id="references-132">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33075">https://github.com/apache/airflow/pull/33075</a></li>
<li><a href="https://github.com/apache/airflow/pull/33108">https://github.com/apache/airflow/pull/33108</a></li>
<li><a href="https://github.com/apache/airflow/pull/33070">https://github.com/apache/airflow/pull/33070</a></li>
<li><a href="https://lists.apache.org/thread/xzp4wgjg2b1o6ylk2595df8bstlbo1lb">https://lists.apache.org/thread/xzp4wgjg2b1o6ylk2595df8bstlbo1lb</a></li>
</ul>
-<h3 id="credits-114">Credits</h3>
+<h3 id="credits-130">Credits</h3>
<ul>
<li>Martin Schobert, Pentagrid AG (finder)</li>
</ul>
<h2 id="CVE-2023-37415">Improper Input Validation in Hive Provider with proxy_user</h2>
<p>CVE-2023-37415 <a href="https://cve.org/CVERecord?id=CVE-2023-37415">[CVE]</a> <a href="./CVE-2023-37415.cve.json">[CVE json]</a> <a href="./CVE-2023-37415.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-07-13T07:35:30.726Z</em></p>
-<h3 id="affected-117">Affected</h3>
+<h3 id="affected-133">Affected</h3>
<ul>
<li>Apache Airflow Apache Hive Provider before 6.1.2</li>
</ul>
-<h3 id="description-117">Description</h3>
+<h3 id="description-133">Description</h3>
<p>Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider.<br><br>Patching on top of CVE-2023-35797<br><p>Before 6.1.2<span style="background-color: rgb(255, 255, 255);"> the proxy_user option can also inject semicolon.<br></span><br>This issue affects Apache Airflow Apache Hive Provider: before 6.1.2.<br><br></p><p>It is recommended updating provider version to 6.1.2 in order to avoid this vulnerability.</p><p></p></p>
-<h3 id="references-117">References</h3>
+<h3 id="references-133">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/9wx0jlckbnycjh8nj5qfwxo423zvm41k">https://lists.apache.org/thread/9wx0jlckbnycjh8nj5qfwxo423zvm41k</a></li>
</ul>
-<h3 id="credits-115">Credits</h3>
+<h3 id="credits-131">Credits</h3>
<ul>
<li>Son Tran from VNPT - VCI (reporter)</li>
</ul>
<h2 id="CVE-2023-37379">Exposure of sensitive connection information, DOS and SSRF on “test connection” feature</h2>
<p>CVE-2023-37379 <a href="https://cve.org/CVERecord?id=CVE-2023-37379">[CVE]</a> <a href="./CVE-2023-37379.cve.json">[CVE json]</a> <a href="./CVE-2023-37379.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-08-23T15:38:53.691Z</em></p>
-<h3 id="affected-118">Affected</h3>
+<h3 id="affected-134">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.0</li>
</ul>
-<h3 id="description-118">Description</h3>
+<h3 id="description-134">Description</h3>
<p>Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connection feature by sending many requests, leading to a denial of service (DoS) condition on the server. Furthermore, malicious actors can leverage this vulnerability to establish harmful connections with the server.</p><p>Users of Ap [...]
-<h3 id="references-118">References</h3>
+<h3 id="references-134">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/32052">https://github.com/apache/airflow/pull/32052</a></li>
<li><a href="https://lists.apache.org/thread/g5c9vcn27lr14go48thrjpo6f4vw571r">https://lists.apache.org/thread/g5c9vcn27lr14go48thrjpo6f4vw571r</a></li>
</ul>
-<h3 id="credits-116">Credits</h3>
+<h3 id="credits-132">Credits</h3>
<ul>
<li>kuteminh11 (finder)</li>
<li>khoabda of Zalo Security Team (finder)</li>
@@ -2378,18 +2693,18 @@
<h2 id="CVE-2023-36543">ReDoS via dags function</h2>
<p>CVE-2023-36543 <a href="https://cve.org/CVERecord?id=CVE-2023-36543">[CVE]</a> <a href="./CVE-2023-36543.cve.json">[CVE json]</a> <a href="./CVE-2023-36543.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-07-21T10:49:41.270Z</em></p>
-<h3 id="affected-119">Affected</h3>
+<h3 id="affected-135">Affected</h3>
<ul>
<li>Apache Airflow before 2.6.3</li>
</ul>
-<h3 id="description-119">Description</h3>
+<h3 id="description-135">Description</h3>
<p>Apache Airflow, versions before 2.6.3, has a vulnerability where an authenticated user can use crafted input to make the current request hang. It is recommended to upgrade to a version that is not affected</p>
-<h3 id="references-119">References</h3>
+<h3 id="references-135">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/32060">https://github.com/apache/airflow/pull/32060</a></li>
<li><a href="https://lists.apache.org/thread/tokfs980504ylgk3cv3hjlnrtbv4tng4">https://lists.apache.org/thread/tokfs980504ylgk3cv3hjlnrtbv4tng4</a></li>
</ul>
-<h3 id="credits-117">Credits</h3>
+<h3 id="credits-133">Credits</h3>
<ul>
<li>National Cyber Security VietNam (NCS VietNam) (finder)</li>
<li>hungtd (finder)</li>
@@ -2397,124 +2712,124 @@
<h2 id="CVE-2023-35908">Access to DAGs without relevant permission</h2>
<p>CVE-2023-35908 <a href="https://cve.org/CVERecord?id=CVE-2023-35908">[CVE]</a> <a href="./CVE-2023-35908.cve.json">[CVE json]</a> <a href="./CVE-2023-35908.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-07-12T09:14:08.022Z</em></p>
-<h3 id="affected-120">Affected</h3>
+<h3 id="affected-136">Affected</h3>
<ul>
<li>Apache Airflow before 2.6.3</li>
</ul>
-<h3 id="description-120">Description</h3>
+<h3 id="description-136">Description</h3>
<p>Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL. It is recommended to upgrade to a version that is not affected</p>
-<h3 id="references-120">References</h3>
+<h3 id="references-136">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/32014">https://github.com/apache/airflow/pull/32014</a></li>
<li><a href="https://lists.apache.org/thread/vsflptk5dt30vrfggn96nx87d7zr6yvw">https://lists.apache.org/thread/vsflptk5dt30vrfggn96nx87d7zr6yvw</a></li>
</ul>
-<h3 id="credits-118">Credits</h3>
+<h3 id="credits-134">Credits</h3>
<ul>
<li>Name : Karthikeyan Singaravelan Employer : Visa (finder)</li>
</ul>
<h2 id="CVE-2023-35798">Airflow Apache ODBC and MSSQL Providers Arbitrary File Read Vulnerability</h2>
<p>CVE-2023-35798 <a href="https://cve.org/CVERecord?id=CVE-2023-35798">[CVE]</a> <a href="./CVE-2023-35798.cve.json">[CVE json]</a> <a href="./CVE-2023-35798.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-06-27T11:39:49.794Z</em></p>
-<h3 id="affected-121">Affected</h3>
+<h3 id="affected-137">Affected</h3>
<ul>
<li>Apache Airflow ODBC Provider before 4.0.0</li>
<li>Apache Airflow MSSQL Provider before 3.4.1</li>
</ul>
-<h3 id="description-121">Description</h3>
+<h3 id="description-137">Description</h3>
<p>Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.<p>This vulnerability is considered low since it requires DAG code to use <code><span style="background-color: rgb(255, 255, 255);">get_sqlalchemy_connection</code> and someone with access to connection resources specifically updating the connection to <span style="background-color: rgb(255, 255, 255);">exploit it.</span><b [...]
-<h3 id="references-121">References</h3>
+<h3 id="references-137">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/31984">https://github.com/apache/airflow/pull/31984</a></li>
<li><a href="https://lists.apache.org/thread/951rb9m7wwox5p30tdvcfjxq8j1mp4pj">https://lists.apache.org/thread/951rb9m7wwox5p30tdvcfjxq8j1mp4pj</a></li>
</ul>
-<h3 id="credits-119">Credits</h3>
+<h3 id="credits-135">Credits</h3>
<ul>
<li>id_No2015429 of 3H Secruity Team (finder)</li>
</ul>
<h2 id="CVE-2023-35797">Apache Airflow Hive Provider Beeline RCE with Principal</h2>
<p>CVE-2023-35797 <a href="https://cve.org/CVERecord?id=CVE-2023-35797">[CVE]</a> <a href="./CVE-2023-35797.cve.json">[CVE json]</a> <a href="./CVE-2023-35797.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-07-03T09:08:49.038Z</em></p>
-<h3 id="affected-122">Affected</h3>
+<h3 id="affected-138">Affected</h3>
<ul>
<li>Apache Airflow Apache Hive Provider before 6.1.1</li>
</ul>
-<h3 id="description-122">Description</h3>
+<h3 id="description-138">Description</h3>
<p>Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider.<br><p>This issue affects Apache Airflow Apache Hive Provider: before 6.1.1.<br><br><span style="background-color: rgb(255, 255, 255);">Before version 6.1.1 it was </span><span style="background-color: rgb(255, 255, 255);">possible to bypass the security check to RCE via</span><br><span style="background-color: rgb(255, 255, 255);">principal parameter. For this to be <span style="backgro [...]
-<h3 id="references-122">References</h3>
+<h3 id="references-138">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/31983">https://github.com/apache/airflow/pull/31983</a></li>
<li><a href="https://lists.apache.org/thread/30y19ok07fw52x5hnkbhwqo3ho0wwc1y">https://lists.apache.org/thread/30y19ok07fw52x5hnkbhwqo3ho0wwc1y</a></li>
</ul>
-<h3 id="credits-120">Credits</h3>
+<h3 id="credits-136">Credits</h3>
<ul>
<li>id_No2015429 of 3H Secruity Team (reporter)</li>
</ul>
<h2 id="CVE-2023-35005">Information disclosure on configuration view</h2>
<p>CVE-2023-35005 <a href="https://cve.org/CVERecord?id=CVE-2023-35005">[CVE]</a> <a href="./CVE-2023-35005.cve.json">[CVE json]</a> <a href="./CVE-2023-35005.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-06-19T08:15:11.464Z</em></p>
-<h3 id="affected-123">Affected</h3>
+<h3 id="affected-139">Affected</h3>
<ul>
<li>Apache Airflow from 2.5.0 before 2.6.2</li>
</ul>
-<h3 id="description-123">Description</h3>
+<h3 id="description-139">Description</h3>
<div>In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations.</div><div>This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all uncensored values are actually sentitive.</div><br><div>This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are recommended to update to version 2.6.2 or later.<br></div>
-<h3 id="references-123">References</h3>
+<h3 id="references-139">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/31788">https://github.com/apache/airflow/pull/31788</a></li>
<li><a href="https://github.com/apache/airflow/pull/31820">https://github.com/apache/airflow/pull/31820</a></li>
<li><a href="https://lists.apache.org/thread/o4f2cxh0054m9tlxpb81c1yhylor5gjd">https://lists.apache.org/thread/o4f2cxh0054m9tlxpb81c1yhylor5gjd</a></li>
</ul>
-<h3 id="credits-121">Credits</h3>
+<h3 id="credits-137">Credits</h3>
<ul>
<li>Piotr Chomiak from Astro product security team (finder)</li>
</ul>
<h2 id="CVE-2023-34395">Remote code execution vulnerability</h2>
<p>CVE-2023-34395 <a href="https://cve.org/CVERecord?id=CVE-2023-34395">[CVE]</a> <a href="./CVE-2023-34395.cve.json">[CVE json]</a> <a href="./CVE-2023-34395.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-06-27T11:36:51.331Z</em></p>
-<h3 id="affected-124">Affected</h3>
+<h3 id="affected-140">Affected</h3>
<ul>
<li>Apache Airflow ODBC Provider before 4.0.0</li>
</ul>
-<h3 id="description-124">Description</h3>
+<h3 id="description-140">Description</h3>
<p>Improper Neutralization of Argument Delimiters in a Command (‘Argument Injection’) vulnerability in Apache Software Foundation Apache Airflow ODBC Provider.<br><span style="background-color: rgb(255, 255, 255);">In OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution.<br></span>Starting version 4.0.0 driver can be set only from [...]
-<h3 id="references-124">References</h3>
+<h3 id="references-140">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/31713">https://github.com/apache/airflow/pull/31713</a></li>
<li><a href="https://lists.apache.org/thread/l26yykftzbhc9tgcph8cso88bc2lqwwd">https://lists.apache.org/thread/l26yykftzbhc9tgcph8cso88bc2lqwwd</a></li>
</ul>
-<h3 id="credits-122">Credits</h3>
+<h3 id="credits-138">Credits</h3>
<ul>
<li>KmhlYXJ0 (finder)</li>
</ul>
<h2 id="CVE-2023-33234">KubernetesPodOperator RCE via connection configuration</h2>
<p>CVE-2023-33234 <a href="https://cve.org/CVERecord?id=CVE-2023-33234">[CVE]</a> <a href="./CVE-2023-33234.cve.json">[CVE json]</a> <a href="./CVE-2023-33234.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-05-30T10:56:52.167Z</em></p>
-<h3 id="affected-125">Affected</h3>
+<h3 id="affected-141">Affected</h3>
<ul>
<li>Apache Airflow CNCF Kubernetes Provider from 5.0.0 through 6.1.0</li>
</ul>
-<h3 id="description-125">Description</h3>
+<h3 id="description-141">Description</h3>
<p>Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection.<br><br>In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner. Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.<br><br></p>
-<h3 id="references-125">References</h3>
+<h3 id="references-141">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/n1vpgl6h2qsdm52o9m2tx1oo86tl4gnq">https://lists.apache.org/thread/n1vpgl6h2qsdm52o9m2tx1oo86tl4gnq</a></li>
</ul>
<h2 id="CVE-2023-29247">Stored XSS on Apache Airflow</h2>
<p>CVE-2023-29247 <a href="https://cve.org/CVERecord?id=CVE-2023-29247">[CVE]</a> <a href="./CVE-2023-29247.cve.json">[CVE json]</a> <a href="./CVE-2023-29247.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-05-08T09:01:33.604Z</em></p>
-<h3 id="affected-126">Affected</h3>
+<h3 id="affected-142">Affected</h3>
<ul>
<li>Apache Airflow before 2.6.0</li>
</ul>
-<h3 id="description-126">Description</h3>
+<h3 id="description-142">Description</h3>
<p>Task instance details page in the UI is vulnerable to a stored XSS.<p>This issue affects Apache Airflow: before 2.6.0.</p><br></p>
-<h3 id="references-126">References</h3>
+<h3 id="references-142">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/30447">https://github.com/apache/airflow/pull/30447</a></li>
<li><a href="https://github.com/apache/airflow/pull/30779">https://github.com/apache/airflow/pull/30779</a></li>
<li><a href="https://lists.apache.org/thread/kqf5lxmko133780clsp827xfsh4xd3fl">https://lists.apache.org/thread/kqf5lxmko133780clsp827xfsh4xd3fl</a></li>
</ul>
-<h3 id="credits-123">Credits</h3>
+<h3 id="credits-139">Credits</h3>
<ul>
<li>taidh from VNPT - VCI (finder)</li>
<li>kuteminh11 (finder)</li>
@@ -2522,72 +2837,72 @@
<h2 id="CVE-2023-28710">Apache Airflow Spark Provider Arbitrary File Read via JDBC</h2>
<p>CVE-2023-28710 <a href="https://cve.org/CVERecord?id=CVE-2023-28710">[CVE]</a> <a href="./CVE-2023-28710.cve.json">[CVE json]</a> <a href="./CVE-2023-28710.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-04-07T14:55:42.112Z</em></p>
-<h3 id="affected-127">Affected</h3>
+<h3 id="affected-143">Affected</h3>
<ul>
<li>Apache Airflow Spark Provider before 4.0.1</li>
</ul>
-<h3 id="description-127">Description</h3>
+<h3 id="description-143">Description</h3>
<p>Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Spark Provider.<p>This issue affects Apache Airflow Spark Provider: before 4.0.1.</p></p>
-<h3 id="references-127">References</h3>
+<h3 id="references-143">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/30223">https://github.com/apache/airflow/pull/30223</a></li>
<li><a href="https://lists.apache.org/thread/lb9w9114ow00h2nkn8bjm106v5x1p1d2">https://lists.apache.org/thread/lb9w9114ow00h2nkn8bjm106v5x1p1d2</a></li>
</ul>
-<h3 id="credits-124">Credits</h3>
+<h3 id="credits-140">Credits</h3>
<ul>
<li>Xie Jianming of Nsfocus (finder)</li>
</ul>
<h2 id="CVE-2023-28707">Airflow Apache Drill Provider Arbitrary File Read Vulnerability</h2>
<p>CVE-2023-28707 <a href="https://cve.org/CVERecord?id=CVE-2023-28707">[CVE]</a> <a href="./CVE-2023-28707.cve.json">[CVE json]</a> <a href="./CVE-2023-28707.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-04-07T14:53:21.428Z</em></p>
-<h3 id="affected-128">Affected</h3>
+<h3 id="affected-144">Affected</h3>
<ul>
<li>Apache Airflow Drill Provider before 2.3.2</li>
</ul>
-<h3 id="description-128">Description</h3>
+<h3 id="description-144">Description</h3>
<p>Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.<p>This issue affects Apache Airflow Drill Provider: before 2.3.2.</p></p>
-<h3 id="references-128">References</h3>
+<h3 id="references-144">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/30215">https://github.com/apache/airflow/pull/30215</a></li>
<li><a href="https://lists.apache.org/thread/dfoj7q1nd0vhhsl8fjg63z4j6mfmdxtk">https://lists.apache.org/thread/dfoj7q1nd0vhhsl8fjg63z4j6mfmdxtk</a></li>
</ul>
-<h3 id="credits-125">Credits</h3>
+<h3 id="credits-141">Credits</h3>
<ul>
<li>Kai Zhao of 3H Secruity Team (finder)</li>
</ul>
<h2 id="CVE-2023-28706">Apache Airflow Hive Provider Beeline Remote Command Execution</h2>
<p>CVE-2023-28706 <a href="https://cve.org/CVERecord?id=CVE-2023-28706">[CVE]</a> <a href="./CVE-2023-28706.cve.json">[CVE json]</a> <a href="./CVE-2023-28706.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-04-07T14:54:35.049Z</em></p>
-<h3 id="affected-129">Affected</h3>
+<h3 id="affected-145">Affected</h3>
<ul>
<li>Apache Airflow Hive Provider before 6.0.0</li>
</ul>
-<h3 id="description-129">Description</h3>
+<h3 id="description-145">Description</h3>
<p>Improper Control of Generation of Code (‘Code Injection’) vulnerability in Apache Software Foundation Apache Airflow Hive Provider.<p>This issue affects Apache Airflow Hive Provider: before 6.0.0.</p></p>
-<h3 id="references-129">References</h3>
+<h3 id="references-145">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/30212">https://github.com/apache/airflow/pull/30212</a></li>
<li><a href="https://lists.apache.org/thread/dl20xxd51xvlx0zzc0wzgxfjwgtbbxo3">https://lists.apache.org/thread/dl20xxd51xvlx0zzc0wzgxfjwgtbbxo3</a></li>
</ul>
-<h3 id="credits-126">Credits</h3>
+<h3 id="credits-142">Credits</h3>
<ul>
<li>sw0rd1ight of Caiji Sec Team and 4ra1n of Chaitin Tech (finder)</li>
</ul>
<h2 id="CVE-2023-27604">Airflow Sqoop Provider RCE Vulnerability</h2>
<p>CVE-2023-27604 <a href="https://cve.org/CVERecord?id=CVE-2023-27604">[CVE]</a> <a href="./CVE-2023-27604.cve.json">[CVE json]</a> <a href="./CVE-2023-27604.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-08-28T07:47:27.394Z</em></p>
-<h3 id="affected-130">Affected</h3>
+<h3 id="affected-146">Affected</h3>
<ul>
<li>Apache Airflow Sqoop Provider before 4.0.0</li>
</ul>
-<h3 id="description-130">Description</h3>
+<h3 id="description-146">Description</h3>
<p>Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the connections, which makes it possible to implement RCE attacks via ‘sqoop import –connect’, obtain airflow server permissions, etc. T<span style="background-color: rgb(255, 255, 255);">he attacker needs to be logged in and have authorization (permissions) to create/edit connections.<br></span><br> It is recommended to upgrade to a version that is n [...]
-<h3 id="references-130">References</h3>
+<h3 id="references-146">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33039">https://github.com/apache/airflow/pull/33039</a></li>
<li><a href="https://lists.apache.org/thread/lswlxf11do51ob7f6xyyg8qp3n7wdrgd">https://lists.apache.org/thread/lswlxf11do51ob7f6xyyg8qp3n7wdrgd</a></li>
</ul>
-<h3 id="credits-127">Credits</h3>
+<h3 id="credits-143">Credits</h3>
<ul>
<li>happyhacking-k (finder)</li>
<li>Xie Jianming of Caiji Sec Team (finder)</li>
@@ -2596,18 +2911,18 @@
<h2 id="CVE-2023-25956">Arbitrary file read via AWS provider</h2>
<p>CVE-2023-25956 <a href="https://cve.org/CVERecord?id=CVE-2023-25956">[CVE]</a> <a href="./CVE-2023-25956.cve.json">[CVE json]</a> <a href="./CVE-2023-25956.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-03-07T08:23:39.736Z</em></p>
-<h3 id="affected-131">Affected</h3>
+<h3 id="affected-147">Affected</h3>
<ul>
<li>Apache Airflow AWS Provider before 7.2.1</li>
</ul>
-<h3 id="description-131">Description</h3>
+<h3 id="description-147">Description</h3>
<p>Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider.<br><br><p>This issue affects Apache Airflow AWS Provider versions before 7.2.1.</p></p>
-<h3 id="references-131">References</h3>
+<h3 id="references-147">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29587">https://github.com/apache/airflow/pull/29587</a></li>
<li><a href="https://lists.apache.org/thread/07pl9y4gdpw2c6rzqm77dvkm2z2kb5gv">https://lists.apache.org/thread/07pl9y4gdpw2c6rzqm77dvkm2z2kb5gv</a></li>
</ul>
-<h3 id="credits-128">Credits</h3>
+<h3 id="credits-144">Credits</h3>
<ul>
<li>Son Tran from VNPT - VCI (finder)</li>
<li>kuteminh11 (finder)</li>
@@ -2615,144 +2930,144 @@
<h2 id="CVE-2023-25754">Privilege escalation using airflow logs</h2>
<p>CVE-2023-25754 <a href="https://cve.org/CVERecord?id=CVE-2023-25754">[CVE]</a> <a href="./CVE-2023-25754.cve.json">[CVE json]</a> <a href="./CVE-2023-25754.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-05-08T11:57:41.997Z</em></p>
-<h3 id="affected-132">Affected</h3>
+<h3 id="affected-148">Affected</h3>
<ul>
<li>Apache Airflow before 2.6.0</li>
</ul>
-<h3 id="description-132">Description</h3>
+<h3 id="description-148">Description</h3>
<p>Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.<p>This issue affects Apache Airflow: before 2.6.0.</p></p>
-<h3 id="references-132">References</h3>
+<h3 id="references-148">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29506">https://github.com/apache/airflow/pull/29506</a></li>
<li><a href="https://lists.apache.org/thread/3y83gr0qb8t49ppfk4fb2yk7md8ltq4v">https://lists.apache.org/thread/3y83gr0qb8t49ppfk4fb2yk7md8ltq4v</a></li>
</ul>
-<h3 id="credits-129">Credits</h3>
+<h3 id="credits-145">Credits</h3>
<ul>
<li><a href="mailto:ksw9722@naver.com">ksw9722@naver.com</a> (finder)</li>
</ul>
<h2 id="CVE-2023-25696">Apache Airflow Hive Provider Beeline RCE</h2>
<p>CVE-2023-25696 <a href="https://cve.org/CVERecord?id=CVE-2023-25696">[CVE]</a> <a href="./CVE-2023-25696.cve.json">[CVE json]</a> <a href="./CVE-2023-25696.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-02-24T11:48:19.499Z</em></p>
-<h3 id="affected-133">Affected</h3>
+<h3 id="affected-149">Affected</h3>
<ul>
<li>Apache Airflow Hive Provider before 5.1.3</li>
</ul>
-<h3 id="description-133">Description</h3>
+<h3 id="description-149">Description</h3>
<p>Improper Input Validation vulnerability in the Apache Airflow Hive Provider.<br><br><p>This issue affects Apache Airflow Hive Provider versions before 5.1.3.</p></p>
-<h3 id="references-133">References</h3>
+<h3 id="references-149">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29502">https://github.com/apache/airflow/pull/29502</a></li>
<li><a href="https://lists.apache.org/thread/99g0qm56wmgdxmbtdsvhj4rdnxhpzpml">https://lists.apache.org/thread/99g0qm56wmgdxmbtdsvhj4rdnxhpzpml</a></li>
</ul>
-<h3 id="credits-130">Credits</h3>
+<h3 id="credits-146">Credits</h3>
<ul>
<li>id_No2015429 of 3H Secruity Team (finder)</li>
</ul>
<h2 id="CVE-2023-25695">Information disclosure in Apache Airflow</h2>
<p>CVE-2023-25695 <a href="https://cve.org/CVERecord?id=CVE-2023-25695">[CVE]</a> <a href="./CVE-2023-25695.cve.json">[CVE json]</a> <a href="./CVE-2023-25695.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-03-15T09:37:07.873Z</em></p>
-<h3 id="affected-134">Affected</h3>
+<h3 id="affected-150">Affected</h3>
<ul>
<li>Apache Airflow before 2.5.2</li>
</ul>
-<h3 id="description-134">Description</h3>
+<h3 id="description-150">Description</h3>
<p>Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.<p>This issue affects Apache Airflow: before 2.5.2.</p></p>
-<h3 id="references-134">References</h3>
+<h3 id="references-150">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29501">https://github.com/apache/airflow/pull/29501</a></li>
<li><a href="https://lists.apache.org/thread/z8w6ckzs61ql365tv4d19k82o67r15p2">https://lists.apache.org/thread/z8w6ckzs61ql365tv4d19k82o67r15p2</a></li>
</ul>
-<h3 id="credits-131">Credits</h3>
+<h3 id="credits-147">Credits</h3>
<ul>
<li>kuteminh11 (finder)</li>
</ul>
<h2 id="CVE-2023-25693">Sqoop Apache Airflow Provider Remote Code Execution Vulnerability</h2>
<p>CVE-2023-25693 <a href="https://cve.org/CVERecord?id=CVE-2023-25693">[CVE]</a> <a href="./CVE-2023-25693.cve.json">[CVE json]</a> <a href="./CVE-2023-25693.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-02-24T11:48:09.839Z</em></p>
-<h3 id="affected-135">Affected</h3>
+<h3 id="affected-151">Affected</h3>
<ul>
<li>Apache Airflow Sqoop Provider before 3.1.1</li>
</ul>
-<h3 id="description-135">Description</h3>
+<h3 id="description-151">Description</h3>
<p>Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider.<br><br><p>This issue affects Apache Airflow Sqoop Provider versions before 3.1.1.</p></p>
-<h3 id="references-135">References</h3>
+<h3 id="references-151">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29500">https://github.com/apache/airflow/pull/29500</a></li>
<li><a href="https://lists.apache.org/thread/79qn8g5xbq036f8crb115obvr22l52q4">https://lists.apache.org/thread/79qn8g5xbq036f8crb115obvr22l52q4</a></li>
</ul>
-<h3 id="credits-132">Credits</h3>
+<h3 id="credits-148">Credits</h3>
<ul>
<li>L3yx of Syclover Security Team (finder)</li>
</ul>
<h2 id="CVE-2023-25692">Google Cloud Sql Provider Denial Of Service</h2>
<p>CVE-2023-25692 <a href="https://cve.org/CVERecord?id=CVE-2023-25692">[CVE]</a> <a href="./CVE-2023-25692.cve.json">[CVE json]</a> <a href="./CVE-2023-25692.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-02-24T11:47:58.411Z</em></p>
-<h3 id="affected-136">Affected</h3>
+<h3 id="affected-152">Affected</h3>
<ul>
<li>Apache Airflow Google Provider before 8.10.0</li>
</ul>
-<h3 id="description-136">Description</h3>
+<h3 id="description-152">Description</h3>
<p>Improper Input Validation vulnerability in the Apache Airflow Google Provider.<br><br><p>This issue affects Apache Airflow Google Provider versions before 8.10.0.</p></p>
-<h3 id="references-136">References</h3>
+<h3 id="references-152">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29499">https://github.com/apache/airflow/pull/29499</a></li>
<li><a href="https://lists.apache.org/thread/ks4l78l5rwdpmvfn7y7yhs179nyxtlsh">https://lists.apache.org/thread/ks4l78l5rwdpmvfn7y7yhs179nyxtlsh</a></li>
</ul>
-<h3 id="credits-133">Credits</h3>
+<h3 id="credits-149">Credits</h3>
<ul>
<li>Xie Jianming of Caiji Sec Team (finder)</li>
</ul>
<h2 id="CVE-2023-25691">Google Cloud Sql Provider Remote Command Execution</h2>
<p>CVE-2023-25691 <a href="https://cve.org/CVERecord?id=CVE-2023-25691">[CVE]</a> <a href="./CVE-2023-25691.cve.json">[CVE json]</a> <a href="./CVE-2023-25691.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-02-24T11:35:47.925Z</em></p>
-<h3 id="affected-137">Affected</h3>
+<h3 id="affected-153">Affected</h3>
<ul>
<li>Apache Airflow Google Provider before 8.10.0</li>
</ul>
-<h3 id="description-137">Description</h3>
+<h3 id="description-153">Description</h3>
<p>Improper Input Validation vulnerability in the Apache Airflow Google Provider.<br><br><p>This issue affects Apache Airflow Google Provider versions before 8.10.0.</p></p>
-<h3 id="references-137">References</h3>
+<h3 id="references-153">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29497">https://github.com/apache/airflow/pull/29497</a></li>
<li><a href="https://lists.apache.org/thread/zdr8ovfttbh7kj0lydgcw88tbt2nmkcy">https://lists.apache.org/thread/zdr8ovfttbh7kj0lydgcw88tbt2nmkcy</a></li>
</ul>
-<h3 id="credits-134">Credits</h3>
+<h3 id="credits-150">Credits</h3>
<ul>
<li>Xie Jianming of Caiji Sec Team (finder)</li>
</ul>
<h2 id="CVE-2023-22888">Scheduler remote DoS</h2>
<p>CVE-2023-22888 <a href="https://cve.org/CVERecord?id=CVE-2023-22888">[CVE]</a> <a href="./CVE-2023-22888.cve.json">[CVE json]</a> <a href="./CVE-2023-22888.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-07-12T09:17:51.316Z</em></p>
-<h3 id="affected-138">Affected</h3>
+<h3 id="affected-154">Affected</h3>
<ul>
<li>Apache Airflow before 2.6.3</li>
</ul>
-<h3 id="description-138">Description</h3>
+<h3 id="description-154">Description</h3>
<p>Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to cause a service disruption by manipulating the run_id parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected</p>
-<h3 id="references-138">References</h3>
+<h3 id="references-154">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/32293">https://github.com/apache/airflow/pull/32293</a></li>
<li><a href="https://lists.apache.org/thread/dnlht2hvm7k81k5tgjtsfmk27c76kq7z">https://lists.apache.org/thread/dnlht2hvm7k81k5tgjtsfmk27c76kq7z</a></li>
</ul>
-<h3 id="credits-135">Credits</h3>
+<h3 id="credits-151">Credits</h3>
<ul>
<li>Zhipeng Zhang (@timon8) (finder)</li>
</ul>
<h2 id="CVE-2023-22887">Apache Airflow path traversal by authenticated user</h2>
<p>CVE-2023-22887 <a href="https://cve.org/CVERecord?id=CVE-2023-22887">[CVE]</a> <a href="./CVE-2023-22887.cve.json">[CVE json]</a> <a href="./CVE-2023-22887.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-07-13T10:31:08.518Z</em></p>
-<h3 id="affected-139">Affected</h3>
+<h3 id="affected-155">Affected</h3>
<ul>
<li>Apache Airflow before 2.6.3</li>
</ul>
-<h3 id="description-139">Description</h3>
+<h3 id="description-155">Description</h3>
<p>Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended directory structure by manipulating the run_id parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected</p>
-<h3 id="references-139">References</h3>
+<h3 id="references-155">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/32293">https://github.com/apache/airflow/pull/32293</a></li>
<li><a href="https://lists.apache.org/thread/rxddqs76r6rkxsg1n24d029zys67qwwo">https://lists.apache.org/thread/rxddqs76r6rkxsg1n24d029zys67qwwo</a></li>
</ul>
-<h3 id="credits-136">Credits</h3>
+<h3 id="credits-152">Credits</h3>
<ul>
<li>Zhipeng Zhang (@Timon8) (finder)</li>
<li>KietNA from National Cyber Security (NCS) (finder)</li>
@@ -2760,17 +3075,17 @@
<h2 id="CVE-2023-22886">RCE Vulnerability</h2>
<p>CVE-2023-22886 <a href="https://cve.org/CVERecord?id=CVE-2023-22886">[CVE]</a> <a href="./CVE-2023-22886.cve.json">[CVE json]</a> <a href="./CVE-2023-22886.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-06-29T09:40:58.058Z</em></p>
-<h3 id="affected-140">Affected</h3>
+<h3 id="affected-156">Affected</h3>
<ul>
<li>Apache Airflow JDBC Provider before 4.0.0</li>
</ul>
-<h3 id="description-140">Description</h3>
+<h3 id="description-156">Description</h3>
<p>Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider.<br><span style="background-color: rgb(255, 255, 255);">Airflow JDBC Provider Connection’s [Connection URL] parameters had no</span><br><span style="background-color: rgb(255, 255, 255);">restrictions, which made it possible to implement RCE attacks via</span><br><span style="background-color: rgb(255, 255, 255);">different type JDBC drivers, obtain airflow server permission.</span><br>< [...]
-<h3 id="references-140">References</h3>
+<h3 id="references-156">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/ynbjwp4n0vzql0xzhog1gkp1ovncf8j3">https://lists.apache.org/thread/ynbjwp4n0vzql0xzhog1gkp1ovncf8j3</a></li>
</ul>
-<h3 id="credits-137">Credits</h3>
+<h3 id="credits-153">Credits</h3>
<ul>
<li>heart Y (finder)</li>
<li>happyhacking (finder)</li>
@@ -2778,32 +3093,32 @@
<h2 id="CVE-2023-22884">Arbitrary file read via MySQL provider in Apache Airflow</h2>
<p>CVE-2023-22884 <a href="https://cve.org/CVERecord?id=CVE-2023-22884">[CVE]</a> <a href="./CVE-2023-22884.cve.json">[CVE json]</a> <a href="./CVE-2023-22884.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-01-21T13:02:09.736Z</em></p>
-<h3 id="affected-141">Affected</h3>
+<h3 id="affected-157">Affected</h3>
<ul>
<li>Apache Airflow before 2.5.1</li>
<li>Apache Airflow MySQL Provider before 4.0.0</li>
</ul>
-<h3 id="description-141">Description</h3>
+<h3 id="description-157">Description</h3>
<p>Improper Neutralization of Special Elements used in a Command (‘Command Injection’) vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.<p>This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL Provider: before 4.0.0.</p></p>
-<h3 id="references-141">References</h3>
+<h3 id="references-157">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/28811">https://github.com/apache/airflow/pull/28811</a></li>
<li><a href="https://lists.apache.org/thread/0l0j3nt0t7fzrcjl2ch0jgj6c58kxs5h">https://lists.apache.org/thread/0l0j3nt0t7fzrcjl2ch0jgj6c58kxs5h</a></li>
</ul>
-<h3 id="credits-138">Credits</h3>
+<h3 id="credits-154">Credits</h3>
<ul>
<li>Son Tran from VNPT - VCI (reporter)</li>
</ul>
<h2 id="CVE-2022-46651">Security vulnerability on AirFlow Connections</h2>
<p>CVE-2022-46651 <a href="https://cve.org/CVERecord?id=CVE-2022-46651">[CVE]</a> <a href="./CVE-2022-46651.cve.json">[CVE json]</a> <a href="./CVE-2022-46651.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-07-12T09:16:59.771Z</em></p>
-<h3 id="affected-142">Affected</h3>
+<h3 id="affected-158">Affected</h3>
<ul>
<li>Apache Airflow before 2.6.3</li>
</ul>
-<h3 id="description-142">Description</h3>
+<h3 id="description-158">Description</h3>
<p>Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability.<br></p>
-<h3 id="references-142">References</h3>
+<h3 id="references-158">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/32309">https://github.com/apache/airflow/pull/32309</a></li>
<li><a href="https://lists.apache.org/thread/n45h3y82og125rnlgt6rbm9szfb6q24d">https://lists.apache.org/thread/n45h3y82og125rnlgt6rbm9szfb6q24d</a></li>
@@ -2811,271 +3126,271 @@
<h2 id="CVE-2022-46421">Hive Provider RCE vulnerability with hive_cli_params</h2>
<p>CVE-2022-46421 <a href="https://cve.org/CVERecord?id=CVE-2022-46421">[CVE]</a> <a href="./CVE-2022-46421.cve.json">[CVE json]</a> <a href="./CVE-2022-46421.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-12-20T10:18:24.768Z</em></p>
-<h3 id="affected-143">Affected</h3>
+<h3 id="affected-159">Affected</h3>
<ul>
<li>Apache Airflow Hive Provider before 5.0.0</li>
</ul>
-<h3 id="description-143">Description</h3>
+<h3 id="description-159">Description</h3>
<p>Improper Neutralization of Special Elements used in a Command (‘Command Injection’) vulnerability in Apache Software Foundation Apache Airflow Hive Provider.<p>This issue affects Apache Airflow Hive Provider: before 5.0.0.</p></p>
-<h3 id="references-143">References</h3>
+<h3 id="references-159">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/28101">https://github.com/apache/airflow/pull/28101</a></li>
<li><a href="https://lists.apache.org/thread/09twdoyoybldlfj5gvk0qswtofh0rmp4">https://lists.apache.org/thread/09twdoyoybldlfj5gvk0qswtofh0rmp4</a></li>
</ul>
-<h3 id="credits-139">Credits</h3>
+<h3 id="credits-155">Credits</h3>
<ul>
<li>id_No2015429 of 3H Security Team (finder)</li>
</ul>
<h2 id="CVE-2022-45402">Apache Airflow: Open redirect during login</h2>
<p>CVE-2022-45402 <a href="https://cve.org/CVERecord?id=CVE-2022-45402">[CVE]</a> <a href="./CVE-2022-45402.cve.json">[CVE json]</a> <a href="./CVE-2022-45402.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-15T08:49:17.848Z</em></p>
-<h3 id="affected-144">Affected</h3>
+<h3 id="affected-160">Affected</h3>
<ul>
<li>Apache Airflow from unspecified before 2.4.3</li>
</ul>
-<h3 id="description-144">Description</h3>
+<h3 id="description-160">Description</h3>
<p>In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver’s <code>/login</code> endpoint.</p>
-<h3 id="references-144">References</h3>
+<h3 id="references-160">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/27576">https://github.com/apache/airflow/pull/27576</a></li>
<li><a href="https://lists.apache.org/thread/nf4xrkoo6c81g6fdn4vj8k9x2686o9nh">https://lists.apache.org/thread/nf4xrkoo6c81g6fdn4vj8k9x2686o9nh</a></li>
</ul>
-<h3 id="credits-140">Credits</h3>
+<h3 id="credits-156">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank Bugra Eskici for reporting this issue.</li>
</ul>
<h2 id="CVE-2022-43985">Apache Airflow prior to 2.4.2 has an open redirect</h2>
<p>CVE-2022-43985 <a href="https://cve.org/CVERecord?id=CVE-2022-43985">[CVE]</a> <a href="./CVE-2022-43985.cve.json">[CVE json]</a> <a href="./CVE-2022-43985.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-02T08:40:14.097Z</em></p>
-<h3 id="affected-145">Affected</h3>
+<h3 id="affected-161">Affected</h3>
<ul>
<li>Apache Airflow from unspecified before 2.4.2</li>
</ul>
-<h3 id="description-145">Description</h3>
+<h3 id="description-161">Description</h3>
<p>In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver’s <code>/confirm</code> endpoint.</p>
-<h3 id="references-145">References</h3>
+<h3 id="references-161">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/27143">https://github.com/apache/airflow/pull/27143</a></li>
<li><a href="https://lists.apache.org/thread/m13y9s5kw92fw9l8j4qd85h0txp4kfcq">https://lists.apache.org/thread/m13y9s5kw92fw9l8j4qd85h0txp4kfcq</a></li>
</ul>
-<h3 id="credits-141">Credits</h3>
+<h3 id="credits-157">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank Axel Chong (@Haxatron) [https://hackerone.com/haxatron1] for reporting this issue.</li>
</ul>
<h2 id="CVE-2022-43982">Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL</h2>
<p>CVE-2022-43982 <a href="https://cve.org/CVERecord?id=CVE-2022-43982">[CVE]</a> <a href="./CVE-2022-43982.cve.json">[CVE json]</a> <a href="./CVE-2022-43982.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-02T08:37:19.773Z</em></p>
-<h3 id="affected-146">Affected</h3>
+<h3 id="affected-162">Affected</h3>
<ul>
<li>Apache Airflow from unspecified before 2.4.2</li>
</ul>
-<h3 id="description-146">Description</h3>
+<h3 id="description-162">Description</h3>
<p>In Apache Airflow versions prior to 2.4.2, the “Trigger DAG with config” screen was susceptible to XSS attacks via the <code>origin</code> query argument.</p>
-<h3 id="references-146">References</h3>
+<h3 id="references-162">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/27143">https://github.com/apache/airflow/pull/27143</a></li>
<li><a href="https://lists.apache.org/thread/vqnvdrfsw9z7v7c46qh3psjgr7wy959l">https://lists.apache.org/thread/vqnvdrfsw9z7v7c46qh3psjgr7wy959l</a></li>
</ul>
-<h3 id="credits-142">Credits</h3>
+<h3 id="credits-158">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank id_No2015429 of 3H Security Team for reporting this issue.</li>
</ul>
<h2 id="CVE-2022-41672">Session still functional after user is deactivated</h2>
<p>CVE-2022-41672 <a href="https://cve.org/CVERecord?id=CVE-2022-41672">[CVE]</a> <a href="./CVE-2022-41672.cve.json">[CVE json]</a> <a href="./CVE-2022-41672.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-10-07T06:56:43.156Z</em></p>
-<h3 id="affected-147">Affected</h3>
+<h3 id="affected-163">Affected</h3>
<ul>
<li>Apache Airflow from unspecified through 2.4.0</li>
</ul>
-<h3 id="description-147">Description</h3>
+<h3 id="description-163">Description</h3>
<p>In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn’t prevent an already authenticated user from being able to continue using the UI or API.</p>
-<h3 id="references-147">References</h3>
+<h3 id="references-163">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/26635">https://github.com/apache/airflow/pull/26635</a></li>
<li><a href="https://lists.apache.org/thread/ohf3pvd3dftb8zb01yngbn1jtkq5m08y">https://lists.apache.org/thread/ohf3pvd3dftb8zb01yngbn1jtkq5m08y</a></li>
</ul>
-<h3 id="credits-143">Credits</h3>
+<h3 id="credits-159">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank Axel Chong (@Haxatron) for reporting this issue.</li>
</ul>
<h2 id="CVE-2022-41131">Apache Airflow Hive Provider vulnerability (command injection via hive_cli connection)</h2>
<p>CVE-2022-41131 <a href="https://cve.org/CVERecord?id=CVE-2022-41131">[CVE]</a> <a href="./CVE-2022-41131.cve.json">[CVE json]</a> <a href="./CVE-2022-41131.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-22T09:38:16.454Z</em></p>
-<h3 id="affected-148">Affected</h3>
+<h3 id="affected-164">Affected</h3>
<ul>
<li>Apache Airflow Hive Provider from unspecified before 4.1.0</li>
<li>Apache Airflow at 2.3.0</li>
</ul>
-<h3 id="description-148">Description</h3>
+<h3 id="description-164">Description</h3>
<p>Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG files. This issue affects Hive Provider versions prior to 4.1.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case HIve Provider is installed (Hive Provider 4.1.0 can only be installed for Airflow 2.3 [...]
-<h3 id="references-148">References</h3>
+<h3 id="references-164">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/27647">https://github.com/apache/airflow/pull/27647</a></li>
<li><a href="https://lists.apache.org/thread/wwo3qp0z8gv54yzn7hr04wy4n8gb0vhl">https://lists.apache.org/thread/wwo3qp0z8gv54yzn7hr04wy4n8gb0vhl</a></li>
</ul>
-<h3 id="credits-144">Credits</h3>
+<h3 id="credits-160">Credits</h3>
<ul>
<li>Apache Airflow PMC wants to thank id_No2015429 of 3H Security Team for reporting the issue.</li>
</ul>
<h2 id="CVE-2022-40954">Apache Airflow Spark Provider RCE that bypass restrictions to read arbitrary files</h2>
<p>CVE-2022-40954 <a href="https://cve.org/CVERecord?id=CVE-2022-40954">[CVE]</a> <a href="./CVE-2022-40954.cve.json">[CVE json]</a> <a href="./CVE-2022-40954.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-22T09:40:32.614Z</em></p>
-<h3 id="affected-149">Affected</h3>
+<h3 id="affected-165">Affected</h3>
<ul>
<li>Apache Airflow Spark Provider from unspecified before 4.0.0</li>
<li>Apache Airflow from unspecified before 2.3.0</li>
</ul>
-<h3 id="description-149">Description</h3>
+<h3 id="description-165">Description</h3>
<p>Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Spark Provider is installed (Spark Provider 4.0.0 can only be installed for Airflow 2.3.0 [...]
-<h3 id="references-149">References</h3>
+<h3 id="references-165">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/27646">https://github.com/apache/airflow/pull/27646</a></li>
<li><a href="https://lists.apache.org/thread/0tmdlnmjs5t4gsx5fy73tb6zd3jztq45">https://lists.apache.org/thread/0tmdlnmjs5t4gsx5fy73tb6zd3jztq45</a></li>
</ul>
-<h3 id="credits-145">Credits</h3>
+<h3 id="credits-161">Credits</h3>
<ul>
<li>Apache Airflow PMC wants to thank id_No2015429 of 3H Security Team for reporting the issue.</li>
</ul>
<h2 id="CVE-2022-40754">Open Redirect</h2>
<p>CVE-2022-40754 <a href="https://cve.org/CVERecord?id=CVE-2022-40754">[CVE]</a> <a href="./CVE-2022-40754.cve.json">[CVE json]</a> <a href="./CVE-2022-40754.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-09-21T07:22:31.671Z</em></p>
-<h3 id="affected-150">Affected</h3>
+<h3 id="affected-166">Affected</h3>
<ul>
<li>Apache Airflow from unspecified before 2.4.0</li>
</ul>
-<h3 id="description-150">Description</h3>
+<h3 id="description-166">Description</h3>
<p>In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver’s <code>/confirm</code> endpoint.</p>
-<h3 id="references-150">References</h3>
+<h3 id="references-166">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/26409">https://github.com/apache/airflow/pull/26409</a></li>
<li><a href="https://lists.apache.org/thread/cn098dcp5x3c402xrb06p3l7nz5goffm">https://lists.apache.org/thread/cn098dcp5x3c402xrb06p3l7nz5goffm</a></li>
</ul>
-<h3 id="credits-146">Credits</h3>
+<h3 id="credits-162">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank Konstantin Weddige (Lutra Security) for reporting this issue.</li>
</ul>
<h2 id="CVE-2022-40604">Format String Vulnerability</h2>
<p>CVE-2022-40604 <a href="https://cve.org/CVERecord?id=CVE-2022-40604">[CVE]</a> <a href="./CVE-2022-40604.cve.json">[CVE json]</a> <a href="./CVE-2022-40604.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-09-21T07:22:50.780Z</em></p>
-<h3 id="affected-151">Affected</h3>
+<h3 id="affected-167">Affected</h3>
<ul>
<li>Apache Airflow from unspecified before 2.4.0</li>
</ul>
-<h3 id="description-151">Description</h3>
+<h3 id="description-167">Description</h3>
<p>In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction.</p>
-<h3 id="references-151">References</h3>
+<h3 id="references-167">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/26337">https://github.com/apache/airflow/pull/26337</a></li>
<li><a href="https://lists.apache.org/thread/z20x8m16fnhxdkoollv53w1ybsts687t">https://lists.apache.org/thread/z20x8m16fnhxdkoollv53w1ybsts687t</a></li>
</ul>
-<h3 id="credits-147">Credits</h3>
+<h3 id="credits-163">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank L3yx of Syclover Security Team for reporting this issue.</li>
</ul>
<h2 id="CVE-2022-40189">Apache Airlfow Pig Provider RCE</h2>
<p>CVE-2022-40189 <a href="https://cve.org/CVERecord?id=CVE-2022-40189">[CVE]</a> <a href="./CVE-2022-40189.cve.json">[CVE json]</a> <a href="./CVE-2022-40189.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-22T09:39:35.331Z</em></p>
-<h3 id="affected-152">Affected</h3>
+<h3 id="affected-168">Affected</h3>
<ul>
<li>Apache Airlfow Pig Provider from unspecified before 4.0.0</li>
<li>Apache Airflow from unspecified before 2.3.0</li>
</ul>
-<h3 id="description-152">Description</h3>
+<h3 id="description-168">Description</h3>
<p>Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Pig Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Pig Provider is installed (Pig Provider 4.0.0 can only be installed for Airflow 2.3.0+) [...]
-<h3 id="references-152">References</h3>
+<h3 id="references-168">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/27644">https://github.com/apache/airflow/pull/27644</a></li>
<li><a href="https://lists.apache.org/thread/yxnfzfw2w9pj5s785k3rlyly4y44sd15">https://lists.apache.org/thread/yxnfzfw2w9pj5s785k3rlyly4y44sd15</a></li>
</ul>
-<h3 id="credits-148">Credits</h3>
+<h3 id="credits-164">Credits</h3>
<ul>
<li>Apache Airflow PMC wants to thank id_No2015429 of 3H Security Team for reporting the issue.</li>
</ul>
<h2 id="CVE-2022-40127">Apache Airflow <2.4.0 has an RCE in a bash example</h2>
<p>CVE-2022-40127 <a href="https://cve.org/CVERecord?id=CVE-2022-40127">[CVE]</a> <a href="./CVE-2022-40127.cve.json">[CVE json]</a> <a href="./CVE-2022-40127.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-14T09:30:08.330Z</em></p>
-<h3 id="affected-153">Affected</h3>
+<h3 id="affected-169">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow before 2.4.0</li>
</ul>
-<h3 id="description-153">Description</h3>
+<h3 id="description-169">Description</h3>
<p>A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.</p>
-<h3 id="references-153">References</h3>
+<h3 id="references-169">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/25960">https://github.com/apache/airflow/pull/25960</a></li>
<li><a href="https://lists.apache.org/thread/cf132hgm6jvzvsbpsozl3plf1r4cwysy">https://lists.apache.org/thread/cf132hgm6jvzvsbpsozl3plf1r4cwysy</a></li>
</ul>
-<h3 id="credits-149">Credits</h3>
+<h3 id="credits-165">Credits</h3>
<ul>
<li>Apache Airflow PMC would like to thank L3yx of Syclover Security Team.</li>
</ul>
<h2 id="CVE-2022-38649">Apache Airflow Pinot provider allowed Command Injection</h2>
<p>CVE-2022-38649 <a href="https://cve.org/CVERecord?id=CVE-2022-38649">[CVE]</a> <a href="./CVE-2022-38649.cve.json">[CVE json]</a> <a href="./CVE-2022-38649.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-22T09:35:10.175Z</em></p>
-<h3 id="affected-154">Affected</h3>
+<h3 id="affected-170">Affected</h3>
<ul>
<li>Apache Airflow Pinot Provider from unspecified before 4.0.0</li>
<li>Apache Airflow from unspecified before 2.3.0</li>
</ul>
-<h3 id="description-154">Description</h3>
+<h3 id="description-170">Description</h3>
<p>Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Apache Airflow Pinot Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Apache Airflow Pinot Provider is installed (Apache Airflow Pinot Pro [...]
-<h3 id="references-154">References</h3>
+<h3 id="references-170">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/27641">https://github.com/apache/airflow/pull/27641</a></li>
<li><a href="https://lists.apache.org/thread/033o1gbc4ly6dpd2xf1o201v56fbl4dz">https://lists.apache.org/thread/033o1gbc4ly6dpd2xf1o201v56fbl4dz</a></li>
</ul>
-<h3 id="credits-150">Credits</h3>
+<h3 id="credits-166">Credits</h3>
<ul>
<li>Apache Airflow PMC wants to thank id_No2015429 of 3H Security Team for reporting the issue.</li>
</ul>
<h2 id="CVE-2022-38362">Docker Provider <3.0 RCE vulnerability in example dag</h2>
<p>CVE-2022-38362 <a href="https://cve.org/CVERecord?id=CVE-2022-38362">[CVE]</a> <a href="./CVE-2022-38362.cve.json">[CVE json]</a> <a href="./CVE-2022-38362.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-08-16T14:05:03.199Z</em></p>
-<h3 id="affected-155">Affected</h3>
+<h3 id="affected-171">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow Docker Provider before 3.0.0</li>
</ul>
-<h3 id="description-155">Description</h3>
+<h3 id="description-171">Description</h3>
<p>Apache Airflow Docker’s Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host.</p>
-<h3 id="references-155">References</h3>
+<h3 id="references-171">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/614p38nf4gbk8xhvnskj9b1sqo2dknkb">https://lists.apache.org/thread/614p38nf4gbk8xhvnskj9b1sqo2dknkb</a></li>
</ul>
-<h3 id="credits-151">Credits</h3>
+<h3 id="credits-167">Credits</h3>
<ul>
<li>Thanks to Kai Zhao of 3H Secruity Team for reporting this</li>
</ul>
<h2 id="CVE-2022-38170">Overly permissive umask for daemons</h2>
<p>CVE-2022-38170 <a href="https://cve.org/CVERecord?id=CVE-2022-38170">[CVE]</a> <a href="./CVE-2022-38170.cve.json">[CVE json]</a> <a href="./CVE-2022-38170.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-09-02T07:07:24.352Z</em></p>
-<h3 id="affected-156">Affected</h3>
+<h3 id="affected-172">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow through 2.3.3</li>
</ul>
-<h3 id="description-156">Description</h3>
+<h3 id="description-172">Description</h3>
<p>In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the <code>--daemon</code> flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver.</p>
-<h3 id="references-156">References</h3>
+<h3 id="references-172">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/zn8mbbb1j2od5nc9zhrvb7rpsrg1vvzv">https://lists.apache.org/thread/zn8mbbb1j2od5nc9zhrvb7rpsrg1vvzv</a></li>
</ul>
-<h3 id="credits-152">Credits</h3>
+<h3 id="credits-168">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank Harry Sintonen for reporting this issue.</li>
</ul>
<h2 id="CVE-2022-38054">Session Fixation</h2>
<p>CVE-2022-38054 <a href="https://cve.org/CVERecord?id=CVE-2022-38054">[CVE]</a> <a href="./CVE-2022-38054.cve.json">[CVE json]</a> <a href="./CVE-2022-38054.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-09-13T08:39:38.357Z</em></p>
-<h3 id="affected-157">Affected</h3>
+<h3 id="affected-173">Affected</h3>
<ul>
<li>Apache Airflow from 2.2.4 before Apache Airflow*</li>
</ul>
-<h3 id="description-157">Description</h3>
+<h3 id="description-173">Description</h3>
<p>In Apache Airflow versions 2.2.4 through 2.3.3, the <code>database</code> webserver session backend was susceptible to session fixation.</p>
-<h3 id="references-157">References</h3>
+<h3 id="references-173">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/rsd3h89xdp16rg0ltovx3m7q3ypkxsbb">https://lists.apache.org/thread/rsd3h89xdp16rg0ltovx3m7q3ypkxsbb</a></li>
</ul>
-<h3 id="credits-153">Credits</h3>
+<h3 id="credits-169">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank Kai Zhao for reporting this issue.</li>
<li>Additoinally we would like to thank Ali Al-Habsi for independently discovering and reporting this issue.</li>
@@ -3083,233 +3398,233 @@
<h2 id="CVE-2022-27949">Apache Airflow prior to 2.3.1 may include sensitive values in rendered template</h2>
<p>CVE-2022-27949 <a href="https://cve.org/CVERecord?id=CVE-2022-27949">[CVE]</a> <a href="./CVE-2022-27949.cve.json">[CVE json]</a> <a href="./CVE-2022-27949.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-15T11:12:08.938Z</em></p>
-<h3 id="affected-158">Affected</h3>
+<h3 id="affected-174">Affected</h3>
<ul>
<li>Apache Airflow from unspecified before 2.3.1</li>
</ul>
-<h3 id="description-158">Description</h3>
+<h3 id="description-174">Description</h3>
<p>A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example when they were depending on past and previous instances of the task failed). This issue affects Apache Airflow prior to 2.3.1.</p>
-<h3 id="references-158">References</h3>
+<h3 id="references-174">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/22754">https://github.com/apache/airflow/pull/22754</a></li>
<li><a href="https://lists.apache.org/thread/n38oc5obb48600fsvnbopxcs0jpbp65p">https://lists.apache.org/thread/n38oc5obb48600fsvnbopxcs0jpbp65p</a></li>
</ul>
-<h3 id="credits-154">Credits</h3>
+<h3 id="credits-170">Credits</h3>
<ul>
<li>Apache Airflow PMC would like to thank James Srinivasan for reporting it.</li>
</ul>
<h2 id="CVE-2022-24288">Apache Airflow: RCE in example DAGs</h2>
<p>CVE-2022-24288 <a href="https://cve.org/CVERecord?id=CVE-2022-24288">[CVE]</a> <a href="./CVE-2022-24288.cve.json">[CVE json]</a> <a href="./CVE-2022-24288.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-02-25T08:21:43.680Z</em></p>
-<h3 id="affected-159">Affected</h3>
+<h3 id="affected-175">Affected</h3>
<ul>
<li>Apache Airflow from unspecified before 2.2.4</li>
</ul>
-<h3 id="description-159">Description</h3>
+<h3 id="description-175">Description</h3>
<p>In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.</p>
-<h3 id="references-159">References</h3>
+<h3 id="references-175">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/dbw5ozcmr0h0lhs0yjph7xdc64oht23t">https://lists.apache.org/thread/dbw5ozcmr0h0lhs0yjph7xdc64oht23t</a></li>
</ul>
-<h3 id="credits-155">Credits</h3>
+<h3 id="credits-171">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank Kai Zhao of the TToU Security Team for reporting this issue.</li>
</ul>
<h2 id="CVE-2021-45230">Apache Airflow: Creating DagRuns didn’t respect Dag-level permissions in the Webserver</h2>
<p>CVE-2021-45230 <a href="https://cve.org/CVERecord?id=CVE-2021-45230">[CVE]</a> <a href="./CVE-2021-45230.cve.json">[CVE json]</a> <a href="./CVE-2021-45230.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-01-20T09:06:03.334Z</em></p>
-<h3 id="affected-160">Affected</h3>
+<h3 id="affected-176">Affected</h3>
<ul>
<li>Apache Airflow at Apache Airflow 1.10 1.10.0 to 1.10.15</li>
<li>Apache Airflow from Apache Airflow 2 before 2.2.0</li>
</ul>
-<h3 id="description-160">Description</h3>
+<h3 id="description-176">Description</h3>
<p>In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has “can_create” permissions on DAG Runs can create Dag Runs for dags that they don’t have “edit” permissions for.</p>
-<h3 id="references-160">References</h3>
+<h3 id="references-176">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/m778ojn0k595rwco4ht9wjql89mjoxnl">https://lists.apache.org/thread/m778ojn0k595rwco4ht9wjql89mjoxnl</a></li>
</ul>
-<h3 id="credits-156">Credits</h3>
+<h3 id="credits-172">Credits</h3>
<ul>
<li>Apache Airflow PMC would like to thank Franco Cano Erazo for reporting this issue.</li>
</ul>
<h2 id="CVE-2021-45229">Apache Airflow: Reflected XSS via Origin Query Argument in URL</h2>
<p>CVE-2021-45229 <a href="https://cve.org/CVERecord?id=CVE-2021-45229">[CVE]</a> <a href="./CVE-2021-45229.cve.json">[CVE json]</a> <a href="./CVE-2021-45229.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-02-25T08:21:17.026Z</em></p>
-<h3 id="affected-161">Affected</h3>
+<h3 id="affected-177">Affected</h3>
<ul>
<li>Apache Airflow from unspecified before 2.2.4</li>
</ul>
-<h3 id="description-161">Description</h3>
+<h3 id="description-177">Description</h3>
<p>It was discovered that the “Trigger DAG with config” screen was susceptible to XSS attacks via the <code>origin</code> query argument.</p>
<p>This issue affects Apache Airflow versions 2.2.3 and below.</p>
-<h3 id="references-161">References</h3>
+<h3 id="references-177">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/phx76cgtmhwwdy780rvwhobx8qoy4bnk">https://lists.apache.org/thread/phx76cgtmhwwdy780rvwhobx8qoy4bnk</a></li>
</ul>
-<h3 id="credits-157">Credits</h3>
+<h3 id="credits-173">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank both Bogdan Kurinnoy of the Samsung R&D Institute Ukraine (SRK) and Ali Al-Habsi of Accellion for independently discovering and reporting this issue.</li>
</ul>
<h2 id="CVE-2021-38540">Apache Airflow: Variable Import endpoint missed authentication check</h2>
<p>CVE-2021-38540 <a href="https://cve.org/CVERecord?id=CVE-2021-38540">[CVE]</a> <a href="./CVE-2021-38540.cve.json">[CVE json]</a> <a href="./CVE-2021-38540.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2021-09-09T14:59:44.637Z</em></p>
-<h3 id="affected-162">Affected</h3>
+<h3 id="affected-178">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow before 2.1.3</li>
</ul>
-<h3 id="description-162">Description</h3>
+<h3 id="description-178">Description</h3>
<p>The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially
resulting in a denial of service, information disclosure or remote code execution.</p>
<p>This issue affects Apache Airflow >=2.0.0, <2.1.3.</p>
-<h3 id="references-162">References</h3>
+<h3 id="references-178">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/rb34c3dd1a815456355217eef34060789f771b6f77c3a3dec77de2064%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/rb34c3dd1a815456355217eef34060789f771b6f77c3a3dec77de2064%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
-<h3 id="credits-158">Credits</h3>
+<h3 id="credits-174">Credits</h3>
<ul>
<li>Apache Airflow would like to thank Nathan Jones, National Australia Bank’s Offensive Security Team</li>
</ul>
<h2 id="CVE-2021-35936">No Authentication on Logging Server</h2>
<p>CVE-2021-35936 <a href="https://cve.org/CVERecord?id=CVE-2021-35936">[CVE]</a> <a href="./CVE-2021-35936.cve.json">[CVE json]</a> <a href="./CVE-2021-35936.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2021-08-16T07:22:38.757Z</em></p>
-<h3 id="affected-163">Affected</h3>
+<h3 id="affected-179">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow before 2.1.2</li>
</ul>
-<h3 id="description-163">Description</h3>
+<h3 id="description-179">Description</h3>
<p>If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default.
This logging server had no authentication and allows reading log files of DAG jobs.</p>
<p>This issue affects Apache Airflow < 2.1.2.</p>
-<h3 id="references-163">References</h3>
+<h3 id="references-179">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/r53d6bd7b0a66f92ddaf1313282f10fec802e71246606dd30c16536df%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/r53d6bd7b0a66f92ddaf1313282f10fec802e71246606dd30c16536df%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
-<h3 id="credits-159">Credits</h3>
+<h3 id="credits-175">Credits</h3>
<ul>
<li>Apache Airflow would like to thank Dolev Farhi for reporting this issue.</li>
</ul>
<h2 id="CVE-2021-28359">Apache Airflow Reflected XSS via Origin Query Argument in URL</h2>
<p>CVE-2021-28359 <a href="https://cve.org/CVERecord?id=CVE-2021-28359">[CVE]</a> <a href="./CVE-2021-28359.cve.json">[CVE json]</a> <a href="./CVE-2021-28359.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2021-05-02T07:52:16.051Z</em></p>
-<h3 id="affected-164">Affected</h3>
+<h3 id="affected-180">Affected</h3>
<ul>
<li>Apache Airflow at 2.0.0</li>
<li>Apache Airflow at 2.0.1</li>
<li>Apache Airflow from Apache Airflow before 1.10.15</li>
</ul>
-<h3 id="description-164">Description</h3>
+<h3 id="description-180">Description</h3>
<p>The “origin” parameter passed to some of the endpoints like ‘/trigger’ was vulnerable to XSS exploit. This issue affects Apache Airflow versions <1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series.</p>
<p>This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fix the issue completely. Update to Airflow 1.10.15 or 2.0.2.</p>
<p>Please also update your Python version to the latest available PATCH releases of the installed MINOR versions, example update to Python 3.6.13 if you are on Python 3.6. (Those contain the fix for CVE-2021-23336 <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-23336)">https://nvd.nist.gov/vuln/detail/CVE-2021-23336)</a>.</p>
-<h3 id="references-164">References</h3>
+<h3 id="references-180">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
-<h3 id="credits-160">Credits</h3>
+<h3 id="credits-176">Credits</h3>
<ul>
<li>Vasileios Daskalakis</li>
</ul>
<h2 id="CVE-2021-26697">Apache Airflow: Lineage API endpoint for Experimental API missed authentication check</h2>
<p>CVE-2021-26697 <a href="https://cve.org/CVERecord?id=CVE-2021-26697">[CVE]</a> <a href="./CVE-2021-26697.cve.json">[CVE json]</a> <a href="./CVE-2021-26697.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2021-02-17T14:10:43.736Z</em></p>
-<h3 id="affected-165">Affected</h3>
+<h3 id="affected-181">Affected</h3>
<ul>
<li>Apache Airflow at 2.0.0</li>
</ul>
-<h3 id="description-165">Description</h3>
+<h3 id="description-181">Description</h3>
<p>The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint.</p>
<p>This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task.</p>
<p>This issue affects Apache Airflow 2.0.0.</p>
-<h3 id="references-165">References</h3>
+<h3 id="references-181">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/re21fec81baea7a6d73b0b5d31efd07cc02c61f832e297f65bb19b519%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/re21fec81baea7a6d73b0b5d31efd07cc02c61f832e297f65bb19b519%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
-<h3 id="credits-161">Credits</h3>
+<h3 id="credits-177">Credits</h3>
<ul>
<li>Apache Airflow would like to thank Ian Carroll for reporting this issue.</li>
</ul>
<h2 id="CVE-2021-26559">CWE-284 Improper Access Control on Configurations Endpoint for the Stable API</h2>
<p>CVE-2021-26559 <a href="https://cve.org/CVERecord?id=CVE-2021-26559">[CVE]</a> <a href="./CVE-2021-26559.cve.json">[CVE json]</a> <a href="./CVE-2021-26559.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2021-02-17T13:18:02.283Z</em></p>
-<h3 id="affected-166">Affected</h3>
+<h3 id="affected-182">Affected</h3>
<ul>
<li>Apache Airflow at 2.0.0</li>
</ul>
-<h3 id="description-166">Description</h3>
+<h3 id="description-182">Description</h3>
<p>Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when <code>[webserver] expose_config</code> is set to <code>False</code> in <code>airflow.cfg</code>.</p>
<p>This allowed a privilege escalation attack.</p>
<p>This issue affects Apache Airflow 2.0.0.</p>
-<h3 id="references-166">References</h3>
+<h3 id="references-182">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/r3b3787700279ec361308cbefb7c2cce2acb26891a12ce864e4a13c8d%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/r3b3787700279ec361308cbefb7c2cce2acb26891a12ce864e4a13c8d%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
-<h3 id="credits-162">Credits</h3>
+<h3 id="credits-178">Credits</h3>
<ul>
<li>Apache Airflow would like to thank Ian Carroll for reporting this issue.</li>
</ul>
<h2 id="CVE-2020-17526"></h2>
<p>CVE-2020-17526 <a href="https://cve.org/CVERecord?id=CVE-2020-17526">[CVE]</a> <a href="./CVE-2020-17526.cve.json">[CVE json]</a> <a href="./CVE-2020-17526.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2020-12-21T16:43:50.352Z</em></p>
-<h3 id="affected-167">Affected</h3>
+<h3 id="affected-183">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow before 1.10.14</li>
</ul>
-<h3 id="description-167">Description</h3>
+<h3 id="description-183">Description</h3>
<p>Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for <code>[webserver] secret_key</code> config.</p>
-<h3 id="references-167">References</h3>
+<h3 id="references-183">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/rbeeb73a6c741f2f9200d83b9c2220610da314810c4e8c9cf881d47ef%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/rbeeb73a6c741f2f9200d83b9c2220610da314810c4e8c9cf881d47ef%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
-<h3 id="credits-163">Credits</h3>
+<h3 id="credits-179">Credits</h3>
<ul>
<li>Junghan Lee of Deliveryhero Korea Security Team</li>
</ul>
<h2 id="CVE-2020-17515"></h2>
<p>CVE-2020-17515 <a href="https://cve.org/CVERecord?id=CVE-2020-17515">[CVE]</a> <a href="./CVE-2020-17515.cve.json">[CVE json]</a> <a href="./CVE-2020-17515.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2020-12-11T13:35:28.574Z</em></p>
-<h3 id="affected-168">Affected</h3>
+<h3 id="affected-184">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow before 1.10.13</li>
</ul>
-<h3 id="description-168">Description</h3>
+<h3 id="description-184">Description</h3>
<p>The “origin” parameter passed to some of the endpoints like ‘/trigger’ was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13.</p>
<p>This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.</p>
-<h3 id="references-168">References</h3>
+<h3 id="references-184">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/r4656959c8ed06c1f6202d89aa4e67b35ad7bdba5a666caff3fea888e%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/r4656959c8ed06c1f6202d89aa4e67b35ad7bdba5a666caff3fea888e%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
-<h3 id="credits-164">Credits</h3>
+<h3 id="credits-180">Credits</h3>
<ul>
<li>Ali Abdulwahab Ali Al-habsi of Accellion</li>
</ul>
<h2 id="CVE-2020-17513"></h2>
<p>CVE-2020-17513 <a href="https://cve.org/CVERecord?id=CVE-2020-17513">[CVE]</a> <a href="./CVE-2020-17513.cve.json">[CVE json]</a> <a href="./CVE-2020-17513.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2020-12-14T09:36:02.746Z</em></p>
-<h3 id="affected-169">Affected</h3>
+<h3 id="affected-185">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow before 1.10.13</li>
</ul>
-<h3 id="description-169">Description</h3>
+<h3 id="description-185">Description</h3>
<p>In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack.</p>
-<h3 id="references-169">References</h3>
+<h3 id="references-185">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/rb3647269f07cc2775ca6568cbfd4994d862c842a58120d2aba9c658a%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/rb3647269f07cc2775ca6568cbfd4994d862c842a58120d2aba9c658a%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
<h2 id="CVE-2020-17511"></h2>
<p>CVE-2020-17511 <a href="https://cve.org/CVERecord?id=CVE-2020-17511">[CVE]</a> <a href="./CVE-2020-17511.cve.json">[CVE json]</a> <a href="./CVE-2020-17511.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2020-12-14T09:35:45.373Z</em></p>
-<h3 id="affected-170">Affected</h3>
+<h3 id="affected-186">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow before 1.10.13</li>
</ul>
-<h3 id="description-170">Description</h3>
+<h3 id="description-186">Description</h3>
<p>In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. Same happened when creating a Connection with a password field.</p>
-<h3 id="references-170">References</h3>
+<h3 id="references-186">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/ree782a29d927b96bf0b39fb92e2f1f09ea3112a985f7a08ce93765ac%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/ree782a29d927b96bf0b39fb92e2f1f09ea3112a985f7a08ce93765ac%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
-<h3 id="credits-165">Credits</h3>
+<h3 id="credits-181">Credits</h3>
<ul>
<li>Ali Al-Habsi of Accellion</li>
</ul>
diff --git a/projects/allura/CVE-2026-69223.cve.json b/projects/allura/CVE-2026-69223.cve.json
new file mode 100644
index 00000000..51c3b509
--- /dev/null
+++ b/projects/allura/CVE-2026-69223.cve.json
@@ -0,0 +1,85 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Server-side request forgery",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-918 Server-Side Request Forgery (SSRF)",
+ "lang": "en",
+ "cweId": "CWE-918",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "INTERNAL"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Allura",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "1.19.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Allura's webhooks are vulnerable to\u00a0Server-Side Request Forgery (SSRF).\n\nThis issue affects Apache Allura: before 1.19.1.\n\nUsers are recommended to upgrade to version 1.19.1, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF).</p><p>This issue affects Apache Allura: before 1.19.1.</p><p>Users are recommended to upgrade to version 1.19.1, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://allura.apache.org/posts/2026-allura-1.19.1.html"
+ },
+ {
+ "url": "https://lists.apache.org/thread/9xpltfm6nombd7rdrx5o0hh8kxmm82pb",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-69223",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/allura/CVE-2026-69223.osv.json b/projects/allura/CVE-2026-69223.osv.json
new file mode 100644
index 00000000..5271e165
--- /dev/null
+++ b/projects/allura/CVE-2026-69223.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-69223", "summary": "Server-side request forgery", "details": "Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF).\n\nThis issue affects Apache Allura: before 1.19.1.\n\nUsers are recommended to upgrade to version 1.19.1, which fixes the issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "0"}, {"fixed": "1.19.1"}]}]}], "references": [{"type": "WEB", "url": "https://allura.apache.org/posts/20 [...]
\ No newline at end of file
diff --git a/projects/allura/CVE-2026-73237.cve.json b/projects/allura/CVE-2026-73237.cve.json
new file mode 100644
index 00000000..9cf7b382
--- /dev/null
+++ b/projects/allura/CVE-2026-73237.cve.json
@@ -0,0 +1,85 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "XSS in markdown pipeline",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
+ "lang": "en",
+ "cweId": "CWE-80",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Allura",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "1.10.0",
+ "lessThan": "1.19.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "XSS vulnerability in Markdown handling in Apache Allura.\n\nThis issue affects Apache Allura: from 1.10.0 before 1.19.1.\n\nUsers are recommended to upgrade to version 1.19.1, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>XSS vulnerability in Markdown handling in Apache Allura.</p><p>This issue affects Apache Allura: from 1.10.0 before 1.19.1.</p><p>Users are recommended to upgrade to version 1.19.1, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://allura.apache.org/posts/2026-allura-1.19.1.html"
+ },
+ {
+ "url": "https://lists.apache.org/thread/p7bd1yz9v9wbsbc6hz3tjxozxnwyzqz0",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "critical"
+ }
+ }
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-73237",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/allura/CVE-2026-73237.osv.json b/projects/allura/CVE-2026-73237.osv.json
new file mode 100644
index 00000000..17c4974d
--- /dev/null
+++ b/projects/allura/CVE-2026-73237.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-73237", "summary": "XSS in markdown pipeline", "details": "XSS vulnerability in Markdown handling in Apache Allura.\n\nThis issue affects Apache Allura: from 1.10.0 before 1.19.1.\n\nUsers are recommended to upgrade to version 1.19.1, which fixes the issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "1.10.0"}, {"fixed": "1.19.1"}]}]}], "references": [{"type": "WEB", "url": "https://allura.apache.org/posts/2026-allur [...]
\ No newline at end of file
diff --git a/projects/allura/CVE-2026-73238.cve.json b/projects/allura/CVE-2026-73238.cve.json
new file mode 100644
index 00000000..cb533cd0
--- /dev/null
+++ b/projects/allura/CVE-2026-73238.cve.json
@@ -0,0 +1,85 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "XSS in code display",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
+ "lang": "en",
+ "cweId": "CWE-80",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Allura",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "1.19.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "XSS vulnerability in code display in Apache Allura.\n\nThis issue affects Apache Allura: before 1.19.1.\n\nUsers are recommended to upgrade to version 1.19.1, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>XSS vulnerability in code display in Apache Allura.</p><p>This issue affects Apache Allura: before 1.19.1.</p><p>Users are recommended to upgrade to version 1.19.1, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://allura.apache.org/posts/2026-allura-1.19.1.html"
+ },
+ {
+ "url": "https://lists.apache.org/thread/bbzhnvqlwvwbprnfg4g41s8wkc5bdfmk",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "critical"
+ }
+ }
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-73238",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/allura/CVE-2026-73238.osv.json b/projects/allura/CVE-2026-73238.osv.json
new file mode 100644
index 00000000..0550c455
--- /dev/null
+++ b/projects/allura/CVE-2026-73238.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-73238", "summary": "XSS in code display", "details": "XSS vulnerability in code display in Apache Allura.\n\nThis issue affects Apache Allura: before 1.19.1.\n\nUsers are recommended to upgrade to version 1.19.1, which fixes the issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "0"}, {"fixed": "1.19.1"}]}]}], "references": [{"type": "WEB", "url": "https://allura.apache.org/posts/2026-allura-1.19.1.html"}, {"type": " [...]
\ No newline at end of file
diff --git a/projects/allura/CVE-2026-73239.cve.json b/projects/allura/CVE-2026-73239.cve.json
new file mode 100644
index 00000000..df1e5d50
--- /dev/null
+++ b/projects/allura/CVE-2026-73239.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Missing permission checks IDOR",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-280 Improper Handling of Insufficient Permissions or Privileges",
+ "lang": "en",
+ "cweId": "CWE-280",
+ "type": "CWE"
+ }
+ ]
+ },
+ {
+ "descriptions": [
+ {
+ "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
+ "lang": "en",
+ "cweId": "CWE-639",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Allura",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "1.19.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types\u00a0in Apache Allura.\n\nThis issue affects Apache Allura: before 1.19.1.\n\nUsers are recommended to upgrade to version 1.19.1, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura.</p><p>This issue affects Apache Allura: before 1.19.1.</p><p>Users are recommended to upgrade to version 1.19.1, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://allura.apache.org/posts/2026-allura-1.19.1.html"
+ },
+ {
+ "url": "https://lists.apache.org/thread/ryn6yomo897d43ovrd47g02t8ycmbxb3",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-73239",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/allura/CVE-2026-73239.osv.json b/projects/allura/CVE-2026-73239.osv.json
new file mode 100644
index 00000000..68e82c96
--- /dev/null
+++ b/projects/allura/CVE-2026-73239.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-73239", "summary": "Missing permission checks IDOR", "details": "Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura.\n\nThis issue affects Apache Allura: before 1.19.1.\n\nUsers are recommended to upgrade to version 1.19.1, which fixes the issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "0"}, {"fixed": "1.19.1"}]}]}], "references": [{"type": "WEB", [...]
\ No newline at end of file
diff --git a/projects/allura/CVE-2026-73240.cve.json b/projects/allura/CVE-2026-73240.cve.json
new file mode 100644
index 00000000..30eab643
--- /dev/null
+++ b/projects/allura/CVE-2026-73240.cve.json
@@ -0,0 +1,85 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Git command injection",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')",
+ "lang": "en",
+ "cweId": "CWE-88",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Allura",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "1.19.1",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Specifically crafted inputs may lead to git argument injection in Apache Allura.\n\nThis issue affects Apache Allura: before 1.19.1.\n\nUsers are recommended to upgrade to version 1.19.1, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Specifically crafted inputs may lead to git argument injection in Apache Allura.</p><p>This issue affects Apache Allura: before 1.19.1.</p><p>Users are recommended to upgrade to version 1.19.1, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://allura.apache.org/posts/2026-allura-1.19.1.html"
+ },
+ {
+ "url": "https://lists.apache.org/thread/10gnxblhomk2z4gxcyyb4t3p4zxsdddv",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-73240",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/allura/CVE-2026-73240.osv.json b/projects/allura/CVE-2026-73240.osv.json
new file mode 100644
index 00000000..9e681a45
--- /dev/null
+++ b/projects/allura/CVE-2026-73240.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-73240", "summary": "Git command injection", "details": "Specifically crafted inputs may lead to git argument injection in Apache Allura.\n\nThis issue affects Apache Allura: before 1.19.1.\n\nUsers are recommended to upgrade to version 1.19.1, which fixes the issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "0"}, {"fixed": "1.19.1"}]}]}], "references": [{"type": "WEB", "url": "https://allura.apache.org/posts/2026-a [...]
\ No newline at end of file
diff --git a/projects/allura/index.html b/projects/allura/index.html
index 16b103c5..3101b30a 100644
--- a/projects/allura/index.html
+++ b/projects/allura/index.html
@@ -105,16 +105,86 @@
<p>Do you want disclose a potential security issue for Apache Allura? Send your report to the <a href="mailto:security@apache.org?subject=Allura">Apache Security Team</a>.</p>
<h1 id="advisories">Advisories</h1>
<p class="bg-warning">This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public <a href="/mailinglist">mailinglist</a> or privately on <a href="mailto:security@apache.org">security@apache.org</a></p>
+<h2 id="CVE-2026-73240">Git command injection</h2>
+<p>CVE-2026-73240 <a href="https://cve.org/CVERecord?id=CVE-2026-73240">[CVE]</a> <a href="./CVE-2026-73240.cve.json">[CVE json]</a> <a href="./CVE-2026-73240.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-12T16:41:16.893Z</em></p>
+<h3 id="affected">Affected</h3>
+<ul>
+<li>Apache Allura before 1.19.1</li>
+</ul>
+<h3 id="description">Description</h3>
+<p>Specifically crafted inputs may lead to git argument injection in Apache Allura.</p><p>This issue affects Apache Allura: before 1.19.1.</p><p>Users are recommended to upgrade to version 1.19.1, which fixes the issue.</p>
+<h3 id="references">References</h3>
+<ul>
+<li><a href="https://allura.apache.org/posts/2026-allura-1.19.1.html">https://allura.apache.org/posts/2026-allura-1.19.1.html</a></li>
+<li><a href="https://lists.apache.org/thread/10gnxblhomk2z4gxcyyb4t3p4zxsdddv">https://lists.apache.org/thread/10gnxblhomk2z4gxcyyb4t3p4zxsdddv</a></li>
+</ul>
+<h2 id="CVE-2026-73239">Missing permission checks IDOR</h2>
+<p>CVE-2026-73239 <a href="https://cve.org/CVERecord?id=CVE-2026-73239">[CVE]</a> <a href="./CVE-2026-73239.cve.json">[CVE json]</a> <a href="./CVE-2026-73239.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-12T16:41:39.780Z</em></p>
+<h3 id="affected-1">Affected</h3>
+<ul>
+<li>Apache Allura before 1.19.1</li>
+</ul>
+<h3 id="description-1">Description</h3>
+<p>Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura.</p><p>This issue affects Apache Allura: before 1.19.1.</p><p>Users are recommended to upgrade to version 1.19.1, which fixes the issue.</p>
+<h3 id="references-1">References</h3>
+<ul>
+<li><a href="https://allura.apache.org/posts/2026-allura-1.19.1.html">https://allura.apache.org/posts/2026-allura-1.19.1.html</a></li>
+<li><a href="https://lists.apache.org/thread/ryn6yomo897d43ovrd47g02t8ycmbxb3">https://lists.apache.org/thread/ryn6yomo897d43ovrd47g02t8ycmbxb3</a></li>
+</ul>
+<h2 id="CVE-2026-73238">XSS in code display</h2>
+<p>CVE-2026-73238 <a href="https://cve.org/CVERecord?id=CVE-2026-73238">[CVE]</a> <a href="./CVE-2026-73238.cve.json">[CVE json]</a> <a href="./CVE-2026-73238.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-12T16:41:57.464Z</em></p>
+<h3 id="affected-2">Affected</h3>
+<ul>
+<li>Apache Allura before 1.19.1</li>
+</ul>
+<h3 id="description-2">Description</h3>
+<p>XSS vulnerability in code display in Apache Allura.</p><p>This issue affects Apache Allura: before 1.19.1.</p><p>Users are recommended to upgrade to version 1.19.1, which fixes the issue.</p>
+<h3 id="references-2">References</h3>
+<ul>
+<li><a href="https://allura.apache.org/posts/2026-allura-1.19.1.html">https://allura.apache.org/posts/2026-allura-1.19.1.html</a></li>
+<li><a href="https://lists.apache.org/thread/bbzhnvqlwvwbprnfg4g41s8wkc5bdfmk">https://lists.apache.org/thread/bbzhnvqlwvwbprnfg4g41s8wkc5bdfmk</a></li>
+</ul>
+<h2 id="CVE-2026-73237">XSS in markdown pipeline</h2>
+<p>CVE-2026-73237 <a href="https://cve.org/CVERecord?id=CVE-2026-73237">[CVE]</a> <a href="./CVE-2026-73237.cve.json">[CVE json]</a> <a href="./CVE-2026-73237.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-12T16:42:26.194Z</em></p>
+<h3 id="affected-3">Affected</h3>
+<ul>
+<li>Apache Allura from 1.10.0 before 1.19.1</li>
+</ul>
+<h3 id="description-3">Description</h3>
+<p>XSS vulnerability in Markdown handling in Apache Allura.</p><p>This issue affects Apache Allura: from 1.10.0 before 1.19.1.</p><p>Users are recommended to upgrade to version 1.19.1, which fixes the issue.</p>
+<h3 id="references-3">References</h3>
+<ul>
+<li><a href="https://allura.apache.org/posts/2026-allura-1.19.1.html">https://allura.apache.org/posts/2026-allura-1.19.1.html</a></li>
+<li><a href="https://lists.apache.org/thread/p7bd1yz9v9wbsbc6hz3tjxozxnwyzqz0">https://lists.apache.org/thread/p7bd1yz9v9wbsbc6hz3tjxozxnwyzqz0</a></li>
+</ul>
+<h2 id="CVE-2026-69223">Server-side request forgery</h2>
+<p>CVE-2026-69223 <a href="https://cve.org/CVERecord?id=CVE-2026-69223">[CVE]</a> <a href="./CVE-2026-69223.cve.json">[CVE json]</a> <a href="./CVE-2026-69223.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-11T17:03:03.256Z</em></p>
+<h3 id="affected-4">Affected</h3>
+<ul>
+<li>Apache Allura before 1.19.1</li>
+</ul>
+<h3 id="description-4">Description</h3>
+<p>Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF).</p><p>This issue affects Apache Allura: before 1.19.1.</p><p>Users are recommended to upgrade to version 1.19.1, which fixes the issue.</p>
+<h3 id="references-4">References</h3>
+<ul>
+<li><a href="https://allura.apache.org/posts/2026-allura-1.19.1.html">https://allura.apache.org/posts/2026-allura-1.19.1.html</a></li>
+<li><a href="https://lists.apache.org/thread/9xpltfm6nombd7rdrx5o0hh8kxmm82pb">https://lists.apache.org/thread/9xpltfm6nombd7rdrx5o0hh8kxmm82pb</a></li>
+</ul>
<h2 id="CVE-2024-38379">Stored authenticated XSS</h2>
<p>CVE-2024-38379 <a href="https://cve.org/CVERecord?id=CVE-2024-38379">[CVE]</a> <a href="./CVE-2024-38379.cve.json">[CVE json]</a> <a href="./CVE-2024-38379.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-02-06T14:32:32.361Z</em></p>
-<h3 id="affected">Affected</h3>
+<h3 id="affected-5">Affected</h3>
<ul>
<li>Apache Allura from 1.4.0 through 1.17.0</li>
</ul>
-<h3 id="description">Description</h3>
+<h3 id="description-5">Description</h3>
<p>Apache Allura's neighborhood settings are vulnerable to a stored XSS attack. Only neighborhood admins can access these settings, so the scope of risk is limited to configurations where neighborhood admins are not fully trusted.<br></p><p>This issue affects Apache Allura: from 1.4.0 through 1.17.0.</p><p>Users are recommended to upgrade to version 1.17.1, which fixes the issue.</p>
-<h3 id="references">References</h3>
+<h3 id="references-5">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/2lb6vp00sj2b2snpmhff5lyortxjsnrp">https://lists.apache.org/thread/2lb6vp00sj2b2snpmhff5lyortxjsnrp</a></li>
</ul>
@@ -125,13 +195,13 @@
<h2 id="CVE-2024-36471">sensitive information exposure via DNS rebinding</h2>
<p>CVE-2024-36471 <a href="https://cve.org/CVERecord?id=CVE-2024-36471">[CVE]</a> <a href="./CVE-2024-36471.cve.json">[CVE json]</a> <a href="./CVE-2024-36471.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-06-10T21:55:03.113Z</em></p>
-<h3 id="affected-1">Affected</h3>
+<h3 id="affected-6">Affected</h3>
<ul>
<li>Apache Allura from 1.0.1 through 1.16.0</li>
</ul>
-<h3 id="description-1">Description</h3>
+<h3 id="description-6">Description</h3>
<div>Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL. Project administrators can run these imports, which could cause Allura to read from internal services and expose them.<br></div><div><br></div><div>This issue affects Apache Allura from 1.0.1 through 1.16.0.</div><p></p><p>Users are recommended to upgrade to version 1.17.0, which fixes the issue. If you are unable to upgrade, set "disable_entry_points.allura.importers = [...]
-<h3 id="references-1">References</h3>
+<h3 id="references-6">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/g43164t4bcp0tjwt4opxyks4svm8kvbh">https://lists.apache.org/thread/g43164t4bcp0tjwt4opxyks4svm8kvbh</a></li>
</ul>
@@ -142,13 +212,13 @@
<h2 id="CVE-2023-46851">sensitive information exposure via import</h2>
<p>CVE-2023-46851 <a href="https://cve.org/CVERecord?id=CVE-2023-46851">[CVE]</a> <a href="./CVE-2023-46851.cve.json">[CVE json]</a> <a href="./CVE-2023-46851.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-11-07T08:56:30.662Z</em></p>
-<h3 id="affected-2">Affected</h3>
+<h3 id="affected-7">Affected</h3>
<ul>
<li>Apache Allura from 1.0.1 through 1.15.0</li>
</ul>
-<h3 id="description-2">Description</h3>
+<h3 id="description-7">Description</h3>
<div>Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could cause Allura to read local files and expose them. Exposing internal files then can lead to other exploits, like session hijacking, or remote code execution.<br></div><div><br></div><div>This issue affects Apache Allura from 1.0.1 through 1.15.0.</div><p></p><p>Users are recommended to upgrade to version 1.16.0, which fixe [...]
-<h3 id="references-2">References</h3>
+<h3 id="references-7">References</h3>
<ul>
<li><a href="https://allura.apache.org/posts/2023-allura-1.16.0.html">https://allura.apache.org/posts/2023-allura-1.16.0.html</a></li>
<li><a href="https://lists.apache.org/thread/hqk0vltl7qgrq215zgwjfoj0khbov0gx">https://lists.apache.org/thread/hqk0vltl7qgrq215zgwjfoj0khbov0gx</a></li>
diff --git a/projects/cloudstack/CVE-2026-47359.cve.json b/projects/cloudstack/CVE-2026-47359.cve.json
new file mode 100644
index 00000000..13a70929
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-47359.cve.json
@@ -0,0 +1,100 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "OS Command Injection due to unsanitized mount command",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
+ "lang": "en",
+ "cweId": "CWE-78",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.20.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache CloudStack's NAS backup provider plugin.\u00a0The addBackupRepository API (available since 4.20.0.0) and updateBackupRepository API (introduced in 4.22.0.0) accept unsanitized command options for the backup repository. A malicious operator account can exploit this to inject arbitrary commands that execute on the KVM hypervisor host when any account subseq [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache CloudStack's NAS backup provider plugin. The addBackupRepository API (available since 4.20.0.0) and updateBackupRepository API (introduced in 4.22.0.0) accept unsanitized command options for the backup repository. A malicious operator account can exploit this to inject arbitrary commands that execute on the KVM hypervisor host when any account [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "\uae40\uc6b0\uc11d <wo...@gmail.com>",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "\u0141ukasz Bawolski <Lu...@exea.pl>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-47359",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-47359.osv.json b/projects/cloudstack/CVE-2026-47359.osv.json
new file mode 100644
index 00000000..10fa960a
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-47359.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-47359", "summary": "OS Command Injection due to unsanitized mount command", "details": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache CloudStack's NAS backup provider plugin. The addBackupRepository API (available since 4.20.0.0) and updateBackupRepository API (introduced in 4.22.0.0) accept unsanitized command options for the backup repository. A malicious operator account ca [...]
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-50112.cve.json b/projects/cloudstack/CVE-2026-50112.cve.json
new file mode 100644
index 00000000..b04aa588
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-50112.cve.json
@@ -0,0 +1,125 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "RCE and SSRF in direct download, metalink and NFS templates",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
+ "lang": "en",
+ "cweId": "CWE-78",
+ "type": "CWE"
+ }
+ ]
+ },
+ {
+ "descriptions": [
+ {
+ "description": "CWE-918 Server-Side Request Forgery (SSRF)",
+ "lang": "en",
+ "cweId": "CWE-918",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.14.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "SSRF via Metalink Mirror URL Resolution:\n\nAn authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal APIs.\n\nRCE on KVM hypervisor via NFS, Metalink files with/without Direct Downloads:\n\nAn authenticated CloudStack tenant holding the default User role can execute arbitrar [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p><b>SSRF via Metalink Mirror URL Resolution:</b></p><p>An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal APIs.</p><p><b>RCE on KVM hypervisor via NFS, Metalink files with/without Direct Downloads:</b></p><p>An authenticated CloudStack tenant holding the default [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "critical"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "K",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "Samy Ghannad <sa...@samyghannad.com>",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "Katriel Moses <ka...@gmail.com>",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "Venkatraman Kumar <ve...@securin.io>",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "\u0141ukasz Bawolski <Lu...@exea.pl>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-50112",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-50112.osv.json b/projects/cloudstack/CVE-2026-50112.osv.json
new file mode 100644
index 00000000..d0ed079b
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-50112.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-50112", "summary": "RCE and SSRF in direct download, metalink and NFS templates", "details": "SSRF via Metalink Mirror URL Resolution:\n\nAn authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal APIs.\n\nRCE on KVM hypervisor via NFS, Metalink files w [...]
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-50222.cve.json b/projects/cloudstack/CVE-2026-50222.cve.json
new file mode 100644
index 00000000..a0e6dda9
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-50222.cve.json
@@ -0,0 +1,125 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Improper access control in Userdata reference APIs",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-862 Missing Authorization",
+ "lang": "en",
+ "cweId": "CWE-862",
+ "type": "CWE"
+ }
+ ]
+ },
+ {
+ "descriptions": [
+ {
+ "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
+ "lang": "en",
+ "cweId": "CWE-200",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.18.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs.\n\nSeveral userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that be [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs.</p><p>Several userdata-related APIs in Apache CloudStack, including <code>deleteUserData</code>, <code>linkUserDataToTemplate</code>, <code>resetUserDataForVirtualMachine</code>, <code>deployVirtualMachine</code>, and <code>updateVirtualMachine</code>, exhibit missing or insufficient access control validation, potential [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Bernardo De Marco Gon\u00e7alves <be...@gmail.com>",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "Yuliang Xiao <xy...@outlook.com>",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "\u0141ukasz Bawolski <Lu...@exea.pl>",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "George Chen (GitHub: geo-chen)",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "KQ Wu <kq...@163.com>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-50222",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-50222.osv.json b/projects/cloudstack/CVE-2026-50222.osv.json
new file mode 100644
index 00000000..21accc1c
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-50222.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-50222", "summary": "Improper access control in Userdata reference APIs", "details": "Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs.\n\nSeveral userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient ac [...]
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-59085.cve.json b/projects/cloudstack/CVE-2026-59085.cve.json
new file mode 100644
index 00000000..ae751385
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-59085.cve.json
@@ -0,0 +1,105 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Server-Side Request Forgery (SSRF) vulnerability in webhook module",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-918 Server-Side Request Forgery (SSRF)",
+ "lang": "en",
+ "cweId": "CWE-918",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.20.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests.\n\nThis issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p></p><p>Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests.</p><p>This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p><p></p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Jonathan Leitschuh <jo...@gmail.com>",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "\u0141ukasz Bawolski <Lu...@exea.pl>",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "George Chen (GitHub: geo-chen)",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-59085",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-59085.osv.json b/projects/cloudstack/CVE-2026-59085.osv.json
new file mode 100644
index 00000000..e8affda5
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-59085.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-59085", "summary": "Server-Side Request Forgery (SSRF) vulnerability in webhook module", "details": "Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests.\n\nThis issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.", "affe [...]
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-59654.cve.json b/projects/cloudstack/CVE-2026-59654.cve.json
new file mode 100644
index 00000000..fbf958b1
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-59654.cve.json
@@ -0,0 +1,119 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "DoS caused by database connections leak",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-772 Missing Release of Resource after Effective Lifetime",
+ "lang": "en",
+ "cweId": "CWE-772",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.7.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service (DoS) scenario for the management server.\n\nThis issue affects Apache CloudStack: from 4.7.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service (DoS) scenario for the management server.</p><p>This issue affects Apache CloudStack: from 4.7.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended t [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/7cgf37clcpjj4g2hl7rnyoq1th3ht9r4",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "format": "CVSS",
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ],
+ "cvssV4_0": {
+ "version": "4.0",
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "attackRequirements": "PRESENT",
+ "privilegesRequired": "LOW",
+ "userInteraction": "ACTIVE",
+ "vulnConfidentialityImpact": "NONE",
+ "subConfidentialityImpact": "NONE",
+ "vulnIntegrityImpact": "NONE",
+ "subIntegrityImpact": "NONE",
+ "vulnAvailabilityImpact": "HIGH",
+ "subAvailabilityImpact": "HIGH",
+ "Safety": "NOT_DEFINED",
+ "Automatable": "NOT_DEFINED",
+ "Recovery": "NOT_DEFINED",
+ "valueDensity": "NOT_DEFINED",
+ "vulnerabilityResponseEffort": "NOT_DEFINED",
+ "providerUrgency": "NOT_DEFINED",
+ "baseSeverity": "MEDIUM",
+ "baseScore": 6.8,
+ "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Henrique Sato <he...@gmail.com>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-59654",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-59654.osv.json b/projects/cloudstack/CVE-2026-59654.osv.json
new file mode 100644
index 00000000..7f583427
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-59654.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-59654", "summary": "DoS caused by database connections leak", "details": "Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service (DoS) scenario for the management server.\n\nThis issue affects Apache CloudStack: from [...]
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-59655.cve.json b/projects/cloudstack/CVE-2026-59655.cve.json
new file mode 100644
index 00000000..24946a2c
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-59655.cve.json
@@ -0,0 +1,100 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Unauthenticated OAuth provider client-secret disclosure",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
+ "lang": "en",
+ "cweId": "CWE-200",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.19.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers.\n\nThis issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers.</p><p>This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Yuliang Xiao <xy...@outlook.com>",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "Stijn Simons <st...@portofantwerpbruges.com>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-59655",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-59655.osv.json b/projects/cloudstack/CVE-2026-59655.osv.json
new file mode 100644
index 00000000..3e319587
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-59655.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-59655", "summary": "Unauthenticated OAuth provider client-secret disclosure", "details": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers.\n\nThis issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the i [...]
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-59657.cve.json b/projects/cloudstack/CVE-2026-59657.cve.json
new file mode 100644
index 00000000..6e239672
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-59657.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Sensitive Information Disclosure via Cleartext Storage in AsyncJob",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-312 Cleartext Storage of Sensitive Information",
+ "lang": "en",
+ "cweId": "CWE-312",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database.\n\nThis issue affects Apache CloudStack: from 4.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database.</p><p>This issue affects Apache CloudStack: from 4.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Davi Torres <da...@gmail.com>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-59657",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-59657.osv.json b/projects/cloudstack/CVE-2026-59657.osv.json
new file mode 100644
index 00000000..faccd8c9
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-59657.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-59657", "summary": "Sensitive Information Disclosure via Cleartext Storage in AsyncJob", "details": "Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database.\n\nThis issue affects Apache CloudStack: from 4.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.", "affected": [{"ranges" [...]
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-59780.cve.json b/projects/cloudstack/CVE-2026-59780.cve.json
new file mode 100644
index 00000000..c0112296
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-59780.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "LDAP provider configuration disclosure",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
+ "lang": "en",
+ "cweId": "CWE-200",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.2.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers.\n\n\n\n\n\n\n\n\n\n\n\nLDAP configurations can be listed by any authenticated user with access to the listLdapConfigurations API. By default, this API is available to all default roles.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nThis issue affects Apache CloudStack: from 4.2.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22 [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers.</p><p></p><div><div><div><div></div></div></div></div><div><div><div><div><div><div><div><p>LDAP configurations can be listed by any authenticated user with access to the <em>listLdapConfigurations</em> API. By default, this API is available to all default roles.</p></div></div></div></div></div></div></div><p> [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "\u0141ukasz Bawolski <Lu...@exea.pl>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-59780",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-59780.osv.json b/projects/cloudstack/CVE-2026-59780.osv.json
new file mode 100644
index 00000000..46561e97
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-59780.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-59780", "summary": "LDAP provider configuration disclosure", "details": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers.\n\n\n\n\n\n\n\n\n\n\n\nLDAP configurations can be listed by any authenticated user with access to the listLdapConfigurations API. By default, this API is available to all default roles.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nT [...]
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-59799.cve.json b/projects/cloudstack/CVE-2026-59799.cve.json
new file mode 100644
index 00000000..01536950
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-59799.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Missing Privilege Check in Two-Factor Authentication Disable Flow",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-269 Improper Privilege Management",
+ "lang": "en",
+ "cweId": "CWE-269",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.18.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow.\n\nThis issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow.</p><p>This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Erichen <ch...@ict.ac.cn>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-59799",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-59799.osv.json b/projects/cloudstack/CVE-2026-59799.osv.json
new file mode 100644
index 00000000..88caa685
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-59799.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-59799", "summary": "Missing Privilege Check in Two-Factor Authentication Disable Flow", "details": "Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow.\n\nThis issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, [...]
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-61397.cve.json b/projects/cloudstack/CVE-2026-61397.cve.json
new file mode 100644
index 00000000..e8f3bff3
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-61397.cve.json
@@ -0,0 +1,115 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "OAuth2 Token Cross-Request Leak",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
+ "lang": "en",
+ "cweId": "CWE-200",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.19.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration.\n\nThis issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration.</p><p>This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "critical"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Katriel Moses <ka...@gmail.com>",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "\"Network and Cloud Laboratory (NaCl) KMITL\" <na...@kmitl.ac.th>",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "Paratpanu Pechsaman <66...@kmitl.ac.th>",
+ "type": "analyst"
+ },
+ {
+ "lang": "en",
+ "value": "Nutthawat Charoensiriphong <68...@kmitl.ac.th>",
+ "type": "analyst"
+ },
+ {
+ "lang": "en",
+ "value": "Panabordee Panitchakit <68...@kmitl.ac.th>",
+ "type": "analyst"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-61397",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-61397.osv.json b/projects/cloudstack/CVE-2026-61397.osv.json
new file mode 100644
index 00000000..9b9d00b3
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-61397.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-61397", "summary": "OAuth2 Token Cross-Request Leak", "details": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration.\n\nThis issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1, which fixes the issue.", "affected": [{"ranges": [ [...]
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-61398.cve.json b/projects/cloudstack/CVE-2026-61398.cve.json
new file mode 100644
index 00000000..4c1480a4
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-61398.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-116 Improper Encoding or Escaping of Output",
+ "lang": "en",
+ "cweId": "CWE-116",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.15.1.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality.\n\nThis issue affects Apache CloudStack: from 4.15.1.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality.</p><p>This issue affects Apache CloudStack: from 4.15.1.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "\u0141ukasz Bawolski <Lu...@exea.pl>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-61398",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-61398.osv.json b/projects/cloudstack/CVE-2026-61398.osv.json
new file mode 100644
index 00000000..65b25467
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-61398.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-61398", "summary": "Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI", "details": "Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality.\n\nThis issue affects Apache CloudStack: from 4.15.1.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes th [...]
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-61399.cve.json b/projects/cloudstack/CVE-2026-61399.cve.json
new file mode 100644
index 00000000..84369e19
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-61399.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-116 Improper Encoding or Escaping of Output",
+ "lang": "en",
+ "cweId": "CWE-116",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.20.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality.\n\nThis issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality.</p><p>This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "\u0141ukasz Bawolski <Lu...@exea.pl>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-61399",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-61399.osv.json b/projects/cloudstack/CVE-2026-61399.osv.json
new file mode 100644
index 00000000..245caf67
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-61399.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-61399", "summary": "Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI", "details": "Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality.\n\nThis issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.", "affected": [{"ra [...]
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-61400.cve.json b/projects/cloudstack/CVE-2026-61400.cve.json
new file mode 100644
index 00000000..1833b1f6
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-61400.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Get and Run Diagnostics Command Injection",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')",
+ "lang": "en",
+ "cweId": "CWE-77",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.14.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers.\n\nAn authenticated user holding the permissions required to invoke either `getDiagnosticsData` or `runDiagnostics` can achieve arbitrary command execution on the system VM and/or Virtual Router instances, with commands running as root (or as the diagnostics-process user, [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers.<br><br>An authenticated user holding the permissions required to invoke either `getDiagnosticsData` or `runDiagnostics` can achieve arbitrary command execution on the system VM and/or Virtual Router instances, with commands running as root (or as the diagnostics-pro [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "\u0141ukasz Bawolski <Lu...@exea.pl>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-61400",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-61400.osv.json b/projects/cloudstack/CVE-2026-61400.osv.json
new file mode 100644
index 00000000..eed7eb91
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-61400.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-61400", "summary": "Get and Run Diagnostics Command Injection", "details": "Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers.\n\nAn authenticated user holding the permissions required to invoke either `getDiagnosticsData` or `runDiagnostics` can achieve arbitrary command execution on the system VM [...]
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-61422.cve.json b/projects/cloudstack/CVE-2026-61422.cve.json
new file mode 100644
index 00000000..ef81cdc0
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-61422.cve.json
@@ -0,0 +1,94 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Authenticated pre-validation SSRF in registerTemplate",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-918 Server-Side Request Forgery (SSRF)",
+ "lang": "en",
+ "cweId": "CWE-918",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality.\n\nWhen registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validation is performed. However, this does not pose a malicious template or ISO registration risk, as URL validation still occurs prior to the actual download by the Secondary Stor [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality.<br><br>When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validation is performed. However, this does not pose a malicious template or ISO registration risk, as URL validation still occurs prior to the actual download by the Second [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Yuliang Xiao <xy...@outlook.com>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-61422",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-61422.osv.json b/projects/cloudstack/CVE-2026-61422.osv.json
new file mode 100644
index 00000000..9a7fa157
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-61422.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-61422", "summary": "Authenticated pre-validation SSRF in registerTemplate", "details": "Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality.\n\nWhen registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validation is performed. However, this does not pose a malicious temp [...]
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-62440.cve.json b/projects/cloudstack/CVE-2026-62440.cve.json
new file mode 100644
index 00000000..4f70ab0d
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-62440.cve.json
@@ -0,0 +1,94 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Improper access control in Kubernetes Service (CKS) cluster manipulation",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-284 Improper Access Control",
+ "lang": "en",
+ "cweId": "CWE-284",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes.\n\nThis issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.22.1.1 or later, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes.</p><p>This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.22.1.1 or later, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "George Chen (GitHub: geo-chen)",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "D0HY30N (GitHub: D0HY30N)",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-62440",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-62440.osv.json b/projects/cloudstack/CVE-2026-62440.osv.json
new file mode 100644
index 00000000..6242fa95
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-62440.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-62440", "summary": "Improper access control in Kubernetes Service (CKS) cluster manipulation", "details": "Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes.\n\nThis issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.22.1.1 or later, which fixes th [...]
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-65613.cve.json b/projects/cloudstack/CVE-2026-65613.cve.json
new file mode 100644
index 00000000..f7414d1e
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-65613.cve.json
@@ -0,0 +1,105 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Webhook Deliveries Incorrect Access",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
+ "lang": "en",
+ "cweId": "CWE-200",
+ "type": "CWE"
+ }
+ ]
+ },
+ {
+ "descriptions": [
+ {
+ "description": "CWE-284 Improper Access Control",
+ "lang": "en",
+ "cweId": "CWE-284",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.20.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries.\n\nThis issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries.</p><p>This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "\u0141ukasz Bawolski <Lu...@exea.pl>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-65613",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-65613.osv.json b/projects/cloudstack/CVE-2026-65613.osv.json
new file mode 100644
index 00000000..0d3801e3
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-65613.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-65613", "summary": "Webhook Deliveries Incorrect Access", "details": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries.\n\nThis issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\nUsers are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.", "affected": [{"ra [...]
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-66721.cve.json b/projects/cloudstack/CVE-2026-66721.cve.json
new file mode 100644
index 00000000..9a4ecd3d
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-66721.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Authorization issue with listHostTags for domain admins",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-862 Missing Authorization",
+ "lang": "en",
+ "cweId": "CWE-862",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.12.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Missing authorization issue for domain admins in CloudStack's host tags listing functionality.\n\n\n\n\nDomain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only the hosts dedicated to that admin's domain.\n\n\n\n\nThis issue affects Apache CloudStack: from 4.12.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.\n\n\n\n\n [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<div>Missing authorization issue for domain admins in CloudStack's host tags listing functionality.</div><div><br></div><div>Domain Admins, by default, have permission to call the <code>listHostTags</code> API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only the hosts dedicated to that admin's domain.</div><div><br></div><div>This issue affects Apache CloudStack: from 4.12.0.0 through [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "KQ Wu <kq...@163.com>",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-66721",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-66721.osv.json b/projects/cloudstack/CVE-2026-66721.osv.json
new file mode 100644
index 00000000..41cfa40c
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-66721.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-66721", "summary": "Authorization issue with listHostTags for domain admins", "details": "Missing authorization issue for domain admins in CloudStack's host tags listing functionality.\n\n\n\n\nDomain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only the hosts dedicated to that admin's domain.\n\n\n\n\n [...]
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-66722.cve.json b/projects/cloudstack/CVE-2026-66722.cve.json
new file mode 100644
index 00000000..d3bd7079
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-66722.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "ProjectRole & ProjectRolePermission authorization issue",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-285 Improper Authorization",
+ "lang": "en",
+ "cweId": "CWE-285",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.15.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack.\n\n\n\n\nA Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the caller is a Domain Admin, without verifying whether the target project belongs to their domain or subdomain. This allows a malicious Domain Admin to tamper with project r [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<div>Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack.</div><div><br></div><div>A Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the caller is a Domain Admin, without verifying whether the target project belongs to their domain or subdomain. This allows a malicious Domain Admin [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "KQ Wu <kq...@163.com>",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-66722",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-66722.osv.json b/projects/cloudstack/CVE-2026-66722.osv.json
new file mode 100644
index 00000000..f8a0f1f5
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-66722.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-66722", "summary": "ProjectRole & ProjectRolePermission authorization issue", "details": "Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack.\n\n\n\n\nA Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the caller is a Domain Admin, without verifying whether the [...]
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-66797.cve.json b/projects/cloudstack/CVE-2026-66797.cve.json
new file mode 100644
index 00000000..13df1f0c
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-66797.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Unauthorised comment creation and disclosure",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-284 Improper Access Control",
+ "lang": "en",
+ "cweId": "CWE-284",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.16.0.0",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Improper access control in CloudStack's annotation functionality allows unauthorized\u00a0comment creation and disclosure.\n\n\n\n\nThe addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user write annotations to, and disclose existing annotations/comments on, an entity they don't own by simply supplying its UUID.\n\n\n\n\nThis issue affects Apache Clo [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<div>Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure.</div><div><br></div><div>The <code>addAnnotation</code> and <code>listAnnotation</code> APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user write annotations to, and disclose existing annotations/comments on, an entity they don't own by simply supplyi [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "\u0141ukasz Bawolski <lu...@exea.pl>",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-66797",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-66797.osv.json b/projects/cloudstack/CVE-2026-66797.osv.json
new file mode 100644
index 00000000..5f0a4f13
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-66797.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-66797", "summary": "Unauthorised comment creation and disclosure", "details": "Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure.\n\n\n\n\nThe addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user write annotations to, and disclose existing annotations/comments [...]
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-68745.cve.json b/projects/cloudstack/CVE-2026-68745.cve.json
new file mode 100644
index 00000000..4f7b4eb2
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-68745.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "SAML2 Signature Validation Silently Skipped for Cert-less IdP",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-347 Improper Verification of Cryptographic Signature",
+ "lang": "en",
+ "cweId": "CWE-347",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache CloudStack",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.5.2",
+ "lessThanOrEqual": "4.20.3.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.21.0.0",
+ "lessThanOrEqual": "4.22.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server. The agent will have to spoof the ip address of the IdP or get an url of its own choosing registered in the management server, after which it can allow logging on with forged signatures.\n\nUsers are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 and above, which fix this issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server. The agent will have to spoof the ip address of the IdP or get an url of its own choosing registered in the management server, after which it can allow logging on with forged signatures.<br><br>Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 and above, which fi [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Katriel Moses <ka...@gmail.com>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-68745",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/cloudstack/CVE-2026-68745.osv.json b/projects/cloudstack/CVE-2026-68745.osv.json
new file mode 100644
index 00000000..5ffc4423
--- /dev/null
+++ b/projects/cloudstack/CVE-2026-68745.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-68745", "summary": "SAML2 Signature Validation Silently Skipped for Cert-less IdP", "details": "Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server. The agent will have to spoof the ip address of the IdP or get an url of its own choosing registered in the management server, after which it can allow logging on [...]
\ No newline at end of file
diff --git a/projects/cloudstack/index.html b/projects/cloudstack/index.html
index b533aa9a..cf97f53a 100644
--- a/projects/cloudstack/index.html
+++ b/projects/cloudstack/index.html
@@ -109,56 +109,432 @@
</ul>
<h1 id="advisories">Advisories</h1>
<p class="bg-warning">This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the project security page linked above. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public <a href="/mailinglist">mailinglist</a> or privately on <a href="mailto:security@apache.org">security@apache.org</a></p>
+<h2 id="CVE-2026-68745">SAML2 Signature Validation Silently Skipped for Cert-less IdP</h2>
+<p>CVE-2026-68745 <a href="https://cve.org/CVERecord?id=CVE-2026-68745">[CVE]</a> <a href="./CVE-2026-68745.cve.json">[CVE json]</a> <a href="./CVE-2026-68745.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-21T08:21:27.609Z</em></p>
+<h3 id="affected">Affected</h3>
+<ul>
+<li>Apache CloudStack from 4.5.2 through 4.20.3.0</li>
+<li>Apache CloudStack from 4.21.0.0 through 4.22.1.0</li>
+</ul>
+<h3 id="description">Description</h3>
+<p>Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server. The agent will have to spoof the ip address of the IdP or get an url of its own choosing registered in the management server, after which it can allow logging on with forged signatures.<br><br>Users are recommended to upgrade to versions 4.20.3.1 or 4.22.1.1 and above, which fix this issue.</p>
+<h3 id="references">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc">https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc</a></li>
+</ul>
+<h3 id="credits">Credits</h3>
+<ul>
+<li>Katriel Moses <a href="mailto:katriel.moses@gmail.com">katriel.moses@gmail.com</a> (reporter)</li>
+</ul>
+<h2 id="CVE-2026-66797">Unauthorised comment creation and disclosure</h2>
+<p>CVE-2026-66797 <a href="https://cve.org/CVERecord?id=CVE-2026-66797">[CVE]</a> <a href="./CVE-2026-66797.cve.json">[CVE json]</a> <a href="./CVE-2026-66797.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-21T08:21:57.156Z</em></p>
+<h3 id="affected-1">Affected</h3>
+<ul>
+<li>Apache CloudStack from 4.16.0.0 through 4.20.3.0</li>
+<li>Apache CloudStack from 4.21.0.0 through 4.22.1.0</li>
+</ul>
+<h3 id="description-1">Description</h3>
+<div>Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure.</div><div><br></div><div>The <code>addAnnotation</code> and <code>listAnnotation</code> APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user write annotations to, and disclose existing annotations/comments on, an entity they don't own by simply supplying its UUID.</div><div>< [...]
+<h3 id="references-1">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc">https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc</a></li>
+</ul>
+<h3 id="credits-1">Credits</h3>
+<ul>
+<li>Łukasz Bawolski <a href="mailto:lukasz.bawolski@exea.pl">lukasz.bawolski@exea.pl</a> (finder)</li>
+</ul>
+<h2 id="CVE-2026-66722">ProjectRole & ProjectRolePermission authorization issue</h2>
+<p>CVE-2026-66722 <a href="https://cve.org/CVERecord?id=CVE-2026-66722">[CVE]</a> <a href="./CVE-2026-66722.cve.json">[CVE json]</a> <a href="./CVE-2026-66722.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-21T08:22:35.208Z</em></p>
+<h3 id="affected-2">Affected</h3>
+<ul>
+<li>Apache CloudStack from 4.15.0.0 through 4.20.3.0</li>
+<li>Apache CloudStack from 4.21.0.0 through 4.22.1.0</li>
+</ul>
+<h3 id="description-2">Description</h3>
+<div>Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack.</div><div><br></div><div>A Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the caller is a Domain Admin, without verifying whether the target project belongs to their domain or subdomain. This allows a malicious Domain Admin to tamper with project [...]
+<h3 id="references-2">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc">https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc</a></li>
+</ul>
+<h3 id="credits-2">Credits</h3>
+<ul>
+<li>KQ Wu <a href="mailto:kqmailbox@163.com">kqmailbox@163.com</a> (finder)</li>
+</ul>
+<h2 id="CVE-2026-66721">Authorization issue with listHostTags for domain admins</h2>
+<p>CVE-2026-66721 <a href="https://cve.org/CVERecord?id=CVE-2026-66721">[CVE]</a> <a href="./CVE-2026-66721.cve.json">[CVE json]</a> <a href="./CVE-2026-66721.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-21T08:22:59.422Z</em></p>
+<h3 id="affected-3">Affected</h3>
+<ul>
+<li>Apache CloudStack from 4.12.0.0 through 4.20.3.0</li>
+<li>Apache CloudStack from 4.21.0.0 through 4.22.1.0</li>
+</ul>
+<h3 id="description-3">Description</h3>
+<div>Missing authorization issue for domain admins in CloudStack's host tags listing functionality.</div><div><br></div><div>Domain Admins, by default, have permission to call the <code>listHostTags</code> API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only the hosts dedicated to that admin's domain.</div><div><br></div><div>This issue affects Apache CloudStack: from 4.12.0.0 through 4.20.3.0 and from 4.21.0 [...]
+<h3 id="references-3">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc">https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc</a></li>
+</ul>
+<h3 id="credits-3">Credits</h3>
+<ul>
+<li>KQ Wu <a href="mailto:kqmailbox@163.com">kqmailbox@163.com</a> (finder)</li>
+</ul>
+<h2 id="CVE-2026-65613">Webhook Deliveries Incorrect Access</h2>
+<p>CVE-2026-65613 <a href="https://cve.org/CVERecord?id=CVE-2026-65613">[CVE]</a> <a href="./CVE-2026-65613.cve.json">[CVE json]</a> <a href="./CVE-2026-65613.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-21T08:23:29.878Z</em></p>
+<h3 id="affected-4">Affected</h3>
+<ul>
+<li>Apache CloudStack from 4.20.0.0 through 4.20.3.0</li>
+<li>Apache CloudStack from 4.21.0.0 through 4.22.1.0</li>
+</ul>
+<h3 id="description-4">Description</h3>
+<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries.</p><p>This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>
+<h3 id="references-4">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc">https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc</a></li>
+</ul>
+<h3 id="credits-4">Credits</h3>
+<ul>
+<li>Łukasz Bawolski <a href="mailto:Lukasz.Bawolski@exea.pl">Lukasz.Bawolski@exea.pl</a> (reporter)</li>
+</ul>
+<h2 id="CVE-2026-62440">Improper access control in Kubernetes Service (CKS) cluster manipulation</h2>
+<p>CVE-2026-62440 <a href="https://cve.org/CVERecord?id=CVE-2026-62440">[CVE]</a> <a href="./CVE-2026-62440.cve.json">[CVE json]</a> <a href="./CVE-2026-62440.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-21T08:23:54.134Z</em></p>
+<h3 id="affected-5">Affected</h3>
+<ul>
+<li>Apache CloudStack from 4.21.0.0 through 4.22.1.0</li>
+</ul>
+<h3 id="description-5">Description</h3>
+<p>Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes.</p><p>This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.22.1.1 or later, which fixes the issue.</p>
+<h3 id="references-5">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc">https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc</a></li>
+</ul>
+<h3 id="credits-5">Credits</h3>
+<ul>
+<li>George Chen (GitHub: geo-chen) (reporter)</li>
+<li>D0HY30N (GitHub: D0HY30N) (reporter)</li>
+</ul>
+<h2 id="CVE-2026-61422">Authenticated pre-validation SSRF in registerTemplate</h2>
+<p>CVE-2026-61422 <a href="https://cve.org/CVERecord?id=CVE-2026-61422">[CVE]</a> <a href="./CVE-2026-61422.cve.json">[CVE json]</a> <a href="./CVE-2026-61422.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-21T08:24:36.997Z</em></p>
+<h3 id="affected-6">Affected</h3>
+<ul>
+<li>Apache CloudStack at 4.20.3.0</li>
+<li>Apache CloudStack from 4.21.0.0 through 4.22.1.0</li>
+</ul>
+<h3 id="description-6">Description</h3>
+<p>Authenticated pre-validation SSRF vulnerability in Apache CloudStack’s template and ISO registration functionality.<br><br>When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validation is performed. However, this does not pose a malicious template or ISO registration risk, as URL validation still occurs prior to the actual download by the Secondary Storage VM. [...]
+<h3 id="references-6">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc">https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc</a></li>
+</ul>
+<h3 id="credits-6">Credits</h3>
+<ul>
+<li>Yuliang Xiao <a href="mailto:xyl1509410143@outlook.com">xyl1509410143@outlook.com</a> (reporter)</li>
+</ul>
+<h2 id="CVE-2026-61400">Get and Run Diagnostics Command Injection</h2>
+<p>CVE-2026-61400 <a href="https://cve.org/CVERecord?id=CVE-2026-61400">[CVE]</a> <a href="./CVE-2026-61400.cve.json">[CVE json]</a> <a href="./CVE-2026-61400.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-21T08:25:01.740Z</em></p>
+<h3 id="affected-7">Affected</h3>
+<ul>
+<li>Apache CloudStack from 4.14.0.0 through 4.20.3.0</li>
+<li>Apache CloudStack from 4.21.0.0 through 4.22.1.0</li>
+</ul>
+<h3 id="description-7">Description</h3>
+<p>Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers.<br><br>An authenticated user holding the permissions required to invoke either `getDiagnosticsData` or `runDiagnostics` can achieve arbitrary command execution on the system VM and/or Virtual Router instances, with commands running as root (or as the diagnostics-process user, at minimum). [...]
+<h3 id="references-7">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc">https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc</a></li>
+</ul>
+<h3 id="credits-7">Credits</h3>
+<ul>
+<li>Łukasz Bawolski <a href="mailto:Lukasz.Bawolski@exea.pl">Lukasz.Bawolski@exea.pl</a> (reporter)</li>
+</ul>
+<h2 id="CVE-2026-61399">Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI</h2>
+<p>CVE-2026-61399 <a href="https://cve.org/CVERecord?id=CVE-2026-61399">[CVE]</a> <a href="./CVE-2026-61399.cve.json">[CVE json]</a> <a href="./CVE-2026-61399.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-21T08:25:22.261Z</em></p>
+<h3 id="affected-8">Affected</h3>
+<ul>
+<li>Apache CloudStack from 4.20.0.0 through 4.20.3.0</li>
+<li>Apache CloudStack from 4.21.0.0 through 4.22.1.0</li>
+</ul>
+<h3 id="description-8">Description</h3>
+<p>Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality.</p><p>This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>
+<h3 id="references-8">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc">https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc</a></li>
+</ul>
+<h3 id="credits-8">Credits</h3>
+<ul>
+<li>Łukasz Bawolski <a href="mailto:Lukasz.Bawolski@exea.pl">Lukasz.Bawolski@exea.pl</a> (reporter)</li>
+</ul>
+<h2 id="CVE-2026-61398">Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI</h2>
+<p>CVE-2026-61398 <a href="https://cve.org/CVERecord?id=CVE-2026-61398">[CVE]</a> <a href="./CVE-2026-61398.cve.json">[CVE json]</a> <a href="./CVE-2026-61398.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-21T08:25:46.538Z</em></p>
+<h3 id="affected-9">Affected</h3>
+<ul>
+<li>Apache CloudStack from 4.15.1.0 through 4.20.3.0</li>
+<li>Apache CloudStack from 4.21.0.0 through 4.22.1.0</li>
+</ul>
+<h3 id="description-9">Description</h3>
+<p>Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality.</p><p>This issue affects Apache CloudStack: from 4.15.1.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>
+<h3 id="references-9">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc">https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc</a></li>
+</ul>
+<h3 id="credits-9">Credits</h3>
+<ul>
+<li>Łukasz Bawolski <a href="mailto:Lukasz.Bawolski@exea.pl">Lukasz.Bawolski@exea.pl</a> (reporter)</li>
+</ul>
+<h2 id="CVE-2026-61397">OAuth2 Token Cross-Request Leak</h2>
+<p>CVE-2026-61397 <a href="https://cve.org/CVERecord?id=CVE-2026-61397">[CVE]</a> <a href="./CVE-2026-61397.cve.json">[CVE json]</a> <a href="./CVE-2026-61397.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-21T08:26:22.132Z</em></p>
+<h3 id="affected-10">Affected</h3>
+<ul>
+<li>Apache CloudStack from 4.19.0.0 through 4.20.3.0</li>
+<li>Apache CloudStack from 4.21.0.0 through 4.22.1.0</li>
+</ul>
+<h3 id="description-10">Description</h3>
+<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration.</p><p>This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1, which fixes the issue.</p>
+<h3 id="references-10">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc">https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc</a></li>
+</ul>
+<h3 id="credits-10">Credits</h3>
+<ul>
+<li>Katriel Moses <a href="mailto:katriel.moses@gmail.com">katriel.moses@gmail.com</a> (reporter)</li>
+<li>“Network and Cloud Laboratory (NaCl) KMITL” <a href="mailto:nacl@kmitl.ac.th">nacl@kmitl.ac.th</a> (reporter)</li>
+<li>Paratpanu Pechsaman <a href="mailto:66010542@kmitl.ac.th">66010542@kmitl.ac.th</a> (analyst)</li>
+<li>Nutthawat Charoensiriphong <a href="mailto:68010321@kmitl.ac.th">68010321@kmitl.ac.th</a> (analyst)</li>
+<li>Panabordee Panitchakit <a href="mailto:68010697@kmitl.ac.th">68010697@kmitl.ac.th</a> (analyst)</li>
+</ul>
+<h2 id="CVE-2026-59799">Missing Privilege Check in Two-Factor Authentication Disable Flow</h2>
+<p>CVE-2026-59799 <a href="https://cve.org/CVERecord?id=CVE-2026-59799">[CVE]</a> <a href="./CVE-2026-59799.cve.json">[CVE json]</a> <a href="./CVE-2026-59799.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-21T08:26:50.990Z</em></p>
+<h3 id="affected-11">Affected</h3>
+<ul>
+<li>Apache CloudStack from 4.18.0.0 through 4.20.3.0</li>
+<li>Apache CloudStack from 4.21.0.0 through 4.22.1.0</li>
+</ul>
+<h3 id="description-11">Description</h3>
+<p>Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow.</p><p>This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>
+<h3 id="references-11">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc">https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc</a></li>
+</ul>
+<h3 id="credits-11">Credits</h3>
+<ul>
+<li>Erichen <a href="mailto:chenyoulong20g@ict.ac.cn">chenyoulong20g@ict.ac.cn</a> (reporter)</li>
+</ul>
+<h2 id="CVE-2026-59780">LDAP provider configuration disclosure</h2>
+<p>CVE-2026-59780 <a href="https://cve.org/CVERecord?id=CVE-2026-59780">[CVE]</a> <a href="./CVE-2026-59780.cve.json">[CVE json]</a> <a href="./CVE-2026-59780.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-21T08:27:15.624Z</em></p>
+<h3 id="affected-12">Affected</h3>
+<ul>
+<li>Apache CloudStack from 4.2.0.0 through 4.20.3.0</li>
+<li>Apache CloudStack from 4.21.0.0 through 4.22.1.0</li>
+</ul>
+<h3 id="description-12">Description</h3>
+<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers.</p><p></p><div><div><div><div></div></div></div></div><div><div><div><div><div><div><div><p>LDAP configurations can be listed by any authenticated user with access to the <em>listLdapConfigurations</em> API. By default, this API is available to all default roles.</p></div></div></div></div></div></div></div><p></p><p>This issue affect [...]
+<h3 id="references-12">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc">https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc</a></li>
+</ul>
+<h3 id="credits-12">Credits</h3>
+<ul>
+<li>Łukasz Bawolski <a href="mailto:Lukasz.Bawolski@exea.pl">Lukasz.Bawolski@exea.pl</a> (reporter)</li>
+</ul>
+<h2 id="CVE-2026-59657">Sensitive Information Disclosure via Cleartext Storage in AsyncJob</h2>
+<p>CVE-2026-59657 <a href="https://cve.org/CVERecord?id=CVE-2026-59657">[CVE]</a> <a href="./CVE-2026-59657.cve.json">[CVE json]</a> <a href="./CVE-2026-59657.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-21T08:27:52.170Z</em></p>
+<h3 id="affected-13">Affected</h3>
+<ul>
+<li>Apache CloudStack from 4.0.0 through 4.20.3.0</li>
+<li>Apache CloudStack from 4.21.0.0 through 4.22.1.0</li>
+</ul>
+<h3 id="description-13">Description</h3>
+<p>Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database.</p><p>This issue affects Apache CloudStack: from 4.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>
+<h3 id="references-13">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc">https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc</a></li>
+</ul>
+<h3 id="credits-13">Credits</h3>
+<ul>
+<li>Davi Torres <a href="mailto:davift@gmail.com">davift@gmail.com</a> (reporter)</li>
+</ul>
+<h2 id="CVE-2026-59655">Unauthenticated OAuth provider client-secret disclosure</h2>
+<p>CVE-2026-59655 <a href="https://cve.org/CVERecord?id=CVE-2026-59655">[CVE]</a> <a href="./CVE-2026-59655.cve.json">[CVE json]</a> <a href="./CVE-2026-59655.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-21T08:28:13.175Z</em></p>
+<h3 id="affected-14">Affected</h3>
+<ul>
+<li>Apache CloudStack from 4.19.0.0 through 4.20.3.0</li>
+<li>Apache CloudStack from 4.21.0.0 through 4.22.1.0</li>
+</ul>
+<h3 id="description-14">Description</h3>
+<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers.</p><p>This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p>
+<h3 id="references-14">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc">https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc</a></li>
+</ul>
+<h3 id="credits-14">Credits</h3>
+<ul>
+<li>Yuliang Xiao <a href="mailto:xyl1509410143@outlook.com">xyl1509410143@outlook.com</a> (reporter)</li>
+<li>Stijn Simons <a href="mailto:stijn.simons@portofantwerpbruges.com">stijn.simons@portofantwerpbruges.com</a> (reporter)</li>
+</ul>
+<h2 id="CVE-2026-59654">DoS caused by database connections leak</h2>
+<p>CVE-2026-59654 <a href="https://cve.org/CVERecord?id=CVE-2026-59654">[CVE]</a> <a href="./CVE-2026-59654.cve.json">[CVE json]</a> <a href="./CVE-2026-59654.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-21T12:32:59.667Z</em></p>
+<h3 id="affected-15">Affected</h3>
+<ul>
+<li>Apache CloudStack from 4.7.0 through 4.20.3.0</li>
+<li>Apache CloudStack from 4.21.0.0 through 4.22.1.0</li>
+</ul>
+<h3 id="description-15">Description</h3>
+<p>Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service (DoS) scenario for the management server.</p><p>This issue affects Apache CloudStack: from 4.7.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.2 [...]
+<h3 id="references-15">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/7cgf37clcpjj4g2hl7rnyoq1th3ht9r4">https://lists.apache.org/thread/7cgf37clcpjj4g2hl7rnyoq1th3ht9r4</a></li>
+</ul>
+<h3 id="credits-15">Credits</h3>
+<ul>
+<li>Henrique Sato <a href="mailto:henriquesato2003@gmail.com">henriquesato2003@gmail.com</a> (reporter)</li>
+</ul>
+<h2 id="CVE-2026-59085">Server-Side Request Forgery (SSRF) vulnerability in webhook module</h2>
+<p>CVE-2026-59085 <a href="https://cve.org/CVERecord?id=CVE-2026-59085">[CVE]</a> <a href="./CVE-2026-59085.cve.json">[CVE json]</a> <a href="./CVE-2026-59085.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-21T08:28:50.341Z</em></p>
+<h3 id="affected-16">Affected</h3>
+<ul>
+<li>Apache CloudStack from 4.20.0.0 through 4.20.3.0</li>
+<li>Apache CloudStack from 4.21.0.0 through 4.22.1.0</li>
+</ul>
+<h3 id="description-16">Description</h3>
+<p></p><p>Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests.</p><p>This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p><p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p><p></p>
+<h3 id="references-16">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc">https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc</a></li>
+</ul>
+<h3 id="credits-16">Credits</h3>
+<ul>
+<li>Jonathan Leitschuh <a href="mailto:jonathan.leitschuh@gmail.com">jonathan.leitschuh@gmail.com</a> (finder)</li>
+<li>Łukasz Bawolski <a href="mailto:Lukasz.Bawolski@exea.pl">Lukasz.Bawolski@exea.pl</a> (finder)</li>
+<li>George Chen (GitHub: geo-chen) (finder)</li>
+</ul>
+<h2 id="CVE-2026-50222">Improper access control in Userdata reference APIs</h2>
+<p>CVE-2026-50222 <a href="https://cve.org/CVERecord?id=CVE-2026-50222">[CVE]</a> <a href="./CVE-2026-50222.cve.json">[CVE json]</a> <a href="./CVE-2026-50222.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-21T08:29:16.822Z</em></p>
+<h3 id="affected-17">Affected</h3>
+<ul>
+<li>Apache CloudStack from 4.18.0.0 through 4.20.3.0</li>
+<li>Apache CloudStack from 4.21.0.0 through 4.22.1.0</li>
+</ul>
+<h3 id="description-17">Description</h3>
+<p>Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs.</p><p>Several userdata-related APIs in Apache CloudStack, including <code>deleteUserData</code>, <code>linkUserDataToTemplate</code>, <code>resetUserDataForVirtualMachine</code>, <code>deployVirtualMachine</code>, and <code>updateVirtualMachine</code>, exhibit missing or insufficient access control validation, potentially allowing cross-tenant [...]
+<h3 id="references-17">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc">https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc</a></li>
+</ul>
+<h3 id="credits-17">Credits</h3>
+<ul>
+<li>Bernardo De Marco Gonçalves <a href="mailto:bernardomg2004@gmail.com">bernardomg2004@gmail.com</a> (reporter)</li>
+<li>Yuliang Xiao <a href="mailto:xyl1509410143@outlook.com">xyl1509410143@outlook.com</a> (reporter)</li>
+<li>Łukasz Bawolski <a href="mailto:Lukasz.Bawolski@exea.pl">Lukasz.Bawolski@exea.pl</a> (reporter)</li>
+<li>George Chen (GitHub: geo-chen) (reporter)</li>
+<li>KQ Wu <a href="mailto:kqmailbox@163.com">kqmailbox@163.com</a> (reporter)</li>
+</ul>
+<h2 id="CVE-2026-50112">RCE and SSRF in direct download, metalink and NFS templates</h2>
+<p>CVE-2026-50112 <a href="https://cve.org/CVERecord?id=CVE-2026-50112">[CVE]</a> <a href="./CVE-2026-50112.cve.json">[CVE json]</a> <a href="./CVE-2026-50112.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-21T08:29:39.850Z</em></p>
+<h3 id="affected-18">Affected</h3>
+<ul>
+<li>Apache CloudStack from 4.14.0.0 through 4.20.3.0</li>
+<li>Apache CloudStack from 4.21.0.0 through 4.22.1.0</li>
+</ul>
+<h3 id="description-18">Description</h3>
+<p><b>SSRF via Metalink Mirror URL Resolution:</b></p><p>An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal APIs.</p><p><b>RCE on KVM hypervisor via NFS, Metalink files with/without Direct Downloads:</b></p><p>An authenticated CloudStack tenant holding the default User role can execute ar [...]
+<h3 id="references-18">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc">https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc</a></li>
+</ul>
+<h3 id="credits-18">Credits</h3>
+<ul>
+<li>K (reporter)</li>
+<li>Samy Ghannad <a href="mailto:samy@samyghannad.com">samy@samyghannad.com</a> (reporter)</li>
+<li>Katriel Moses <a href="mailto:katriel.moses@gmail.com">katriel.moses@gmail.com</a> (reporter)</li>
+<li>Venkatraman Kumar <a href="mailto:venkatraman.kumar@securin.io">venkatraman.kumar@securin.io</a> (reporter)</li>
+<li>Łukasz Bawolski <a href="mailto:Lukasz.Bawolski@exea.pl">Lukasz.Bawolski@exea.pl</a> (reporter)</li>
+</ul>
+<h2 id="CVE-2026-47359">OS Command Injection due to unsanitized mount command</h2>
+<p>CVE-2026-47359 <a href="https://cve.org/CVERecord?id=CVE-2026-47359">[CVE]</a> <a href="./CVE-2026-47359.cve.json">[CVE json]</a> <a href="./CVE-2026-47359.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-08-21T08:30:06.507Z</em></p>
+<h3 id="affected-19">Affected</h3>
+<ul>
+<li>Apache CloudStack from 4.20.0.0 through 4.20.3.0</li>
+<li>Apache CloudStack from 4.21.0.0 through 4.22.1.0</li>
+</ul>
+<h3 id="description-19">Description</h3>
+<p>Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache CloudStack's NAS backup provider plugin. The addBackupRepository API (available since 4.20.0.0) and updateBackupRepository API (introduced in 4.22.0.0) accept unsanitized command options for the backup repository. A malicious operator account can exploit this to inject arbitrary commands that execute on the KVM hypervisor host when any account subsequently performs a [...]
+<h3 id="references-19">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc">https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc</a></li>
+</ul>
+<h3 id="credits-19">Credits</h3>
+<ul>
+<li>김우석 <a href="mailto:wooseokdotkim@gmail.com">wooseokdotkim@gmail.com</a> (reporter)</li>
+<li>Łukasz Bawolski <a href="mailto:Lukasz.Bawolski@exea.pl">Lukasz.Bawolski@exea.pl</a> (reporter)</li>
+</ul>
<h2 id="CVE-2026-25199">Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access</h2>
<p>CVE-2026-25199 <a href="https://cve.org/CVERecord?id=CVE-2026-25199">[CVE]</a> <a href="./CVE-2026-25199.cve.json">[CVE json]</a> <a href="./CVE-2026-25199.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-08T12:23:04.078Z</em></p>
-<h3 id="affected">Affected</h3>
+<h3 id="affected-20">Affected</h3>
<ul>
<li>Apache CloudStack from 4.21.0 through 4.22.0</li>
</ul>
-<h3 id="description">Description</h3>
+<h3 id="description-20">Description</h3>
<div>Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants.</div><div><br></div><div>This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.0.0.</div><div><br></div><div>The Proxmox extension for CloudStack improperly uses a user-editable instance setting, <code>proxmox_vmid</code>, to associate CloudStack instances with Proxmox virtual machines. Because this value is not restricted or validated against tenant ownership a [...]
-<h3 id="references">References</h3>
+<h3 id="references-20">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm">https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm</a></li>
</ul>
-<h3 id="credits">Credits</h3>
+<h3 id="credits-20">Credits</h3>
<ul>
<li>Sander Grendelman <a href="mailto:sander.grendelman@axians.com">sander.grendelman@axians.com</a> (reporter)</li>
</ul>
<h2 id="CVE-2026-25077">Unauthenticated Command Injection in Direct Download Templates</h2>
<p>CVE-2026-25077 <a href="https://cve.org/CVERecord?id=CVE-2026-25077">[CVE]</a> <a href="./CVE-2026-25077.cve.json">[CVE json]</a> <a href="./CVE-2026-25077.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-08T12:21:33.362Z</em></p>
-<h3 id="affected-1">Affected</h3>
+<h3 id="affected-21">Affected</h3>
<ul>
<li>Apache CloudStack from 4.11.0 through 4.20.2.0</li>
<li>Apache CloudStack from 4.21.0.0 through 4.22.0.0</li>
</ul>
-<h3 id="description-1">Description</h3>
+<h3 id="description-21">Description</h3>
<p>Account users are allowed by default to register templates to be downloaded directly to the primary storage for deploying instances using the KVM hypervisor. Due to missing file name sanitization, an attacker can register malicious templates to execute arbitrary code on the KVM hosts. This can result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of the KVM-based infrastructure managed by CloudStack.<br></p><p>Users are reco [...]
-<h3 id="references-1">References</h3>
+<h3 id="references-21">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm">https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm</a></li>
</ul>
-<h3 id="credits-1">Credits</h3>
+<h3 id="credits-21">Credits</h3>
<ul>
<li>Reza at HazardLab (<a href="https://hazardlab.ninja">https://hazardlab.ninja</a>) (reporter)</li>
</ul>
<h2 id="CVE-2025-69233">Domain/account resources limits not honored</h2>
<p>CVE-2025-69233 <a href="https://cve.org/CVERecord?id=CVE-2025-69233">[CVE]</a> <a href="./CVE-2025-69233.cve.json">[CVE json]</a> <a href="./CVE-2025-69233.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-08T12:19:36.271Z</em></p>
-<h3 id="affected-2">Affected</h3>
+<h3 id="affected-22">Affected</h3>
<ul>
<li>Apache CloudStack from 4.0.0 through 4.20.2.0</li>
<li>Apache CloudStack from 4.21.0.0 through 4.22.0.0</li>
</ul>
-<h3 id="description-2">Description</h3>
+<h3 id="description-22">Description</h3>
<p>Due to multiple time-of-check time-of-use race conditions in the resource count check and increment logic, as well as missing validations, users of the platform are able to exceed the allocation limits configured for their accounts/domains. This can be used by an attacker to degrade the infrastructure’s resources and lead to denial of service conditions.<br><br>Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.</p>
-<h3 id="references-2">References</h3>
+<h3 id="references-22">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm">https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm</a></li>
</ul>
-<h3 id="credits-2">Credits</h3>
+<h3 id="credits-22">Credits</h3>
<ul>
<li>Fernando Oliveira <a href="mailto:ferolicar82@gmail.com">ferolicar82@gmail.com</a> (reporter)</li>
<li>Gustavo Viana <a href="mailto:viana.gust@gmail.com">viana.gust@gmail.com</a> (reporter)</li>
@@ -166,52 +542,52 @@
<h2 id="CVE-2025-66467">MinIO policy remains intact on bucket deletion</h2>
<p>CVE-2025-66467 <a href="https://cve.org/CVERecord?id=CVE-2025-66467">[CVE]</a> <a href="./CVE-2025-66467.cve.json">[CVE json]</a> <a href="./CVE-2025-66467.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-08T12:16:09.128Z</em></p>
-<h3 id="affected-3">Affected</h3>
+<h3 id="affected-23">Affected</h3>
<ul>
<li>Apache CloudStack from 4.19.0.0 through 4.20.2.0</li>
<li>Apache CloudStack from 4.21.0.0 through 4.22.0.0</li>
</ul>
-<h3 id="description-3">Description</h3>
+<h3 id="description-23">Description</h3>
<p>Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain access to buckets which they previously owned. If another user creates a new bucket with the same name, the previous owners can gain unauthorized read and write access to it by using the previously generated access and secret keys.<br><br>Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.</p>
-<h3 id="references-3">References</h3>
+<h3 id="references-23">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm">https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm</a></li>
</ul>
-<h3 id="credits-3">Credits</h3>
+<h3 id="credits-23">Credits</h3>
<ul>
<li>Roman Kozello <a href="mailto:roman.kozello@gmail.com">roman.kozello@gmail.com</a> (reporter)</li>
</ul>
<h2 id="CVE-2025-66172">Any user can attach a volume in their VMs from backups they should not have access to</h2>
<p>CVE-2025-66172 <a href="https://cve.org/CVERecord?id=CVE-2025-66172">[CVE]</a> <a href="./CVE-2025-66172.cve.json">[CVE json]</a> <a href="./CVE-2025-66172.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-08T12:13:30.758Z</em></p>
-<h3 id="affected-4">Affected</h3>
+<h3 id="affected-24">Affected</h3>
<ul>
<li>Apache CloudStack from 4.21.0.0 through 4.22.0.0</li>
</ul>
-<h3 id="description-4">Description</h3>
+<h3 id="description-24">Description</h3>
<p>The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and have access to specific APIs can restore a volume from any other user’s backups and attach the volume to their own VMs.<br><br>Backup plugin users using CloudStack 4.21.0.0+ are recommended to upgrade to CloudStack version 4.22.0.1, which fixes this issue.</p>
-<h3 id="references-4">References</h3>
+<h3 id="references-24">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm">https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm</a></li>
</ul>
-<h3 id="credits-4">Credits</h3>
+<h3 id="credits-24">Credits</h3>
<ul>
<li>Gabriel Pordeus (reporter)</li>
</ul>
<h2 id="CVE-2025-66171">Any user can create a new VM from backups they should not have access to</h2>
<p>CVE-2025-66171 <a href="https://cve.org/CVERecord?id=CVE-2025-66171">[CVE]</a> <a href="./CVE-2025-66171.cve.json">[CVE json]</a> <a href="./CVE-2025-66171.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-08T12:11:10.736Z</em></p>
-<h3 id="affected-5">Affected</h3>
+<h3 id="affected-25">Affected</h3>
<ul>
<li>Apache CloudStack from 4.21.0.0 through 4.22.0.0</li>
</ul>
-<h3 id="description-5">Description</h3>
+<h3 id="description-25">Description</h3>
<p>The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and have access to specific APIs can create new VMs using backups of any other user of the environment.<br><br>Backup plugin users using CloudStack 4.21.0.0+ are recommended to upgrade to CloudStack version 4.22.0.1, which fixes this issue.</p>
-<h3 id="references-5">References</h3>
+<h3 id="references-25">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm">https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm</a></li>
</ul>
-<h3 id="credits-5">Credits</h3>
+<h3 id="credits-25">Credits</h3>
<ul>
<li>Fabricio Duarte <a href="mailto:fabricio.duarte.jr@gmail.com">fabricio.duarte.jr@gmail.com</a> (reporter)</li>
<li>Gabriel Ortiga Fernandes <a href="mailto:gabriel.ortiga@hotmail.com">gabriel.ortiga@hotmail.com</a> (reporter)</li>
@@ -220,17 +596,17 @@
<h2 id="CVE-2025-66170">Any user can list backups that they should not have access to</h2>
<p>CVE-2025-66170 <a href="https://cve.org/CVERecord?id=CVE-2025-66170">[CVE]</a> <a href="./CVE-2025-66170.cve.json">[CVE json]</a> <a href="./CVE-2025-66170.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-08T12:06:38.994Z</em></p>
-<h3 id="affected-6">Affected</h3>
+<h3 id="affected-26">Affected</h3>
<ul>
<li>Apache CloudStack from 4.21.0.0 through 4.22.0.0</li>
</ul>
-<h3 id="description-6">Description</h3>
+<h3 id="description-26">Description</h3>
<p></p>The CloudStack Backup plugin has an improper authorization logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and has access to specific APIs can list backups from any account in the environment. This vulnerability does not allow them to see the contents of the backup.<p></p><p>Users are recommended to upgrade to version 4.22.0.1, which fixes the issue.</p>
-<h3 id="references-6">References</h3>
+<h3 id="references-26">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm">https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm</a></li>
</ul>
-<h3 id="credits-6">Credits</h3>
+<h3 id="credits-26">Credits</h3>
<ul>
<li>Gabriel Ortiga Fernandes <a href="mailto:gabriel.ortiga@hotmail.com">gabriel.ortiga@hotmail.com</a> (reporter)</li>
<li>Fabricio Duarte <a href="mailto:fabricio.duarte.jr@gmail.com">fabricio.duarte.jr@gmail.com</a> (reporter)</li>
@@ -239,12 +615,12 @@
<h2 id="CVE-2025-59454">Lack of user permission validation leading to data leak for few APIs</h2>
<p>CVE-2025-59454 <a href="https://cve.org/CVERecord?id=CVE-2025-59454">[CVE]</a> <a href="./CVE-2025-59454.cve.json">[CVE json]</a> <a href="./CVE-2025-59454.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-11-27T11:40:37.834Z</em></p>
-<h3 id="affected-7">Affected</h3>
+<h3 id="affected-27">Affected</h3>
<ul>
<li>Apache CloudStack from 4.0.0 before 4.20.2</li>
<li>Apache CloudStack from 4.21.0 before 4.22.0</li>
</ul>
-<h3 id="description-7">Description</h3>
+<h3 id="description-27">Description</h3>
<p>In Apache CloudStack, a gap in access control checks affected the APIs <pre>- createNetworkACL</p>
<ul>
<li>listNetworkACLs</li>
@@ -252,49 +628,49 @@
<li>listVirtualMachinesUsageHistory</li>
<li>listVolumesUsageHistory</pre><div>While these APIs were accessible only to authorized users, insufficient permission validation meant that users could occasionally access information beyond their intended scope.</div><div><br></div><div>Users are recommended to upgrade to Apache CloudStack 4.20.2.0 or 4.22.0.0, which fixes the issue.</div></li>
</ul>
-<h3 id="references-7">References</h3>
+<h3 id="references-27">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/0hlklvlwhzsfw39nocmyxb6svjbs9xbc">https://lists.apache.org/thread/0hlklvlwhzsfw39nocmyxb6svjbs9xbc</a></li>
</ul>
-<h3 id="credits-7">Credits</h3>
+<h3 id="credits-27">Credits</h3>
<ul>
<li><a href="mailto:bugreporter@qq.com">bugreporter@qq.com</a> <a href="https://github.com/ai-bugreporter/Credits">https://github.com/ai-bugreporter/Credits</a> (finder)</li>
</ul>
<h2 id="CVE-2025-59302">Potential remote code execution on Javascript engine defined rules</h2>
<p>CVE-2025-59302 <a href="https://cve.org/CVERecord?id=CVE-2025-59302">[CVE]</a> <a href="./CVE-2025-59302.cve.json">[CVE json]</a> <a href="./CVE-2025-59302.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-11-27T11:46:23.798Z</em></p>
-<h3 id="affected-8">Affected</h3>
+<h3 id="affected-28">Affected</h3>
<ul>
<li>Apache CloudStack from 4.18.0 before 4.20.2</li>
<li>Apache CloudStack from 4.21.0 before 4.22.0</li>
</ul>
-<h3 id="description-8">Description</h3>
+<h3 id="description-28">Description</h3>
<p>In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins.</p><ul><li>quotaTariffCreate</li><li>quotaTariffUpdate</li><li>createSecondaryStorageSelector</li><li>updateSecondaryStorageSelector</li><li>updateHost</li><li>updateStorage</li></ul><p>This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions [...]
-<h3 id="references-8">References</h3>
+<h3 id="references-28">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/kwwsg2j85f1b75o0ht5zbr34d7h66788">https://lists.apache.org/thread/kwwsg2j85f1b75o0ht5zbr34d7h66788</a></li>
</ul>
-<h3 id="credits-8">Credits</h3>
+<h3 id="credits-28">Credits</h3>
<ul>
<li>Tianyi Cheng <a href="mailto:chengtianyi@huawei.com">chengtianyi@huawei.com</a> (finder)</li>
</ul>
<h2 id="CVE-2025-47849">Insecure access of user’s API/Secret Keys in the same domain</h2>
<p>CVE-2025-47849 <a href="https://cve.org/CVERecord?id=CVE-2025-47849">[CVE]</a> <a href="./CVE-2025-47849.cve.json">[CVE json]</a> <a href="./CVE-2025-47849.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-06-11T03:59:42.176Z</em></p>
-<h3 id="affected-9">Affected</h3>
+<h3 id="affected-29">Affected</h3>
<ul>
<li>Apache CloudStack from 4.10.0 before 4.19.3.0</li>
<li>Apache CloudStack from 4.20.0.0 before 4.20.1.0</li>
</ul>
-<h3 id="description-9">Description</h3>
+<h3 id="description-29">Description</h3>
<div><span style="background-color: rgba(232, 232, 232, 0.04);"><span style="background-color: rgba(232, 232, 232, 0.04);">A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can get the API key and secret key of user-accounts of Admin role type in the same domain. This operation is not appropriately restricted and allows the attacker to assume control over higher-privileged user-accoun [...]
-<h3 id="references-9">References</h3>
+<h3 id="references-29">References</h3>
<ul>
<li><a href="https://cloudstack.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0/">https://cloudstack.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0/</a></li>
<li><a href="https://www.shapeblue.com/shapeblue-security-advisory-cloudstack-4-19-3-0-and-4-20-1-0/">https://www.shapeblue.com/shapeblue-security-advisory-cloudstack-4-19-3-0-and-4-20-1-0/</a></li>
<li><a href="https://lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60">https://lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60</a></li>
</ul>
-<h3 id="credits-9">Credits</h3>
+<h3 id="credits-29">Credits</h3>
<ul>
<li>Kevin Li <a href="mailto:kli74@apple.com">kli74@apple.com</a> (finder)</li>
<li>Scott Schmitz <a href="mailto:sschmitz@ussignal.com">sschmitz@ussignal.com</a> (finder)</li>
@@ -302,96 +678,96 @@
<h2 id="CVE-2025-47713">Domain Admin can reset Admin password in Root Domain</h2>
<p>CVE-2025-47713 <a href="https://cve.org/CVERecord?id=CVE-2025-47713">[CVE]</a> <a href="./CVE-2025-47713.cve.json">[CVE json]</a> <a href="./CVE-2025-47713.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-06-11T03:59:55.628Z</em></p>
-<h3 id="affected-10">Affected</h3>
+<h3 id="affected-30">Affected</h3>
<ul>
<li>Apache CloudStack from 4.10.0 before 4.19.3.0</li>
<li>Apache CloudStack from 4.20.0.0 before 4.20.1.0</li>
</ul>
-<h3 id="description-10">Description</h3>
+<h3 id="description-30">Description</h3>
<p></p><div><span style="background-color: rgba(232, 232, 232, 0.04);">A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can reset the password of user-accounts of Admin role type. This operation is not appropriately restricted and allows the attacker to assume control over higher-privileged user-accounts. </span><span style="background-color: rgba(232, 232, 232, 0.04);">A malici [...]
-<h3 id="references-10">References</h3>
+<h3 id="references-30">References</h3>
<ul>
<li><a href="https://cloudstack.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0/">https://cloudstack.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0/</a></li>
<li><a href="https://www.shapeblue.com/shapeblue-security-advisory-cloudstack-4-19-3-0-and-4-20-1-0/">https://www.shapeblue.com/shapeblue-security-advisory-cloudstack-4-19-3-0-and-4-20-1-0/</a></li>
<li><a href="https://lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60">https://lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60</a></li>
</ul>
-<h3 id="credits-10">Credits</h3>
+<h3 id="credits-30">Credits</h3>
<ul>
<li>Scott Schmitz <a href="mailto:sschmitz@ussignal.com">sschmitz@ussignal.com</a> (finder)</li>
</ul>
<h2 id="CVE-2025-30675">Unauthorised template/ISO list access to the domain/resource admins</h2>
<p>CVE-2025-30675 <a href="https://cve.org/CVERecord?id=CVE-2025-30675">[CVE]</a> <a href="./CVE-2025-30675.cve.json">[CVE json]</a> <a href="./CVE-2025-30675.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-06-11T04:00:06.854Z</em></p>
-<h3 id="affected-11">Affected</h3>
+<h3 id="affected-31">Affected</h3>
<ul>
<li>Apache CloudStack from 4.0.0 before 4.19.3.0</li>
<li>Apache CloudStack from 4.20.0.0 before 4.20.1.0</li>
</ul>
-<h3 id="description-11">Description</h3>
+<h3 id="description-31">Description</h3>
<div><span style="background-color: rgba(232, 232, 232, 0.04);">In Apache CloudStack, a flaw in access control affects the listTemplates and listIsos APIs. A malicious Domain Admin or Resource Admin can exploit this issue by intentionally specifying the 'domainid' parameter along with the 'filter=self' or 'filter=selfexecutable' values. This allows the attacker to gain unauthorized visibility into templates and ISOs under the ROOT domain.</span></div><div><span style="background-color: r [...]
-<h3 id="references-11">References</h3>
+<h3 id="references-31">References</h3>
<ul>
<li><a href="https://cloudstack.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0/">https://cloudstack.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0/</a></li>
<li><a href="https://www.shapeblue.com/shapeblue-security-advisory-cloudstack-4-19-3-0-and-4-20-1-0/">https://www.shapeblue.com/shapeblue-security-advisory-cloudstack-4-19-3-0-and-4-20-1-0/</a></li>
<li><a href="https://lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60">https://lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60</a></li>
</ul>
-<h3 id="credits-11">Credits</h3>
+<h3 id="credits-31">Credits</h3>
<ul>
<li>Bernardo De Marco Gonçalves <a href="mailto:bernardomg2004@gmail.com">bernardomg2004@gmail.com</a> (finder)</li>
</ul>
<h2 id="CVE-2025-26521">CKS cluster in project exposes user API keys</h2>
<p>CVE-2025-26521 <a href="https://cve.org/CVERecord?id=CVE-2025-26521">[CVE]</a> <a href="./CVE-2025-26521.cve.json">[CVE json]</a> <a href="./CVE-2025-26521.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-06-11T04:00:17.648Z</em></p>
-<h3 id="affected-12">Affected</h3>
+<h3 id="affected-32">Affected</h3>
<ul>
<li>Apache CloudStack from 4.17.0.0 before 4.19.3.0</li>
<li>Apache CloudStack from 4.20.0.0 before 4.20.1.0</li>
</ul>
-<h3 id="description-12">Description</h3>
+<h3 id="description-32">Description</h3>
<p>When an Apache CloudStack user-account creates a CKS-based Kubernetes cluster in a project, the API key and the secret key of the ‘kubeadmin’ user of the caller account are used to create the secret config in the CKS-based Kubernetes cluster. A member of the project who can access the CKS-based Kubernetes cluster, can also access the API key and secret key of the ‘kubeadmin’ user of the CKS cluster’s creator’s account. An attacker who’s a memb [...]
-<h3 id="references-12">References</h3>
+<h3 id="references-32">References</h3>
<ul>
<li><a href="https://cloudstack.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0/">https://cloudstack.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0/</a></li>
<li><a href="https://www.shapeblue.com/shapeblue-security-advisory-cloudstack-4-19-3-0-and-4-20-1-0/">https://www.shapeblue.com/shapeblue-security-advisory-cloudstack-4-19-3-0-and-4-20-1-0/</a></li>
<li><a href="https://lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60">https://lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60</a></li>
</ul>
-<h3 id="credits-12">Credits</h3>
+<h3 id="credits-32">Credits</h3>
<ul>
<li>Wei Zhou (<a href="mailto:weizhou@apache.org">weizhou@apache.org</a>) (finder)</li>
</ul>
<h2 id="CVE-2025-22829">Unauthorised access to dedicated resources in Quota plugin</h2>
<p>CVE-2025-22829 <a href="https://cve.org/CVERecord?id=CVE-2025-22829">[CVE]</a> <a href="./CVE-2025-22829.cve.json">[CVE json]</a> <a href="./CVE-2025-22829.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-06-11T04:00:28.410Z</em></p>
-<h3 id="affected-13">Affected</h3>
+<h3 id="affected-33">Affected</h3>
<ul>
<li>Apache CloudStack from 4.20.0.0 before 4.20.1.0</li>
</ul>
-<h3 id="description-13">Description</h3>
+<h3 id="description-33">Description</h3>
<p>The CloudStack Quota plugin has an improper privilege management logic in version 4.20.0.0. Anyone with authenticated user-account access in CloudStack 4.20.0.0 environments, where this plugin is enabled and have access to specific APIs can enable or disable reception of quota-related emails for any account in the environment and list their configurations.<br><br>Quota plugin users using CloudStack 4.20.0.0 are recommended to upgrade to CloudStack version 4.20.1.0, which fixes this is [...]
-<h3 id="references-13">References</h3>
+<h3 id="references-33">References</h3>
<ul>
<li><a href="https://cloudstack.staged.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0">https://cloudstack.staged.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0</a></li>
<li><a href="https://www.shapeblue.com/shapeblue-security-advisory-cloudstack-4-19-3-0-and-4-20-1-0/">https://www.shapeblue.com/shapeblue-security-advisory-cloudstack-4-19-3-0-and-4-20-1-0/</a></li>
<li><a href="https://lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60">https://lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60</a></li>
</ul>
-<h3 id="credits-13">Credits</h3>
+<h3 id="credits-33">Credits</h3>
<ul>
<li>Fabricio Duarte <a href="mailto:fabricio.duarte.jr@gmail.com">fabricio.duarte.jr@gmail.com</a> (finder)</li>
</ul>
<h2 id="CVE-2025-22828">Unauthorised access to annotations</h2>
<p>CVE-2025-22828 <a href="https://cve.org/CVERecord?id=CVE-2025-22828">[CVE]</a> <a href="./CVE-2025-22828.cve.json">[CVE json]</a> <a href="./CVE-2025-22828.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-01-13T12:40:18.771Z</em></p>
-<h3 id="affected-14">Affected</h3>
+<h3 id="affected-34">Affected</h3>
<ul>
<li>Apache CloudStack from 4.16.0 through *</li>
</ul>
-<h3 id="description-14">Description</h3>
+<h3 id="description-34">Description</h3>
<div>CloudStack users can add and read comments (annotations) on resources they are authorised to access. </div><div>Due to an access validation issue that affects Apache CloudStack versions from 4.16.0, users who have access, prior access or knowledge of resource UUIDs can list and add comments (annotations) to such resources. </div><div>An attacker with a user-account and access or prior knowledge of resource UUIDs may exploit this issue to read contents of the comments (anno [...]
-<h3 id="references-14">References</h3>
+<h3 id="references-34">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/bbsm9fdwrgfyostzojh6ghpocgdmx8rs">https://lists.apache.org/thread/bbsm9fdwrgfyostzojh6ghpocgdmx8rs</a></li>
</ul>
-<h3 id="credits-14">Credits</h3>
+<h3 id="credits-34">Credits</h3>
<ul>
<li>Alex Perrakis <a href="mailto:alexperrakis1@gmail.com">alexperrakis1@gmail.com</a> (reporter)</li>
<li>Efstratios Chatzoglou <a href="mailto:efchatzoglou@gmail.com">efchatzoglou@gmail.com</a> (reporter)</li>
@@ -399,40 +775,40 @@
<h2 id="CVE-2024-50386">Directly downloaded templates can be used to abuse KVM-based infrastructure</h2>
<p>CVE-2024-50386 <a href="https://cve.org/CVERecord?id=CVE-2024-50386">[CVE]</a> <a href="./CVE-2024-50386.cve.json">[CVE json]</a> <a href="./CVE-2024-50386.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-11-12T13:52:37.947Z</em></p>
-<h3 id="affected-15">Affected</h3>
+<h3 id="affected-35">Affected</h3>
<ul>
<li>Apache CloudStack from 4.0.0 through 4.18.2.4</li>
<li>Apache CloudStack from 4.19.0.0 through 4.19.1.2</li>
</ul>
-<h3 id="description-15">Description</h3>
+<h3 id="description-35">Description</h3>
<p>Account users in Apache CloudStack by default are allowed to register templates to be downloaded directly to the primary storage for deploying instances. Due to missing validation checks for KVM-compatible templates in CloudStack 4.0.0 through 4.18.2.4 and 4.19.0.0 through 4.19.1.2, an attacker that can register templates, can use them to deploy malicious instances on KVM-based environments and exploit this to gain access to the host filesystems that could result in the compromise of [...]
-<h3 id="references-15">References</h3>
+<h3 id="references-35">References</h3>
<ul>
<li><a href="https://cloudstack.apache.org/blog/security-release-advisory-4.18.2.5-4.19.1.3">https://cloudstack.apache.org/blog/security-release-advisory-4.18.2.5-4.19.1.3</a></li>
<li><a href="https://lists.apache.org/thread/d0x83c2cyglzzdw8csbop7mj7h83z95y">https://lists.apache.org/thread/d0x83c2cyglzzdw8csbop7mj7h83z95y</a></li>
<li><a href="https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-18-2-5-and-4-19-1-3/">https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-18-2-5-and-4-19-1-3/</a></li>
</ul>
-<h3 id="credits-15">Credits</h3>
+<h3 id="credits-35">Credits</h3>
<ul>
<li>Kiran Chavala <a href="mailto:kiranchavala@apache.org">kiranchavala@apache.org</a> (reporter)</li>
</ul>
<h2 id="CVE-2024-45693">Request origin validation bypass makes account takeover possible</h2>
<p>CVE-2024-45693 <a href="https://cve.org/CVERecord?id=CVE-2024-45693">[CVE]</a> <a href="./CVE-2024-45693.cve.json">[CVE json]</a> <a href="./CVE-2024-45693.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-10-16T10:39:13.974Z</em></p>
-<h3 id="affected-16">Affected</h3>
+<h3 id="affected-36">Affected</h3>
<ul>
<li>Apache CloudStack from 4.15.1.0 through 4.18.2.3</li>
<li>Apache CloudStack from 4.19.0.0 through 4.19.1.1</li>
</ul>
-<h3 id="description-16">Description</h3>
+<h3 id="description-36">Description</h3>
<p>Users logged into the Apache CloudStack's web interface can be tricked to submit malicious CSRF requests due to missing validation of the origin of the requests. This can allow an attacker to gain privileges and access to resources of the authenticated users and may lead<span style="background-color: rgb(255, 255, 255);"> to account takeover, </span>disruption, exposure of sensitive data and compromise integrity of the resources owned by the user account that are managed by [...]
-<h3 id="references-16">References</h3>
+<h3 id="references-36">References</h3>
<ul>
... 3951 lines suppressed ...