You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@security.apache.org by gi...@apache.org on 2026/09/29 20:58:29 UTC
(security-site) branch asf-site updated: Updated site from main (862b0aee4307f31fc117b241aad9b825dc501ba2)
This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/security-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new e2a5f9d7 Updated site from main (862b0aee4307f31fc117b241aad9b825dc501ba2)
e2a5f9d7 is described below
commit e2a5f9d740275379d9903c36940f03282b0c37ca
Author: jenkins <bu...@apache.org>
AuthorDate: Tue Sep 29 20:58:18 2026 +0000
Updated site from main (862b0aee4307f31fc117b241aad9b825dc501ba2)
built by https://ci-builds.apache.org/job/Security/job/site/job/main/
---
projects/airflow/CVE-2026-81862.cve.json | 101 ++
projects/airflow/CVE-2026-81862.osv.json | 1 +
projects/airflow/CVE-2026-81914.cve.json | 101 ++
projects/airflow/CVE-2026-81914.osv.json | 1 +
projects/airflow/CVE-2026-81930.cve.json | 101 ++
projects/airflow/CVE-2026-81930.osv.json | 1 +
projects/airflow/CVE-2026-86843.cve.json | 101 ++
projects/airflow/CVE-2026-86843.osv.json | 1 +
projects/airflow/CVE-2026-97636.cve.json | 131 ++
projects/airflow/CVE-2026-97636.osv.json | 1 +
projects/airflow/index.html | 1689 +++++++++++----------
projects/dolphinscheduler/CVE-2026-57590.cve.json | 116 ++
projects/dolphinscheduler/CVE-2026-57590.osv.json | 1 +
projects/dolphinscheduler/CVE-2026-66083.cve.json | 121 ++
projects/dolphinscheduler/CVE-2026-66083.osv.json | 1 +
projects/dolphinscheduler/CVE-2026-71897.cve.json | 101 ++
projects/dolphinscheduler/CVE-2026-71897.osv.json | 1 +
projects/dolphinscheduler/CVE-2026-71898.cve.json | 96 ++
projects/dolphinscheduler/CVE-2026-71898.osv.json | 1 +
projects/dolphinscheduler/CVE-2026-71899.cve.json | 101 ++
projects/dolphinscheduler/CVE-2026-71899.osv.json | 1 +
projects/dolphinscheduler/CVE-2026-78214.cve.json | 96 ++
projects/dolphinscheduler/CVE-2026-78214.osv.json | 1 +
projects/dolphinscheduler/CVE-2026-81569.cve.json | 87 ++
projects/dolphinscheduler/CVE-2026-81569.osv.json | 1 +
projects/dolphinscheduler/CVE-2026-82804.cve.json | 96 ++
projects/dolphinscheduler/CVE-2026-82804.osv.json | 1 +
projects/dolphinscheduler/index.html | 395 +++--
projects/doris/CVE-2026-31377.cve.json | 183 +++
projects/doris/CVE-2026-96443.cve.json | 95 ++
projects/doris/CVE-2026-96443.osv.json | 1 +
projects/doris/index.html | 135 +-
projects/karaf/CVE-2026-90979.cve.json | 100 ++
projects/karaf/CVE-2026-90979.osv.json | 1 +
projects/karaf/CVE-2026-91006.cve.json | 100 ++
projects/karaf/CVE-2026-91006.osv.json | 1 +
projects/karaf/CVE-2026-91012.cve.json | 84 +
projects/karaf/CVE-2026-91012.osv.json | 1 +
projects/karaf/CVE-2026-91048.cve.json | 95 ++
projects/karaf/CVE-2026-91048.osv.json | 1 +
projects/karaf/CVE-2026-91085.cve.json | 95 ++
projects/karaf/CVE-2026-91085.osv.json | 1 +
projects/karaf/CVE-2026-92142.cve.json | 95 ++
projects/karaf/CVE-2026-92142.osv.json | 1 +
projects/karaf/index.html | 145 +-
projects/polaris/CVE-2026-97395.cve.json | 83 +
projects/polaris/CVE-2026-97395.osv.json | 1 +
projects/polaris/index.html | 49 +-
projects/qpid/CVE-2026-92550.cve.json | 103 ++
projects/qpid/CVE-2026-92550.osv.json | 1 +
projects/qpid/CVE-2026-92560.cve.json | 98 ++
projects/qpid/CVE-2026-92560.osv.json | 1 +
projects/qpid/CVE-2026-92564.cve.json | 97 ++
projects/qpid/CVE-2026-92564.osv.json | 1 +
projects/qpid/CVE-2026-92573.cve.json | 103 ++
projects/qpid/CVE-2026-92573.osv.json | 1 +
projects/qpid/CVE-2026-92608.cve.json | 97 ++
projects/qpid/CVE-2026-92608.osv.json | 1 +
projects/qpid/CVE-2026-92609.cve.json | 97 ++
projects/qpid/CVE-2026-92609.osv.json | 1 +
projects/qpid/index.html | 250 ++-
projects/roller/CVE-2026-82348.cve.json | 133 ++
projects/roller/CVE-2026-82348.osv.json | 1 +
projects/roller/CVE-2026-82375.cve.json | 134 ++
projects/roller/CVE-2026-82375.osv.json | 1 +
projects/roller/CVE-2026-82376.cve.json | 123 ++
projects/roller/CVE-2026-82376.osv.json | 1 +
projects/roller/CVE-2026-82377.cve.json | 133 ++
projects/roller/CVE-2026-82377.osv.json | 1 +
projects/roller/CVE-2026-82378.cve.json | 123 ++
projects/roller/CVE-2026-82378.osv.json | 1 +
projects/roller/CVE-2026-82379.cve.json | 123 ++
projects/roller/CVE-2026-82379.osv.json | 1 +
projects/roller/CVE-2026-82380.cve.json | 123 ++
projects/roller/CVE-2026-82380.osv.json | 1 +
projects/roller/CVE-2026-82381.cve.json | 123 ++
projects/roller/CVE-2026-82381.osv.json | 1 +
projects/roller/CVE-2026-82382.cve.json | 123 ++
projects/roller/CVE-2026-82382.osv.json | 1 +
projects/roller/CVE-2026-82383.cve.json | 123 ++
projects/roller/CVE-2026-82383.osv.json | 1 +
projects/roller/CVE-2026-82384.cve.json | 123 ++
projects/roller/CVE-2026-82384.osv.json | 1 +
projects/roller/CVE-2026-82385.cve.json | 123 ++
projects/roller/CVE-2026-82385.osv.json | 1 +
projects/roller/CVE-2026-82386.cve.json | 123 ++
projects/roller/CVE-2026-82386.osv.json | 1 +
projects/roller/CVE-2026-82387.cve.json | 123 ++
projects/roller/CVE-2026-82387.osv.json | 1 +
projects/roller/CVE-2026-82546.cve.json | 124 ++
projects/roller/CVE-2026-82546.osv.json | 1 +
projects/roller/CVE-2026-86507.cve.json | 123 ++
projects/roller/CVE-2026-86507.osv.json | 1 +
projects/roller/CVE-2026-91204.cve.json | 123 ++
projects/roller/CVE-2026-91204.osv.json | 1 +
projects/roller/CVE-2026-91206.cve.json | 123 ++
projects/roller/CVE-2026-91206.osv.json | 1 +
projects/roller/index.html | 370 ++++-
projects/sling/CVE-2026-73192.cve.json | 95 ++
projects/sling/CVE-2026-73192.osv.json | 1 +
projects/sling/CVE-2026-91852.cve.json | 104 ++
projects/sling/CVE-2026-91852.osv.json | 1 +
projects/sling/CVE-2026-91928.cve.json | 103 ++
projects/sling/CVE-2026-91928.osv.json | 1 +
projects/sling/CVE-2026-91999.cve.json | 103 ++
projects/sling/CVE-2026-91999.osv.json | 1 +
projects/sling/CVE-2026-92001.cve.json | 103 ++
projects/sling/CVE-2026-92001.osv.json | 1 +
projects/sling/CVE-2026-94243.cve.json | 103 ++
projects/sling/CVE-2026-94243.osv.json | 1 +
projects/sling/CVE-2026-94251.cve.json | 103 ++
projects/sling/CVE-2026-94251.osv.json | 1 +
projects/sling/index.html | 209 ++-
projects/tomcat/CVE-2026-73581.cve.json | 119 ++
projects/tomcat/CVE-2026-75973.cve.json | 119 ++
projects/tomcat/CVE-2026-76183.cve.json | 125 ++
projects/tomcat/CVE-2026-76183.osv.json | 1 +
projects/tomcat/CVE-2026-77756.cve.json | 112 ++
projects/tomcat/CVE-2026-77762.cve.json | 112 ++
projects/tomcat/CVE-2026-77791.cve.json | 112 ++
projects/tomcat/CVE-2026-78383.cve.json | 115 ++
projects/tomcat/CVE-2026-78383.osv.json | 1 +
projects/tomcat/CVE-2026-78437.cve.json | 106 ++
projects/tomcat/CVE-2026-79677.cve.json | 128 ++
projects/tomcat/CVE-2026-86243.cve.json | 94 ++
projects/tomcat/CVE-2026-86243.osv.json | 1 +
projects/tomcat/CVE-2026-86246.cve.json | 94 ++
projects/tomcat/CVE-2026-86246.osv.json | 1 +
projects/tomcat/CVE-2026-86247.cve.json | 94 ++
projects/tomcat/CVE-2026-86247.osv.json | 1 +
projects/tomcat/CVE-2026-86248.cve.json | 105 ++
projects/tomcat/CVE-2026-86248.osv.json | 1 +
projects/tomcat/CVE-2026-86350.cve.json | 107 ++
projects/tomcat/CVE-2026-86350.osv.json | 1 +
projects/tomcat/CVE-2026-87022.cve.json | 119 ++
projects/tomcat/CVE-2026-87022.osv.json | 1 +
projects/tomcat/index.html | 947 ++++++++----
projects/ws/CVE-2026-102495.cve.json | 84 +
projects/ws/CVE-2026-102495.osv.json | 1 +
projects/ws/CVE-2026-102496.cve.json | 84 +
projects/ws/CVE-2026-102496.osv.json | 1 +
projects/ws/CVE-2026-102497.cve.json | 84 +
projects/ws/CVE-2026-102497.osv.json | 1 +
projects/ws/index.html | 67 +-
144 files changed, 10586 insertions(+), 1480 deletions(-)
diff --git a/projects/airflow/CVE-2026-81862.cve.json b/projects/airflow/CVE-2026-81862.cve.json
new file mode 100644
index 00000000..b4170c54
--- /dev/null
+++ b/projects/airflow/CVE-2026-81862.cve.json
@@ -0,0 +1,101 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:pypi/apache-airflow-providers-teradata",
+ "product": "Apache Airflow Teradata provider",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThan": "3.7.0",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "tool",
+ "value": "Claude Security Scans"
+ },
+ {
+ "lang": "en",
+ "type": "remediation developer",
+ "value": "Jarek Potiuk"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. `S3ToTeradataOperator` and `AzureBlobStorageToTeradataOperator` interpolate the source bucket's credentials as plain string literals into the `CREATE MULTISET TABLE ... LOCATION` statement whenever the bucket is private and no `teradata_authorization_name` is configured \u2014 which is the default credential path for both operators. The statement is then l [...]
+ }
+ ],
+ "value": "Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. `S3ToTeradataOperator` and `AzureBlobStorageToTeradataOperator` interpolate the source bucket's credentials as plain string literals into the `CREATE MULTISET TABLE ... LOCATION` statement whenever the bucket is private and no `teradata_authorization_name` is configured \u2014 which is the default credential path for both operators. The statement is then logged and exec [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "moderate"
+ },
+ "type": "Textual description of severity"
+ }
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-532",
+ "description": "CWE-532: Insertion of Sensitive Information into Log File",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "patch"
+ ],
+ "url": "https://github.com/apache/airflow/pull/72176"
+ },
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/0vfpoh6l8gz0dpbc9z50dmkc3z07o83l"
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "title": "Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs",
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-81862",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-81862.osv.json b/projects/airflow/CVE-2026-81862.osv.json
new file mode 100644
index 00000000..c8ce1c74
--- /dev/null
+++ b/projects/airflow/CVE-2026-81862.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-81862", "summary": "Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs", "details": "Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. `S3ToTeradataOperator` and `AzureBlobStorageToTeradataOperator` interpolate the source bucket's credentials as plain string literals into the `CREATE MULTISET TABLE ... LOCATION` statement whenever the bucke [...]
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-81914.cve.json b/projects/airflow/CVE-2026-81914.cve.json
new file mode 100644
index 00000000..924b4c63
--- /dev/null
+++ b/projects/airflow/CVE-2026-81914.cve.json
@@ -0,0 +1,101 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:pypi/apache-airflow-providers-google",
+ "product": "Apache Airflow Google provider",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThan": "22.6.0",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "tool",
+ "value": "Claude Security Scans"
+ },
+ {
+ "lang": "en",
+ "type": "remediation developer",
+ "value": "Jarek Potiuk"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended clauses of the attacker's choosing to the query.<br><br>The names are frequently not written by the Dag author. In a wildcard `gcs_to_gdrive` transfer they come f [...]
+ }
+ ],
+ "value": "Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended clauses of the attacker's choosing to the query.\n\nThe names are frequently not written by the Dag author. In a wildcard `gcs_to_gdrive` transfer they come from the source buc [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "low"
+ },
+ "type": "Textual description of severity"
+ }
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-943",
+ "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "patch"
+ ],
+ "url": "https://github.com/apache/airflow/pull/72166"
+ },
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/90osv795jrqds051y7v3lcdzhsospooo"
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "title": "Google Drive query injection via unescaped file and folder names",
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-81914",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-81914.osv.json b/projects/airflow/CVE-2026-81914.osv.json
new file mode 100644
index 00000000..4193f454
--- /dev/null
+++ b/projects/airflow/CVE-2026-81914.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-81914", "summary": "Google Drive query injection via unescaped file and folder names", "details": "Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended clauses of the attacker's choosing to the query.\n\nT [...]
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-81930.cve.json b/projects/airflow/CVE-2026-81930.cve.json
new file mode 100644
index 00000000..5b638d4d
--- /dev/null
+++ b/projects/airflow/CVE-2026-81930.cve.json
@@ -0,0 +1,101 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:pypi/apache-airflow-providers-snowflake",
+ "product": "Apache Airflow Snowflake provider",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThan": "6.18.0",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "tool",
+ "value": "Claude Security Scans"
+ },
+ {
+ "lang": "en",
+ "type": "remediation developer",
+ "value": "Jarek Potiuk"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API endpoint is built as `https://{account}.snowflakecomputing.com/api/v2/statements`, so an `account` value containing `/`, `?` or `#` demotes the intended domain to a path, query or fragment and leaves the attacker in control of the request host.<br><br>The provider sends that request with an `Authoriz [...]
+ }
+ ],
+ "value": "Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API endpoint is built as `https://{account}.snowflakecomputing.com/api/v2/statements`, so an `account` value containing `/`, `?` or `#` demotes the intended domain to a path, query or fragment and leaves the attacker in control of the request host.\n\nThe provider sends that request with an `Authorization: Bearer` hea [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "moderate"
+ },
+ "type": "Textual description of severity"
+ }
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-522",
+ "description": "CWE-522: Insufficiently Protected Credentials",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "patch"
+ ],
+ "url": "https://github.com/apache/airflow/pull/72174"
+ },
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/324jm2mxd5x4nq85jfw1ostz94xwzrmk"
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "title": "Unvalidated account field redirects SQL API bearer token off-domain",
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-81930",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-81930.osv.json b/projects/airflow/CVE-2026-81930.osv.json
new file mode 100644
index 00000000..a45aac2f
--- /dev/null
+++ b/projects/airflow/CVE-2026-81930.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-81930", "summary": "Unvalidated account field redirects SQL API bearer token off-domain", "details": "Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API endpoint is built as `https://{account}.snowflakecomputing.com/api/v2/statements`, so an `account` value containing `/`, `?` or `#` demotes the intended domain to a path, query or fragment [...]
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-86843.cve.json b/projects/airflow/CVE-2026-86843.cve.json
new file mode 100644
index 00000000..89dcb518
--- /dev/null
+++ b/projects/airflow/CVE-2026-86843.cve.json
@@ -0,0 +1,101 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageURL": "pkg:pypi/apache-airflow-providers-teradata",
+ "product": "Apache Airflow Teradata provider",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThan": "3.7.0",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Andrew Rukin (Arenadata)"
+ },
+ {
+ "lang": "en",
+ "type": "remediation developer",
+ "value": "Jarek Potiuk"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is permitted to trigger that Dag - a lower-trust role than the Dag author, and one that needs no Teradata credentials of its own - could therefore supply SQL fragments that execute under the connection the t [...]
+ }
+ ],
+ "value": "The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is permitted to trigger that Dag - a lower-trust role than the Dag author, and one that needs no Teradata credentials of its own - could therefore supply SQL fragments that execute under the connection the task runs [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "low"
+ },
+ "type": "Textual description of severity"
+ }
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-89",
+ "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "patch"
+ ],
+ "url": "https://github.com/apache/airflow/pull/72714"
+ },
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/js9pmhj1j6552gpn1j8wdz579pb46t0d"
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "title": "SQL injection via unvalidated Dag Params in the compute-cluster example Dag",
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-86843",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-86843.osv.json b/projects/airflow/CVE-2026-86843.osv.json
new file mode 100644
index 00000000..3c1ae935
--- /dev/null
+++ b/projects/airflow/CVE-2026-86843.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-86843", "summary": "SQL injection via unvalidated Dag Params in the compute-cluster example Dag", "details": "The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is permitted to trigger that Dag - a lower-trust role than the Dag author, and one [...]
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-97636.cve.json b/projects/airflow/CVE-2026-97636.cve.json
new file mode 100644
index 00000000..06bdc93f
--- /dev/null
+++ b/projects/airflow/CVE-2026-97636.cve.json
@@ -0,0 +1,131 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
+ "lang": "en",
+ "cweId": "CWE-639",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Airflow HashiCorp provider",
+ "packageURL": "pkg:pypi/apache-airflow-providers-hashicorp",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "4.6.0",
+ "lessThan": "4.8.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret belonging to a different team, because after the team-scoped lookup misses the backend falls back to a team-agnostic path concatenated from the unvalidated key. The Execution API V [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret belonging to a different team, because after the team-scoped lookup misses the backend falls back to a team-agnostic path concatenated from the unvalidated key. The Execution A [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://github.com/apache/airflow/pull/70006",
+ "tags": [
+ "patch"
+ ]
+ },
+ {
+ "url": "https://lists.apache.org/thread/l0fogo9dh5v07vnsxnhoh3c74othkr51",
+ "tags": [
+ "vendor-advisory"
+ ]
+ },
+ {
+ "url": "https://www.cve.org/CVERecord?id=CVE-2026-68870",
+ "tags": [
+ "related"
+ ]
+ },
+ {
+ "url": "https://www.cve.org/CVERecord?id=CVE-2026-68871",
+ "tags": [
+ "related"
+ ]
+ },
+ {
+ "url": "https://www.cve.org/CVERecord?id=CVE-2026-68872",
+ "tags": [
+ "related"
+ ]
+ },
+ {
+ "url": "https://www.cve.org/CVERecord?id=CVE-2026-86465",
+ "tags": [
+ "related"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "ReturnZero",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Bas Harenslak",
+ "type": "remediation developer"
+ }
+ ],
+ "x_generator": {
+ "engine": "airflow-s/generate_cve_json.py"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-97636",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
diff --git a/projects/airflow/CVE-2026-97636.osv.json b/projects/airflow/CVE-2026-97636.osv.json
new file mode 100644
index 00000000..782874cd
--- /dev/null
+++ b/projects/airflow/CVE-2026-97636.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-97636", "summary": "HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key", "details": "Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret belonging to a different team, because af [...]
\ No newline at end of file
diff --git a/projects/airflow/index.html b/projects/airflow/index.html
index 9a5e4e27..4cab3b59 100644
--- a/projects/airflow/index.html
+++ b/projects/airflow/index.html
@@ -109,22 +109,64 @@
</ul>
<h1 id="advisories">Advisories</h1>
<p class="bg-warning">This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the project security page linked above. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public <a href="/mailinglist">mailinglist</a> or privately on <a href="mailto:security@apache.org">security@apache.org</a></p>
+<h2 id="CVE-2026-97636">HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key</h2>
+<p>CVE-2026-97636 <a href="https://cve.org/CVERecord?id=CVE-2026-97636">[CVE]</a> <a href="./CVE-2026-97636.cve.json">[CVE json]</a> <a href="./CVE-2026-97636.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-24T21:54:56.271Z</em></p>
+<h3 id="affected">Affected</h3>
+<ul>
+<li>Apache Airflow HashiCorp provider from 4.6.0 before 4.8.0</li>
+</ul>
+<h3 id="description">Description</h3>
+<p>Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend’s team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret belonging to a different team, because after the team-scoped lookup misses the backend falls back to a team-agnostic path concatenated from the unvalidated key. The Execution API Variables ro [...]
+<h3 id="references">References</h3>
+<ul>
+<li><a href="https://github.com/apache/airflow/pull/70006">https://github.com/apache/airflow/pull/70006</a></li>
+<li><a href="https://lists.apache.org/thread/l0fogo9dh5v07vnsxnhoh3c74othkr51">https://lists.apache.org/thread/l0fogo9dh5v07vnsxnhoh3c74othkr51</a></li>
+<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-68870">https://www.cve.org/CVERecord?id=CVE-2026-68870</a></li>
+<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-68871">https://www.cve.org/CVERecord?id=CVE-2026-68871</a></li>
+<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-68872">https://www.cve.org/CVERecord?id=CVE-2026-68872</a></li>
+<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-86465">https://www.cve.org/CVERecord?id=CVE-2026-86465</a></li>
+</ul>
+<h3 id="credits">Credits</h3>
+<ul>
+<li>ReturnZero (finder)</li>
+<li>Bas Harenslak (remediation developer)</li>
+</ul>
+<h2 id="CVE-2026-86843">SQL injection via unvalidated Dag Params in the compute-cluster example Dag</h2>
+<p>CVE-2026-86843 <a href="https://cve.org/CVERecord?id=CVE-2026-86843">[CVE]</a> <a href="./CVE-2026-86843.cve.json">[CVE json]</a> <a href="./CVE-2026-86843.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-29T08:57:19.134Z</em></p>
+<h3 id="affected-1">Affected</h3>
+<ul>
+<li>Apache Airflow Teradata provider before 3.7.0</li>
+</ul>
+<h3 id="description-1">Description</h3>
+<p>The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is permitted to trigger that Dag - a lower-trust role than the Dag author, and one that needs no Teradata credentials of its own - could therefore supply SQL fragments that execute under the connection the task runs as, and could add [...]
+<h3 id="references-1">References</h3>
+<ul>
+<li><a href="https://github.com/apache/airflow/pull/72714">https://github.com/apache/airflow/pull/72714</a></li>
+<li><a href="https://lists.apache.org/thread/js9pmhj1j6552gpn1j8wdz579pb46t0d">https://lists.apache.org/thread/js9pmhj1j6552gpn1j8wdz579pb46t0d</a></li>
+</ul>
+<h3 id="credits-1">Credits</h3>
+<ul>
+<li>Andrew Rukin (Arenadata) (finder)</li>
+<li>Jarek Potiuk (remediation developer)</li>
+</ul>
<h2 id="CVE-2026-86792">Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration</h2>
<p>CVE-2026-86792 <a href="https://cve.org/CVERecord?id=CVE-2026-86792">[CVE]</a> <a href="./CVE-2026-86792.cve.json">[CVE json]</a> <a href="./CVE-2026-86792.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:44:26.808Z</em></p>
-<h3 id="affected">Affected</h3>
+<h3 id="affected-2">Affected</h3>
<ul>
<li>Apache Airflow Apache Kafka provider from 1.15.0 before 2.0.0</li>
</ul>
-<h3 id="description">Description</h3>
+<h3 id="description-2">Description</h3>
<p>Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's <code>extra</code> field into Python callables via <code>import_string</code>, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafka event producer — <code>dag_run_events_enabled</code> or <code>task_instance_events_enabled</code>, both disabled by default — build that client inside the schedule [...]
-<h3 id="references">References</h3>
+<h3 id="references-2">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/72208">https://github.com/apache/airflow/pull/72208</a></li>
<li><a href="https://lists.apache.org/thread/jl4gpok02313yh3rvtvj8qbo11c6zpr2?users@airflow.apache.org">https://lists.apache.org/thread/jl4gpok02313yh3rvtvj8qbo11c6zpr2?users@airflow.apache.org</a></li>
<li><a href="https://lists.apache.org/thread/jl4gpok02313yh3rvtvj8qbo11c6zpr2">https://lists.apache.org/thread/jl4gpok02313yh3rvtvj8qbo11c6zpr2</a></li>
</ul>
-<h3 id="credits">Credits</h3>
+<h3 id="credits-2">Credits</h3>
<ul>
<li>Claude Security Scans (tool)</li>
<li>Christos Bisias (remediation developer)</li>
@@ -132,18 +174,18 @@
<h2 id="CVE-2026-86473">Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry</h2>
<p>CVE-2026-86473 <a href="https://cve.org/CVERecord?id=CVE-2026-86473">[CVE]</a> <a href="./CVE-2026-86473.cve.json">[CVE json]</a> <a href="./CVE-2026-86473.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-21T14:33:41.347Z</em></p>
-<h3 id="affected-1">Affected</h3>
+<h3 id="affected-3">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.3.2</li>
</ul>
-<h3 id="description-1">Description</h3>
+<h3 id="description-3">Description</h3>
<p>Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid until it expires. An attacker who already holds a copy of that token keeps the victim’s access after the victim has logged out and believes the session ended; the default token lifetime is [...]
-<h3 id="references-1">References</h3>
+<h3 id="references-3">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/72649">https://github.com/apache/airflow/pull/72649</a></li>
<li><a href="https://lists.apache.org/thread/k9z1p0q1ng8m68nlnv9d1fqzscrfm7vr">https://lists.apache.org/thread/k9z1p0q1ng8m68nlnv9d1fqzscrfm7vr</a></li>
</ul>
-<h3 id="credits-1">Credits</h3>
+<h3 id="credits-3">Credits</h3>
<ul>
<li>OpenSec Intelligence (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -151,20 +193,20 @@
<h2 id="CVE-2026-86466">FAB Authentik provider: id_token issuer/audience not validated</h2>
<p>CVE-2026-86466 <a href="https://cve.org/CVERecord?id=CVE-2026-86466">[CVE]</a> <a href="./CVE-2026-86466.cve.json">[CVE json]</a> <a href="./CVE-2026-86466.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:44:32.186Z</em></p>
-<h3 id="affected-2">Affected</h3>
+<h3 id="affected-4">Affected</h3>
<ul>
<li>Apache Airflow FAB provider before 3.9.0</li>
</ul>
-<h3 id="description-2">Description</h3>
+<h3 id="description-4">Description</h3>
<p>Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be authenticated as the user it names, because the audience claim is never checked. Affects deployments using the FAB auth manager with Authentik OAuth where the same Authentik instance also se [...]
-<h3 id="references-2">References</h3>
+<h3 id="references-4">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/72645">https://github.com/apache/airflow/pull/72645</a></li>
<li><a href="https://lists.apache.org/thread/qh7fobs16p2hgln2yblbgf8ty4dvf4y7?users@airflow.apache.org">https://lists.apache.org/thread/qh7fobs16p2hgln2yblbgf8ty4dvf4y7?users@airflow.apache.org</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-75156">https://www.cve.org/CVERecord?id=CVE-2026-75156</a></li>
<li><a href="https://lists.apache.org/thread/qh7fobs16p2hgln2yblbgf8ty4dvf4y7">https://lists.apache.org/thread/qh7fobs16p2hgln2yblbgf8ty4dvf4y7</a></li>
</ul>
-<h3 id="credits-2">Credits</h3>
+<h3 id="credits-4">Credits</h3>
<ul>
<li>Ritik Chaddha & NEO by ProjectDiscovery (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -172,13 +214,13 @@
<h2 id="CVE-2026-86465">Akeyless secrets backend: team-scope guard bypass via user-controlled key</h2>
<p>CVE-2026-86465 <a href="https://cve.org/CVERecord?id=CVE-2026-86465">[CVE]</a> <a href="./CVE-2026-86465.cve.json">[CVE json]</a> <a href="./CVE-2026-86465.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:44:31.052Z</em></p>
-<h3 id="affected-3">Affected</h3>
+<h3 id="affected-5">Affected</h3>
<ul>
<li>Apache Airflow Akeyless provider before 0.3.1</li>
</ul>
-<h3 id="description-3">Description</h3>
+<h3 id="description-5">Description</h3>
<p>Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret belonging to a different team, because the lookup path is concatenated from an unvalidated key after the team-scoped lookup misses. The Execution API Variables route accepts a path-shaped key, so this is r [...]
-<h3 id="references-3">References</h3>
+<h3 id="references-5">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/72646">https://github.com/apache/airflow/pull/72646</a></li>
<li><a href="https://lists.apache.org/thread/vczt5xgqjv8ot8fpp1vdq3rmnfm50w0g?users@airflow.apache.org">https://lists.apache.org/thread/vczt5xgqjv8ot8fpp1vdq3rmnfm50w0g?users@airflow.apache.org</a></li>
@@ -187,7 +229,7 @@
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-68872">https://www.cve.org/CVERecord?id=CVE-2026-68872</a></li>
<li><a href="https://lists.apache.org/thread/vczt5xgqjv8ot8fpp1vdq3rmnfm50w0g">https://lists.apache.org/thread/vczt5xgqjv8ot8fpp1vdq3rmnfm50w0g</a></li>
</ul>
-<h3 id="credits-3">Credits</h3>
+<h3 id="credits-5">Credits</h3>
<ul>
<li>ReturnZero (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -195,20 +237,20 @@
<h2 id="CVE-2026-86462">FAB Admin password PATCH does not invalidate database-backed sessions</h2>
<p>CVE-2026-86462 <a href="https://cve.org/CVERecord?id=CVE-2026-86462">[CVE]</a> <a href="./CVE-2026-86462.cve.json">[CVE json]</a> <a href="./CVE-2026-86462.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:44:29.995Z</em></p>
-<h3 id="affected-4">Affected</h3>
+<h3 id="affected-6">Affected</h3>
<ul>
<li>Apache Airflow FAB provider from 3.2.0 before 3.9.0</li>
</ul>
-<h3 id="description-4">Description</h3>
+<h3 id="description-6">Description</h3>
<p>Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that user after the password change, so the password reset does not evict them. Affects deployments using the FAB auth manager with database-backed sessions; an administrator (or the user themselves) performing a routine password chan [...]
-<h3 id="references-4">References</h3>
+<h3 id="references-6">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/72657">https://github.com/apache/airflow/pull/72657</a></li>
<li><a href="https://lists.apache.org/thread/7sr4sggfv5fhhl3qgphcq0rlhg81do1s?users@airflow.apache.org">https://lists.apache.org/thread/7sr4sggfv5fhhl3qgphcq0rlhg81do1s?users@airflow.apache.org</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-82311">https://www.cve.org/CVERecord?id=CVE-2026-82311</a></li>
<li><a href="https://lists.apache.org/thread/7sr4sggfv5fhhl3qgphcq0rlhg81do1s">https://lists.apache.org/thread/7sr4sggfv5fhhl3qgphcq0rlhg81do1s</a></li>
</ul>
-<h3 id="credits-4">Credits</h3>
+<h3 id="credits-6">Credits</h3>
<ul>
<li>OpenSec Intelligence (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -216,19 +258,19 @@
<h2 id="CVE-2026-82355">Session cookie silently overrides explicit Authorization bearer header, enabling session fixation</h2>
<p>CVE-2026-82355 <a href="https://cve.org/CVERecord?id=CVE-2026-82355">[CVE]</a> <a href="./CVE-2026-82355.cve.json">[CVE json]</a> <a href="./CVE-2026-82355.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-21T14:32:02.334Z</em></p>
-<h3 id="affected-5">Affected</h3>
+<h3 id="affected-7">Affected</h3>
<ul>
<li>Apache Airflow from 3.3.0 before 3.3.2</li>
</ul>
-<h3 id="description-5">Description</h3>
+<h3 id="description-7">Description</h3>
<p>When a request to the Airflow core API carries both a session cookie and an explicit <code>Authorization: Bearer</code> token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes – and is recorded in the audit log – as the cookie’s principal rather than the identity the client explicitly presented.<br><br>Only Apache Airflow 3.3.0 and 3.3.1 are affected. Earlier r [...]
-<h3 id="references-5">References</h3>
+<h3 id="references-7">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/72225">https://github.com/apache/airflow/pull/72225</a></li>
<li><a href="https://github.com/apache/airflow/pull/72723">https://github.com/apache/airflow/pull/72723</a></li>
<li><a href="https://lists.apache.org/thread/3p7zpdvv40tn01m0xk5mt2rxg88mw8w1">https://lists.apache.org/thread/3p7zpdvv40tn01m0xk5mt2rxg88mw8w1</a></li>
</ul>
-<h3 id="credits-5">Credits</h3>
+<h3 id="credits-7">Credits</h3>
<ul>
<li>Claude Security Scans (tool)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -236,20 +278,20 @@
<h2 id="CVE-2026-82311">FAB password reset never invalidates sessions: string/int _user_id comparison is always false</h2>
<p>CVE-2026-82311 <a href="https://cve.org/CVERecord?id=CVE-2026-82311">[CVE]</a> <a href="./CVE-2026-82311.cve.json">[CVE json]</a> <a href="./CVE-2026-82311.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:44:28.944Z</em></p>
-<h3 id="affected-6">Affected</h3>
+<h3 id="affected-8">Affected</h3>
<ul>
<li>Apache Airflow FAB provider from 2.4.2 before 3.9.0</li>
</ul>
-<h3 id="description-6">Description</h3>
+<h3 id="description-8">Description</h3>
<p>Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the comparison never matches and no session is removed. An attacker who already holds a copy of the victim's session cookie keeps access as that user after the password change, so the reset does not [...]
-<h3 id="references-6">References</h3>
+<h3 id="references-8">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/72198">https://github.com/apache/airflow/pull/72198</a></li>
<li><a href="https://lists.apache.org/thread/mmplwl93shy615shkpp9p4fzyjvr4yqw?users@airflow.apache.org">https://lists.apache.org/thread/mmplwl93shy615shkpp9p4fzyjvr4yqw?users@airflow.apache.org</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-86462">https://www.cve.org/CVERecord?id=CVE-2026-86462</a></li>
<li><a href="https://lists.apache.org/thread/mmplwl93shy615shkpp9p4fzyjvr4yqw">https://lists.apache.org/thread/mmplwl93shy615shkpp9p4fzyjvr4yqw</a></li>
</ul>
-<h3 id="credits-6">Credits</h3>
+<h3 id="credits-8">Credits</h3>
<ul>
<li>Mayank Jangid (OpenSec) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -257,39 +299,96 @@
<h2 id="CVE-2026-82310">FAB auth manager: deactivated users retain and renew Core API JWT access</h2>
<p>CVE-2026-82310 <a href="https://cve.org/CVERecord?id=CVE-2026-82310">[CVE]</a> <a href="./CVE-2026-82310.cve.json">[CVE json]</a> <a href="./CVE-2026-82310.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:44:27.846Z</em></p>
-<h3 id="affected-7">Affected</h3>
+<h3 id="affected-9">Affected</h3>
<ul>
<li>Apache Airflow FAB provider from 2.0.0 before 3.9.0</li>
</ul>
-<h3 id="description-7">Description</h3>
+<h3 id="description-9">Description</h3>
<p>Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a replacement — so the account keeps its role-scoped access indefinitely after an administrator has disabled it. The user replays their own legitimate credential; no signature forgery or privilege esca [...]
-<h3 id="references-7">References</h3>
+<h3 id="references-9">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/72199">https://github.com/apache/airflow/pull/72199</a></li>
<li><a href="https://lists.apache.org/thread/85h9r50bmy8vgkgr5nyddryj1p5pxxy2?users@airflow.apache.org">https://lists.apache.org/thread/85h9r50bmy8vgkgr5nyddryj1p5pxxy2?users@airflow.apache.org</a></li>
<li><a href="https://lists.apache.org/thread/85h9r50bmy8vgkgr5nyddryj1p5pxxy2">https://lists.apache.org/thread/85h9r50bmy8vgkgr5nyddryj1p5pxxy2</a></li>
</ul>
-<h3 id="credits-7">Credits</h3>
+<h3 id="credits-9">Credits</h3>
<ul>
<li>Mayank Jangid (OpenSec) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
</ul>
+<h2 id="CVE-2026-81930">Unvalidated account field redirects SQL API bearer token off-domain</h2>
+<p>CVE-2026-81930 <a href="https://cve.org/CVERecord?id=CVE-2026-81930">[CVE]</a> <a href="./CVE-2026-81930.cve.json">[CVE json]</a> <a href="./CVE-2026-81930.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-29T08:57:17.400Z</em></p>
+<h3 id="affected-10">Affected</h3>
+<ul>
+<li>Apache Airflow Snowflake provider before 6.18.0</li>
+</ul>
+<h3 id="description-10">Description</h3>
+<p>Apache Airflow's Snowflake provider did not validate the connection's <code>account</code> and <code>region</code> fields before interpolating them into request URLs. The SQL API endpoint is built as <code>https://{account}.snowflakecomputing.com/api/v2/statements</code>, so an <code>account</code> value containing <code>/</code>, <code>?</code> or <code>#</code> demotes the intended domain to a path, query or fragment and leaves the attacker in control of the request host.<br><br>The [...]
+<h3 id="references-10">References</h3>
+<ul>
+<li><a href="https://github.com/apache/airflow/pull/72174">https://github.com/apache/airflow/pull/72174</a></li>
+<li><a href="https://lists.apache.org/thread/324jm2mxd5x4nq85jfw1ostz94xwzrmk">https://lists.apache.org/thread/324jm2mxd5x4nq85jfw1ostz94xwzrmk</a></li>
+</ul>
+<h3 id="credits-10">Credits</h3>
+<ul>
+<li>Claude Security Scans (tool)</li>
+<li>Jarek Potiuk (remediation developer)</li>
+</ul>
+<h2 id="CVE-2026-81914">Google Drive query injection via unescaped file and folder names</h2>
+<p>CVE-2026-81914 <a href="https://cve.org/CVERecord?id=CVE-2026-81914">[CVE]</a> <a href="./CVE-2026-81914.cve.json">[CVE json]</a> <a href="./CVE-2026-81914.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-29T08:57:15.653Z</em></p>
+<h3 id="affected-11">Affected</h3>
+<ul>
+<li>Apache Airflow Google provider before 22.6.0</li>
+</ul>
+<h3 id="description-11">Description</h3>
+<p>Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended clauses of the attacker's choosing to the query.<br><br>The names are frequently not written by the Dag author. In a wildcard <code>gcs_to_gdrive</code> transfer they come from the source bucke [...]
+<h3 id="references-11">References</h3>
+<ul>
+<li><a href="https://github.com/apache/airflow/pull/72166">https://github.com/apache/airflow/pull/72166</a></li>
+<li><a href="https://lists.apache.org/thread/90osv795jrqds051y7v3lcdzhsospooo">https://lists.apache.org/thread/90osv795jrqds051y7v3lcdzhsospooo</a></li>
+</ul>
+<h3 id="credits-11">Credits</h3>
+<ul>
+<li>Claude Security Scans (tool)</li>
+<li>Jarek Potiuk (remediation developer)</li>
+</ul>
+<h2 id="CVE-2026-81862">Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs</h2>
+<p>CVE-2026-81862 <a href="https://cve.org/CVERecord?id=CVE-2026-81862">[CVE]</a> <a href="./CVE-2026-81862.cve.json">[CVE json]</a> <a href="./CVE-2026-81862.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-29T08:57:13.929Z</em></p>
+<h3 id="affected-12">Affected</h3>
+<ul>
+<li>Apache Airflow Teradata provider before 3.7.0</li>
+</ul>
+<h3 id="description-12">Description</h3>
+<p>Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. <code>S3ToTeradataOperator</code> and <code>AzureBlobStorageToTeradataOperator</code> interpolate the source bucket's credentials as plain string literals into the <code>CREATE MULTISET TABLE ... LOCATION</code> statement whenever the bucket is private and no <code>teradata_authorization_name</code> is configured — which is the default credential path for both operators. The statement i [...]
+<h3 id="references-12">References</h3>
+<ul>
+<li><a href="https://github.com/apache/airflow/pull/72176">https://github.com/apache/airflow/pull/72176</a></li>
+<li><a href="https://lists.apache.org/thread/0vfpoh6l8gz0dpbc9z50dmkc3z07o83l">https://lists.apache.org/thread/0vfpoh6l8gz0dpbc9z50dmkc3z07o83l</a></li>
+</ul>
+<h3 id="credits-12">Credits</h3>
+<ul>
+<li>Claude Security Scans (tool)</li>
+<li>Jarek Potiuk (remediation developer)</li>
+</ul>
<h2 id="CVE-2026-76187">Any realm client’s credentials mint an Airflow session JWT</h2>
<p>CVE-2026-76187 <a href="https://cve.org/CVERecord?id=CVE-2026-76187">[CVE]</a> <a href="./CVE-2026-76187.cve.json">[CVE json]</a> <a href="./CVE-2026-76187.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:44:25.736Z</em></p>
-<h3 id="affected-8">Affected</h3>
+<h3 id="affected-13">Affected</h3>
<ul>
<li>Apache Airflow Keycloak provider before 0.10.0</li>
</ul>
-<h3 id="description-8">Description</h3>
+<h3 id="description-13">Description</h3>
<p>Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so the credentials of an unrelated application that happens to share the realm are valid Airflow login credentials, and Airflow mints a signed session token for that application's service account. The endpoint also answer [...]
-<h3 id="references-8">References</h3>
+<h3 id="references-13">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/72205">https://github.com/apache/airflow/pull/72205</a></li>
<li><a href="https://lists.apache.org/thread/j1b9ddljxphqvoc41z7gthj4zh34vmlw?users@airflow.apache.org">https://lists.apache.org/thread/j1b9ddljxphqvoc41z7gthj4zh34vmlw?users@airflow.apache.org</a></li>
<li><a href="https://lists.apache.org/thread/5cqh5ojl3718ogb0q1dcd9vdr47z7gp3">https://lists.apache.org/thread/5cqh5ojl3718ogb0q1dcd9vdr47z7gp3</a></li>
</ul>
-<h3 id="credits-8">Credits</h3>
+<h3 id="credits-13">Credits</h3>
<ul>
<li>Claude Security Scans (tool)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -297,19 +396,19 @@
<h2 id="CVE-2026-76186">Keycloak token cookies not bound to Airflow session identity</h2>
<p>CVE-2026-76186 <a href="https://cve.org/CVERecord?id=CVE-2026-76186">[CVE]</a> <a href="./CVE-2026-76186.cve.json">[CVE json]</a> <a href="./CVE-2026-76186.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:44:19.051Z</em></p>
-<h3 id="affected-9">Affected</h3>
+<h3 id="affected-14">Affected</h3>
<ul>
<li>Apache Airflow Keycloak provider before 0.10.0</li>
</ul>
-<h3 id="description-9">Description</h3>
+<h3 id="description-14">Description</h3>
<p>Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated cookies, and never checks that the two describe the same subject. A user who holds any valid Airflow login of their own, together with another subject's Keycloak access or refresh token obtained out of band, can pair the two: Airflo [...]
-<h3 id="references-9">References</h3>
+<h3 id="references-14">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/72207">https://github.com/apache/airflow/pull/72207</a></li>
<li><a href="https://lists.apache.org/thread/5cqh5ojl3718ogb0q1dcd9vdr47z7gp3?users@airflow.apache.org">https://lists.apache.org/thread/5cqh5ojl3718ogb0q1dcd9vdr47z7gp3?users@airflow.apache.org</a></li>
<li><a href="https://lists.apache.org/thread/5cqh5ojl3718ogb0q1dcd9vdr47z7gp3">https://lists.apache.org/thread/5cqh5ojl3718ogb0q1dcd9vdr47z7gp3</a></li>
</ul>
-<h3 id="credits-9">Credits</h3>
+<h3 id="credits-14">Credits</h3>
<ul>
<li>Claude Security Scans (tool)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -317,18 +416,18 @@
<h2 id="CVE-2026-75158">Assets events API returns asset events for every Dag with no per-Dag authorization filter</h2>
<p>CVE-2026-75158 <a href="https://cve.org/CVERecord?id=CVE-2026-75158">[CVE]</a> <a href="./CVE-2026-75158.cve.json">[CVE json]</a> <a href="./CVE-2026-75158.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-21T14:32:46.741Z</em></p>
-<h3 id="affected-10">Affected</h3>
+<h3 id="affected-15">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.2</li>
</ul>
-<h3 id="description-10">Description</h3>
+<h3 id="description-15">Description</h3>
<p>Apache Airflow’s <code>/assets/events</code> API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events — including the source Dag ID, task ID, run ID and event timestamps — for Dags they have no permission to see. Because the filter was also absent from the count query, <code>total_entries</code> and pagination dis [...]
-<h3 id="references-10">References</h3>
+<h3 id="references-15">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/71741">https://github.com/apache/airflow/pull/71741</a></li>
<li><a href="https://lists.apache.org/thread/rx5lg86l0qkjl2s7dtmpqxjq0xplr4fy">https://lists.apache.org/thread/rx5lg86l0qkjl2s7dtmpqxjq0xplr4fy</a></li>
</ul>
-<h3 id="credits-10">Credits</h3>
+<h3 id="credits-15">Credits</h3>
<ul>
<li>n0mi1k (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -336,18 +435,18 @@
<h2 id="CVE-2026-75157">Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)</h2>
<p>CVE-2026-75157 <a href="https://cve.org/CVERecord?id=CVE-2026-75157">[CVE]</a> <a href="./CVE-2026-75157.cve.json">[CVE json]</a> <a href="./CVE-2026-75157.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-18T07:51:21.855Z</em></p>
-<h3 id="affected-11">Affected</h3>
+<h3 id="affected-16">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.2</li>
</ul>
-<h3 id="description-11">Description</h3>
+<h3 id="description-16">Description</h3>
<p>Apache Airflow’s asset queued-events DELETE endpoints checked the caller’s Dag-axis permission with <code>READ</code> instead of <code>EDIT</code>. Any authenticated user who could read a Dag could therefore delete that Dag’s queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing action gated on a read-only permission. Deployments are affected whenever asset-triggered scheduling is in use and Dag read access is granted more wid [...]
-<h3 id="references-11">References</h3>
+<h3 id="references-16">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/71736">https://github.com/apache/airflow/pull/71736</a></li>
<li><a href="https://lists.apache.org/thread/f2ngj296z48b3x14ss3pgbs41lbnlgmp">https://lists.apache.org/thread/f2ngj296z48b3x14ss3pgbs41lbnlgmp</a></li>
</ul>
-<h3 id="credits-11">Credits</h3>
+<h3 id="credits-16">Credits</h3>
<ul>
<li>n0mi1k (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -355,19 +454,19 @@
<h2 id="CVE-2026-75156">FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass</h2>
<p>CVE-2026-75156 <a href="https://cve.org/CVERecord?id=CVE-2026-75156">[CVE]</a> <a href="./CVE-2026-75156.cve.json">[CVE json]</a> <a href="./CVE-2026-75156.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:46:22.794Z</em></p>
-<h3 id="affected-12">Affected</h3>
+<h3 id="affected-17">Affected</h3>
<ul>
<li>Apache Airflow FAB provider from 3.7.3 before 3.8.1</li>
</ul>
-<h3 id="description-12">Description</h3>
+<h3 id="description-17">Description</h3>
<p>Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD <code>id_token</code>s during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's <strong>multi-tenant</strong> JWKS endpoint, an <code>id_token</code> minted in <em>any</em> Azure tenant — including one the attacker creates — passes signature verification, an [...]
-<h3 id="references-12">References</h3>
+<h3 id="references-17">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/71735">https://github.com/apache/airflow/pull/71735</a></li>
<li><a href="https://lists.apache.org/thread/n3l6z4jfdxj4p0t8l7m6olkq6xsc6f76">https://lists.apache.org/thread/n3l6z4jfdxj4p0t8l7m6olkq6xsc6f76</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-59243">https://www.cve.org/CVERecord?id=CVE-2026-59243</a></li>
</ul>
-<h3 id="credits-12">Credits</h3>
+<h3 id="credits-17">Credits</h3>
<ul>
<li>Roberto Nunes (finder)</li>
<li>NEO AI Engineer (@neo-ai-engineer, ProjectDiscovery) (tool)</li>
@@ -376,18 +475,18 @@
<h2 id="CVE-2026-68971">Cross-team authorization bypass in the asset materialization and dag-run result endpoints</h2>
<p>CVE-2026-68971 <a href="https://cve.org/CVERecord?id=CVE-2026-68971">[CVE]</a> <a href="./CVE-2026-68971.cve.json">[CVE json]</a> <a href="./CVE-2026-68971.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:46:20.610Z</em></p>
-<h3 id="affected-13">Affected</h3>
+<h3 id="affected-18">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.1</li>
</ul>
-<h3 id="description-13">Description</h3>
+<h3 id="description-18">Description</h3>
<p>Apache Airflow's asset materialization endpoint (<code>POST /api/v2/assets/{asset_id}/materialize</code>) and the XCom result check on <code>wait_dag_run_until_finished</code> authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global one by that field – the Keycloak auth manager, for example, checks the <code>DAG</code> resource instead of <code>DAG:&lt;team&gt;</code> &ndash [...]
-<h3 id="references-13">References</h3>
+<h3 id="references-18">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/70893">https://github.com/apache/airflow/pull/70893</a></li>
<li><a href="https://lists.apache.org/thread/kfxqqwgojdjdnt6bxg3ord4y41y334fo">https://lists.apache.org/thread/kfxqqwgojdjdnt6bxg3ord4y41y334fo</a></li>
</ul>
-<h3 id="credits-13">Credits</h3>
+<h3 id="credits-18">Credits</h3>
<ul>
<li>@haoxucu (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -395,19 +494,19 @@
<h2 id="CVE-2026-68970">Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI</h2>
<p>CVE-2026-68970 <a href="https://cve.org/CVERecord?id=CVE-2026-68970">[CVE]</a> <a href="./CVE-2026-68970.cve.json">[CVE json]</a> <a href="./CVE-2026-68970.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:47:05.846Z</em></p>
-<h3 id="affected-14">Affected</h3>
+<h3 id="affected-19">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.1</li>
</ul>
-<h3 id="description-14">Description</h3>
+<h3 id="description-19">Description</h3>
<p>Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level matched neither and was returned unmasked. Any authenticated user able to read the logs or rendered templates of a task that references such a Variable could recover the values, with no special [...]
-<h3 id="references-14">References</h3>
+<h3 id="references-19">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/70891">https://github.com/apache/airflow/pull/70891</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-59244">https://www.cve.org/CVERecord?id=CVE-2026-59244</a></li>
<li><a href="https://lists.apache.org/thread/kkrlnbsk47oght4h38mcd3h2kcb8dt28">https://lists.apache.org/thread/kkrlnbsk47oght4h38mcd3h2kcb8dt28</a></li>
</ul>
-<h3 id="credits-14">Credits</h3>
+<h3 id="credits-19">Credits</h3>
<ul>
<li>Raphael Zanarelli (@zanarellidev) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -415,19 +514,19 @@
<h2 id="CVE-2026-68969">Bulk Variable and Connection endpoints record secret values in the audit log in cleartext</h2>
<p>CVE-2026-68969 <a href="https://cve.org/CVERecord?id=CVE-2026-68969">[CVE]</a> <a href="./CVE-2026-68969.cve.json">[CVE json]</a> <a href="./CVE-2026-68969.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:47:04.500Z</em></p>
-<h3 id="affected-15">Affected</h3>
+<h3 id="affected-20">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.1</li>
</ul>
-<h3 id="description-15">Description</h3>
+<h3 id="description-20">Description</h3>
<p>Apache Airflow wrote Variable values and Connection <code>extra</code> contents to the audit log in cleartext when they were submitted through the bulk endpoints (<code>PATCH /api/v2/variables</code> and <code>PATCH /api/v2/connections</code>). The audit-log masking recognised only top-level request fields, and a bulk request nests its entities two levels below, so no masking was applied to them. Any authenticated user with audit-log read access – who need not hold Variables or [...]
-<h3 id="references-15">References</h3>
+<h3 id="references-20">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/70890">https://github.com/apache/airflow/pull/70890</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-50204">https://www.cve.org/CVERecord?id=CVE-2026-50204</a></li>
<li><a href="https://lists.apache.org/thread/p3jr90jgp2brto4vwcrx680f3x11y70c">https://lists.apache.org/thread/p3jr90jgp2brto4vwcrx680f3x11y70c</a></li>
</ul>
-<h3 id="credits-15">Credits</h3>
+<h3 id="credits-20">Credits</h3>
<ul>
<li>Jarek Potiuk (remediation developer)</li>
<li>Harish Kolla (@Har1sh-k) (finder)</li>
@@ -435,18 +534,18 @@
<h2 id="CVE-2026-68968">Authorization bypass in the Backfill API through conflicting interpretations of the backfill id</h2>
<p>CVE-2026-68968 <a href="https://cve.org/CVERecord?id=CVE-2026-68968">[CVE]</a> <a href="./CVE-2026-68968.cve.json">[CVE json]</a> <a href="./CVE-2026-68968.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:47:02.989Z</em></p>
-<h3 id="affected-16">Affected</h3>
+<h3 id="affected-21">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.1</li>
</ul>
-<h3 id="description-16">Description</h3>
+<h3 id="description-21">Description</h3>
<p>Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the <code>backfill_id</code> path segment failed to parse. The authorization dependency parsed it with <code>int()</code> while the route handler parsed it as pydantic's <code>NonNegativeInt</code>, which accepts values <code>int()</code> rejects (<code>1.0</code> coerces to <code>1</code>); FastAPI resolves dependencies before endpoint validation, so the two acted on different Dags. An [...]
-<h3 id="references-16">References</h3>
+<h3 id="references-21">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/70889">https://github.com/apache/airflow/pull/70889</a></li>
<li><a href="https://lists.apache.org/thread/f9zmw6xs5b4syhwzbl6fsxm4kf2632ol">https://lists.apache.org/thread/f9zmw6xs5b4syhwzbl6fsxm4kf2632ol</a></li>
</ul>
-<h3 id="credits-16">Credits</h3>
+<h3 id="credits-21">Credits</h3>
<ul>
<li>Jarek Potiuk (remediation developer)</li>
<li>Harish Kolla (@Har1sh-k) (finder)</li>
@@ -454,18 +553,18 @@
<h2 id="CVE-2026-68872">amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team’s Connection or Variable</h2>
<p>CVE-2026-68872 <a href="https://cve.org/CVERecord?id=CVE-2026-68872">[CVE]</a> <a href="./CVE-2026-68872.cve.json">[CVE json]</a> <a href="./CVE-2026-68872.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:46:13.734Z</em></p>
-<h3 id="affected-17">Affected</h3>
+<h3 id="affected-22">Affected</h3>
<ul>
<li>Apache Airflow Amazon provider before 9.34.0</li>
</ul>
-<h3 id="description-17">Description</h3>
+<h3 id="description-22">Description</h3>
<p>The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyon [...]
-<h3 id="references-17">References</h3>
+<h3 id="references-22">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/70878">https://github.com/apache/airflow/pull/70878</a></li>
<li><a href="https://lists.apache.org/thread/9nd31g40rd2zpgwwymskvjpfq1xnmllg">https://lists.apache.org/thread/9nd31g40rd2zpgwwymskvjpfq1xnmllg</a></li>
</ul>
-<h3 id="credits-17">Credits</h3>
+<h3 id="credits-22">Credits</h3>
<ul>
<li>Apache Airflow security team (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -473,18 +572,18 @@
<h2 id="CVE-2026-68871">yandex Lockbox backend: team-scope guard bypass resolves another team’s Connection or Variable</h2>
<p>CVE-2026-68871 <a href="https://cve.org/CVERecord?id=CVE-2026-68871">[CVE]</a> <a href="./CVE-2026-68871.cve.json">[CVE json]</a> <a href="./CVE-2026-68871.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:46:11.681Z</em></p>
-<h3 id="affected-18">Affected</h3>
+<h3 id="affected-23">Affected</h3>
<ul>
<li>Apache Airflow Yandex provider before 4.5.1</li>
</ul>
-<h3 id="description-18">Description</h3>
+<h3 id="description-23">Description</h3>
<p>The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using [...]
-<h3 id="references-18">References</h3>
+<h3 id="references-23">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/70877">https://github.com/apache/airflow/pull/70877</a></li>
<li><a href="https://lists.apache.org/thread/jlj9tv085txk4t0j029mvh43mz89o63c">https://lists.apache.org/thread/jlj9tv085txk4t0j029mvh43mz89o63c</a></li>
</ul>
-<h3 id="credits-18">Credits</h3>
+<h3 id="credits-23">Credits</h3>
<ul>
<li>Apache Airflow security team (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -492,19 +591,19 @@
<h2 id="CVE-2026-68870">microsoft.azure Key Vault backend: team-scope guard bypass resolves another team’s Connection or Variable</h2>
<p>CVE-2026-68870 <a href="https://cve.org/CVERecord?id=CVE-2026-68870">[CVE]</a> <a href="./CVE-2026-68870.cve.json">[CVE json]</a> <a href="./CVE-2026-68870.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:46:09.502Z</em></p>
-<h3 id="affected-19">Affected</h3>
+<h3 id="affected-24">Affected</h3>
<ul>
<li>Apache Airflow Microsoft Azure provider before 14.1.0</li>
</ul>
-<h3 id="description-19">Description</h3>
+<h3 id="description-24">Description</h3>
<p>The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode [...]
-<h3 id="references-19">References</h3>
+<h3 id="references-24">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/70876">https://github.com/apache/airflow/pull/70876</a></li>
<li><a href="https://github.com/apache/airflow/pull/70899">https://github.com/apache/airflow/pull/70899</a></li>
<li><a href="https://lists.apache.org/thread/dtkk6vtfoj1y4zjyd6s3mzg0v5g9yg0p">https://lists.apache.org/thread/dtkk6vtfoj1y4zjyd6s3mzg0v5g9yg0p</a></li>
</ul>
-<h3 id="credits-19">Credits</h3>
+<h3 id="credits-24">Credits</h3>
<ul>
<li>Apache Airflow security team (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -512,18 +611,18 @@
<h2 id="CVE-2026-68868">google Secret Manager backend: team scope is never applied, exposing every team’s Connections and Variables</h2>
<p>CVE-2026-68868 <a href="https://cve.org/CVERecord?id=CVE-2026-68868">[CVE]</a> <a href="./CVE-2026-68868.cve.json">[CVE json]</a> <a href="./CVE-2026-68868.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:46:15.844Z</em></p>
-<h3 id="affected-20">Affected</h3>
+<h3 id="affected-25">Affected</h3>
<ul>
<li>Apache Airflow Google provider before 22.3.0</li>
</ul>
-<h3 id="description-20">Description</h3>
+<h3 id="description-25">Description</h3>
<p>The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's <code>team_name</code> was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Variable, obtaining its creden [...]
-<h3 id="references-20">References</h3>
+<h3 id="references-25">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/70869">https://github.com/apache/airflow/pull/70869</a></li>
<li><a href="https://lists.apache.org/thread/03h5y0fmqlh0yf055zlocxh591ozx69x">https://lists.apache.org/thread/03h5y0fmqlh0yf055zlocxh591ozx69x</a></li>
</ul>
-<h3 id="credits-20">Credits</h3>
+<h3 id="credits-25">Credits</h3>
<ul>
<li>Apache Airflow security team (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -531,19 +630,19 @@
<h2 id="CVE-2026-68076">Connections test API: team-scope guard bypass resolves another team’s environment Connection</h2>
<p>CVE-2026-68076 <a href="https://cve.org/CVERecord?id=CVE-2026-68076">[CVE]</a> <a href="./CVE-2026-68076.cve.json">[CVE json]</a> <a href="./CVE-2026-68076.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T15:05:05.218Z</em></p>
-<h3 id="affected-21">Affected</h3>
+<h3 id="affected-26">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.1</li>
</ul>
-<h3 id="description-21">Description</h3>
+<h3 id="description-26">Description</h3>
<p>Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are allowed to contain. When the guard did not apply, the lookup fell through to an unconditional global read that resolved the stored <code>AIRFLOW_CONN__&lt;TEAM&gt;___&lt;ID&gt;</c [...]
-<h3 id="references-21">References</h3>
+<h3 id="references-26">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/70736">https://github.com/apache/airflow/pull/70736</a></li>
<li><a href="https://github.com/apache/airflow/pull/70902">https://github.com/apache/airflow/pull/70902</a></li>
<li><a href="https://lists.apache.org/thread/v4mc51dgmrc1t82mhzsngsgzo2gxsf2l">https://lists.apache.org/thread/v4mc51dgmrc1t82mhzsngsgzo2gxsf2l</a></li>
</ul>
-<h3 id="credits-21">Credits</h3>
+<h3 id="credits-26">Credits</h3>
<ul>
<li>Andrew Rukin (Arenadata) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -551,20 +650,20 @@
<h2 id="CVE-2026-67587">DAG-author remote code execution on the Scheduler via a Serde <code>Callback</code> deserialization gadget</h2>
<p>CVE-2026-67587 <a href="https://cve.org/CVERecord?id=CVE-2026-67587">[CVE]</a> <a href="./CVE-2026-67587.cve.json">[CVE json]</a> <a href="./CVE-2026-67587.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:46:59.901Z</em></p>
-<h3 id="affected-22">Affected</h3>
+<h3 id="affected-27">Affected</h3>
<ul>
<li>Apache Airflow from 3.3.0 before 3.3.1</li>
</ul>
-<h3 id="description-22">Description</h3>
+<h3 id="description-27">Description</h3>
<p>Apache Airflow's Task SDK rebuilt a <code>Callback</code> object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because <code>SyncCallback</code> is itself an Airflow class it passes the default <code>allowed_deserialization_classes</code> allow-list, so tightening that setting does not help. A Dag author — who controls a task instance's <code>next_kwargs</code> through the task execution API — can therefore cause an arb [...]
-<h3 id="references-22">References</h3>
+<h3 id="references-27">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/70704">https://github.com/apache/airflow/pull/70704</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-58076">https://www.cve.org/CVERecord?id=CVE-2026-58076</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-67260">https://www.cve.org/CVERecord?id=CVE-2026-67260</a></li>
<li><a href="https://lists.apache.org/thread/o00ww4n69qojvsckb464dtwd2nhzy6t0">https://lists.apache.org/thread/o00ww4n69qojvsckb464dtwd2nhzy6t0</a></li>
</ul>
-<h3 id="credits-22">Credits</h3>
+<h3 id="credits-27">Credits</h3>
<ul>
<li>Nguyen Van Hiep (@hypnguyen1209), MBBank (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -572,19 +671,19 @@
<h2 id="CVE-2026-67260">DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization</h2>
<p>CVE-2026-67260 <a href="https://cve.org/CVERecord?id=CVE-2026-67260">[CVE]</a> <a href="./CVE-2026-67260.cve.json">[CVE json]</a> <a href="./CVE-2026-67260.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:46:57.273Z</em></p>
-<h3 id="affected-23">Affected</h3>
+<h3 id="affected-28">Affected</h3>
<ul>
<li>Apache Airflow from 3.3.0 before 3.3.1</li>
</ul>
-<h3 id="description-23">Description</h3>
+<h3 id="description-28">Description</h3>
<p>Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new <code>awaiting_input</code> task state swept by the scheduler. That sweep deserializes the task instance's <code>next_kwargs</code> without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an arbitrary module import and object instantiation inside the scheduler process, or terminate the scheduler job. No non-default configuration is required: the sweep runs [...]
-<h3 id="references-23">References</h3>
+<h3 id="references-28">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/70685">https://github.com/apache/airflow/pull/70685</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-58076">https://www.cve.org/CVERecord?id=CVE-2026-58076</a></li>
<li><a href="https://lists.apache.org/thread/vygr0fh82cjzjp5k4vtfmboxryvm3lyn">https://lists.apache.org/thread/vygr0fh82cjzjp5k4vtfmboxryvm3lyn</a></li>
</ul>
-<h3 id="credits-23">Credits</h3>
+<h3 id="credits-28">Credits</h3>
<ul>
<li>Erik Villegas (GitHub: @erik-451) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -592,20 +691,20 @@
<h2 id="CVE-2026-65017">Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)</h2>
<p>CVE-2026-65017 <a href="https://cve.org/CVERecord?id=CVE-2026-65017">[CVE]</a> <a href="./CVE-2026-65017.cve.json">[CVE json]</a> <a href="./CVE-2026-65017.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:47:01.247Z</em></p>
-<h3 id="affected-24">Affected</h3>
+<h3 id="affected-29">Affected</h3>
<ul>
<li>Apache Airflow from 3.3.0 before 3.3.1</li>
</ul>
-<h3 id="description-24">Description</h3>
+<h3 id="description-29">Description</h3>
<p>Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets masker matched only base section an [...]
-<h3 id="references-24">References</h3>
+<h3 id="references-29">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/70755">https://github.com/apache/airflow/pull/70755</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-48828">https://www.cve.org/CVERecord?id=CVE-2026-48828</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-48892">https://www.cve.org/CVERecord?id=CVE-2026-48892</a></li>
<li><a href="https://lists.apache.org/thread/kykn94kjf0tntx4wywtvjowh5bzdgf38">https://lists.apache.org/thread/kykn94kjf0tntx4wywtvjowh5bzdgf38</a></li>
</ul>
-<h3 id="credits-24">Credits</h3>
+<h3 id="credits-29">Credits</h3>
<ul>
<li>Andrew Rukin (Arenadata) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -613,18 +712,18 @@
<h2 id="CVE-2026-59245">FAB auth manager: a DAG named “DAGs” hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision)</h2>
<p>CVE-2026-59245 <a href="https://cve.org/CVERecord?id=CVE-2026-59245">[CVE]</a> <a href="./CVE-2026-59245.cve.json">[CVE json]</a> <a href="./CVE-2026-59245.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:45:59.383Z</em></p>
-<h3 id="affected-25">Affected</h3>
+<h3 id="affected-30">Affected</h3>
<ul>
<li>Apache Airflow FAB provider before 3.7.2</li>
</ul>
-<h3 id="description-25">Description</h3>
+<h3 id="description-30">Description</h3>
<p>In the Apache Airflow FAB auth manager, a DAG whose <code>dag_id</code> is <code>DAGs</code> collided with the global all-DAGs permission resource name produced by <code>resource_name()</code>, so a user granted per-DAG <code>access_control</code> on that one DAG was silently granted the global all-DAGs permission (privilege escalation). The escalation triggers when a DAG named <code>DAGs</code> exists and a lower-privileged user is given per-DAG access to it, granting that user read/ [...]
-<h3 id="references-25">References</h3>
+<h3 id="references-30">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/69106">https://github.com/apache/airflow/pull/69106</a></li>
<li><a href="https://lists.apache.org/thread/70f37q3mwov1vm3zolrfxlzds278c78h">https://lists.apache.org/thread/70f37q3mwov1vm3zolrfxlzds278c78h</a></li>
</ul>
-<h3 id="credits-25">Credits</h3>
+<h3 id="credits-30">Credits</h3>
<ul>
<li>Tran Hieu (h1tr3xnull) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -632,18 +731,18 @@
<h2 id="CVE-2026-59244">Secrets masker: <code>var.json</code> Variable values not masked in the Rendered Templates UI</h2>
<p>CVE-2026-59244 <a href="https://cve.org/CVERecord?id=CVE-2026-59244">[CVE]</a> <a href="./CVE-2026-59244.cve.json">[CVE json]</a> <a href="./CVE-2026-59244.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:46:03.573Z</em></p>
-<h3 id="affected-26">Affected</h3>
+<h3 id="affected-31">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.1</li>
</ul>
-<h3 id="description-26">Description</h3>
+<h3 id="description-31">Description</h3>
<p>Apache Airflow's secrets masker did not mask <code>var.json</code> Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an <code>isinstance(str)</code> guard — so a secret stored as a JSON Variable and referenced in a template via <code>var.json</code> was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardles [...]
-<h3 id="references-26">References</h3>
+<h3 id="references-31">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/68975">https://github.com/apache/airflow/pull/68975</a></li>
<li><a href="https://lists.apache.org/thread/fncod6vttfo5fvmfs3h9r8s2kmm9j1n6">https://lists.apache.org/thread/fncod6vttfo5fvmfs3h9r8s2kmm9j1n6</a></li>
</ul>
-<h3 id="credits-26">Credits</h3>
+<h3 id="credits-31">Credits</h3>
<ul>
<li>Juan Pablo Guereca (@jpgerek) (finder)</li>
<li>Juan Pablo Guereca (@jpgerek) (remediation developer)</li>
@@ -651,18 +750,18 @@
<h2 id="CVE-2026-59243">FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (<code>verify_signature</code> defaults to <code>False</code>)</h2>
<p>CVE-2026-59243 <a href="https://cve.org/CVERecord?id=CVE-2026-59243">[CVE]</a> <a href="./CVE-2026-59243.cve.json">[CVE json]</a> <a href="./CVE-2026-59243.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:46:01.303Z</em></p>
-<h3 id="affected-27">Affected</h3>
+<h3 id="affected-32">Affected</h3>
<ul>
<li>Apache Airflow FAB provider before 3.7.3</li>
</ul>
-<h3 id="description-27">Description</h3>
+<h3 id="description-32">Description</h3>
<p>The FAB auth manager's Azure AD OAuth login defaulted <code>verify_signature=False</code> when decoding the ID token, so an attacker able to present a forged or unsigned (<code>alg:none</code>) ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role (CWE-347). Deployments running the FAB auth manager with the Azure AD OAuth login path under its default configuration are affected; the Authentik path already defaul [...]
-<h3 id="references-27">References</h3>
+<h3 id="references-32">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/69374">https://github.com/apache/airflow/pull/69374</a></li>
<li><a href="https://lists.apache.org/thread/x4784l7z00tl3gw4tv2dmvoon77rxgpl">https://lists.apache.org/thread/x4784l7z00tl3gw4tv2dmvoon77rxgpl</a></li>
</ul>
-<h3 id="credits-27">Credits</h3>
+<h3 id="credits-32">Credits</h3>
<ul>
<li>MalHyuk (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -670,18 +769,18 @@
<h2 id="CVE-2026-59242">Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint</h2>
<p>CVE-2026-59242 <a href="https://cve.org/CVERecord?id=CVE-2026-59242">[CVE]</a> <a href="./CVE-2026-59242.cve.json">[CVE json]</a> <a href="./CVE-2026-59242.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:45:57.373Z</em></p>
-<h3 id="affected-28">Affected</h3>
+<h3 id="affected-33">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.1</li>
</ul>
-<h3 id="description-28">Description</h3>
+<h3 id="description-33">Description</h3>
<p>Apache Airflow's XCom <code>GET /api/v2/{...}/xcomEntries/{key}?deserialize=true</code> endpoint passed a string-literal payload through <code>BaseXCom.deserialize_value</code> without the <code>_check_forbidden_xcom_keys</code> guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary <code>airflow.*</code> classes on the API server (CWE-502). An authenticated user who can write an XCom value and then read it back with <code>deserialize=true</ [...]
-<h3 id="references-28">References</h3>
+<h3 id="references-33">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/69378">https://github.com/apache/airflow/pull/69378</a></li>
<li><a href="https://lists.apache.org/thread/dm0520yhh4mn7qknyoh45r2w6c5qg2mg">https://lists.apache.org/thread/dm0520yhh4mn7qknyoh45r2w6c5qg2mg</a></li>
</ul>
-<h3 id="credits-28">Credits</h3>
+<h3 id="credits-33">Credits</h3>
<ul>
<li>localhost-detect (@localhost-detect) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -689,19 +788,19 @@
<h2 id="CVE-2026-58076">Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server</h2>
<p>CVE-2026-58076 <a href="https://cve.org/CVERecord?id=CVE-2026-58076">[CVE]</a> <a href="./CVE-2026-58076.cve.json">[CVE json]</a> <a href="./CVE-2026-58076.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:46:54.580Z</em></p>
-<h3 id="affected-29">Affected</h3>
+<h3 id="affected-34">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.3.1</li>
</ul>
-<h3 id="description-29">Description</h3>
+<h3 id="description-34">Description</h3>
<p>Apache Airflow's serialization layer reconstructed exception nodes by calling <code>import_string()</code> on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's <code>executor_config</code> reaches that branch, so a Dag author could place a value there that causes an arbitrary callable to be imported and invoked – for example <code>subprocess.check_output</code>, or <cod [...]
-<h3 id="references-29">References</h3>
+<h3 id="references-34">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/68511">https://github.com/apache/airflow/pull/68511</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-33264">https://www.cve.org/CVERecord?id=CVE-2026-33264</a></li>
<li><a href="https://lists.apache.org/thread/t81p688t15jozxsng8521o60nh2kfsos">https://lists.apache.org/thread/t81p688t15jozxsng8521o60nh2kfsos</a></li>
</ul>
-<h3 id="credits-29">Credits</h3>
+<h3 id="credits-34">Credits</h3>
<ul>
<li>Jan Kahmen (turingpoint), GitHub: @kah-ja (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -709,18 +808,18 @@
<h2 id="CVE-2026-58065">Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key verification</h2>
<p>CVE-2026-58065 <a href="https://cve.org/CVERecord?id=CVE-2026-58065">[CVE]</a> <a href="./CVE-2026-58065.cve.json">[CVE json]</a> <a href="./CVE-2026-58065.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T15:05:21.274Z</em></p>
-<h3 id="affected-30">Affected</h3>
+<h3 id="affected-35">Affected</h3>
<ul>
<li>Apache Airflow Git provider before 0.4.1</li>
</ul>
-<h3 id="description-30">Description</h3>
+<h3 id="description-35">Description</h3>
<p>The Apache Airflow Git provider runs its git-over-SSH operations with <code>StrictHostKeyChecking=no</code> by default, disabling SSH host-key verification. An attacker who can intercept the network path between an Airflow worker and the Git server can impersonate the server (man-in-the-middle), capturing the SSH deploy key or injecting malicious repository content. Deployments that use the Git DAG bundle or Git provider to clone over SSH with a deploy key are affected. The fix change [...]
-<h3 id="references-30">References</h3>
+<h3 id="references-35">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/69103">https://github.com/apache/airflow/pull/69103</a></li>
<li><a href="https://lists.apache.org/thread/fjmclngfksz2kp7llpcjxzdz568h0zhc">https://lists.apache.org/thread/fjmclngfksz2kp7llpcjxzdz568h0zhc</a></li>
</ul>
-<h3 id="credits-30">Credits</h3>
+<h3 id="credits-35">Credits</h3>
<ul>
<li>Siyang Wu (independent researcher) (finder)</li>
<li>Ephraim Anierobi (remediation developer)</li>
@@ -728,19 +827,19 @@
<h2 id="CVE-2026-54183">Airflow Variables were not masked in the UI for authenticated users</h2>
<p>CVE-2026-54183 <a href="https://cve.org/CVERecord?id=CVE-2026-54183">[CVE]</a> <a href="./CVE-2026-54183.cve.json">[CVE json]</a> <a href="./CVE-2026-54183.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:46:55.864Z</em></p>
-<h3 id="affected-31">Affected</h3>
+<h3 id="affected-36">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.1</li>
</ul>
-<h3 id="description-31">Description</h3>
+<h3 id="description-36">Description</h3>
<p>Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was shown unmasked in the Variables UI. The exposure is limited to the UI: any authenticated user who can see the Variable in the UI can already read its full value through the Variables REST API, so [...]
-<h3 id="references-31">References</h3>
+<h3 id="references-36">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/68422">https://github.com/apache/airflow/pull/68422</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-42358">https://www.cve.org/CVERecord?id=CVE-2026-42358</a></li>
<li><a href="https://lists.apache.org/thread/z5mrdq6c60f2wyx4cc64cj8nv0dxd9lo">https://lists.apache.org/thread/z5mrdq6c60f2wyx4cc64cj8nv0dxd9lo</a></li>
</ul>
-<h3 id="credits-31">Credits</h3>
+<h3 id="credits-36">Credits</h3>
<ul>
<li>Omkhar Arasaratnam (@omkhar) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -748,18 +847,18 @@
<h2 id="CVE-2026-50203">Path traversal in SFTPHook.retrieve_directory allows local file write outside the destination directory via malicious server-supplied directory-entry names</h2>
<p>CVE-2026-50203 <a href="https://cve.org/CVERecord?id=CVE-2026-50203">[CVE]</a> <a href="./CVE-2026-50203.cve.json">[CVE json]</a> <a href="./CVE-2026-50203.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-17T01:48:06.460Z</em></p>
-<h3 id="affected-32">Affected</h3>
+<h3 id="affected-37">Affected</h3>
<ul>
<li>Apache Airflow SFTP provider before 5.8.1</li>
</ul>
-<h3 id="description-32">Description</h3>
+<h3 id="description-37">Description</h3>
<p>A path traversal in the SFTP provider (<code>SFTPHook.retrieve_directory</code> / <code>SFTPOperator(operation=get)</code>) let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is any deployment downloading directories from an untrusted SFTP server. Upgrade <code>apache-airflow-providers-sftp</code> to 5.8.1 or later.</p>
-<h3 id="references-32">References</h3>
+<h3 id="references-37">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67985">https://github.com/apache/airflow/pull/67985</a></li>
<li><a href="https://lists.apache.org/thread/7f4b284oh44c1n95oq8mh1qc7y1lr9dx">https://lists.apache.org/thread/7f4b284oh44c1n95oq8mh1qc7y1lr9dx</a></li>
</ul>
-<h3 id="credits-32">Credits</h3>
+<h3 id="credits-37">Credits</h3>
<ul>
<li>secuholic (finder)</li>
<li>Venkatraman Kumar (r3dw0lfsec), Securin (finder)</li>
@@ -768,18 +867,18 @@
<h2 id="CVE-2026-49818">Path traversal in GCSToSambaOperator via GCS object names</h2>
<p>CVE-2026-49818 <a href="https://cve.org/CVERecord?id=CVE-2026-49818">[CVE]</a> <a href="./CVE-2026-49818.cve.json">[CVE json]</a> <a href="./CVE-2026-49818.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-10T17:37:51.189Z</em></p>
-<h3 id="affected-33">Affected</h3>
+<h3 id="affected-38">Affected</h3>
<ul>
<li>Apache Airflow Samba provider before 4.12.6</li>
</ul>
-<h3 id="description-33">Description</h3>
+<h3 id="description-38">Description</h3>
<p>The Apache Airflow Samba provider's <code>GCSToSambaOperator</code> joined GCS object names to the SMB destination path without a containment check, so an object named with <code>../</code> segments resolved a write path outside the configured <code>destination_path</code>. An attacker able to write objects into the source GCS bucket — typically an external data producer distinct from the trusted DAG author — could write files to arbitrary locations on the Samba target when the operat [...]
-<h3 id="references-33">References</h3>
+<h3 id="references-38">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67857">https://github.com/apache/airflow/pull/67857</a></li>
<li><a href="https://lists.apache.org/thread/3vs0m3p51psgf54tts18d6336g24x3sf">https://lists.apache.org/thread/3vs0m3p51psgf54tts18d6336g24x3sf</a></li>
</ul>
-<h3 id="credits-33">Credits</h3>
+<h3 id="credits-38">Credits</h3>
<ul>
<li>secuholic (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -787,18 +886,18 @@
<h2 id="CVE-2026-49487">Task-instance API exposes secrets in deferred trigger kwargs</h2>
<p>CVE-2026-49487 <a href="https://cve.org/CVERecord?id=CVE-2026-49487">[CVE]</a> <a href="./CVE-2026-49487.cve.json">[CVE json]</a> <a href="./CVE-2026-49487.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:45:52.041Z</em></p>
-<h3 id="affected-34">Affected</h3>
+<h3 id="affected-39">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.0</li>
</ul>
-<h3 id="description-34">Description</h3>
+<h3 id="description-39">Description</h3>
<p>In Apache Airflow before 3.3.0, the REST API task-instance detail and list<br>endpoints returned a deferred task's trigger kwargs without masking. When a<br>deferred operator passed a secret (for example a provider API key) into its<br>trigger, any authenticated user with DAG-scoped task-instance read access for<br>that DAG could read that secret in clear text while the task was deferred.<br>Users should upgrade to apache-airflow 3.3.0 or later, which masks sensitive<br>values in trig [...]
-<h3 id="references-34">References</h3>
+<h3 id="references-39">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67868">https://github.com/apache/airflow/pull/67868</a></li>
<li><a href="https://lists.apache.org/thread/qlw6pozlzlfhkvmbgqsbjlq6vj4v0pc4">https://lists.apache.org/thread/qlw6pozlzlfhkvmbgqsbjlq6vj4v0pc4</a></li>
</ul>
-<h3 id="credits-34">Credits</h3>
+<h3 id="credits-39">Credits</h3>
<ul>
<li>Andrew Rukin (Arenadata) (finder)</li>
<li>Jarek Potiuk (@potiuk) (remediation developer)</li>
@@ -806,18 +905,18 @@
<h2 id="CVE-2026-49486">FTP Provider does not protect FTPS data channel (missing PROT_P)</h2>
<p>CVE-2026-49486 <a href="https://cve.org/CVERecord?id=CVE-2026-49486">[CVE]</a> <a href="./CVE-2026-49486.cve.json">[CVE json]</a> <a href="./CVE-2026-49486.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:45:46.269Z</em></p>
-<h3 id="affected-35">Affected</h3>
+<h3 id="affected-40">Affected</h3>
<ul>
<li>Apache Airflow FTP provider before 3.15.1</li>
</ul>
-<h3 id="description-35">Description</h3>
+<h3 id="description-40">Description</h3>
<p>The Apache Airflow FTP provider's <code>FTPSHook.get_conn()</code> created an <code>ftplib.FTP_TLS</code> connection but never called <code>prot_p()</code>, so although the control channel was TLS-protected the data channel was transmitted in cleartext. Any deployment using <code>FTPSHook</code> or <code>FTPSFileTransmitOperator</code> to move files over FTPS exposed file contents and credentials-in-transit to a network attacker able to observe the data connection. Upgrade apache-airf [...]
-<h3 id="references-35">References</h3>
+<h3 id="references-40">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67946">https://github.com/apache/airflow/pull/67946</a></li>
<li><a href="https://lists.apache.org/thread/gwnsxlt9hfj5pc543wxtogbnjdn04xj1">https://lists.apache.org/thread/gwnsxlt9hfj5pc543wxtogbnjdn04xj1</a></li>
</ul>
-<h3 id="credits-35">Credits</h3>
+<h3 id="credits-40">Credits</h3>
<ul>
<li>Andrew Rukin (Arenadata) (finder)</li>
<li>Shubham Raj (remediation developer)</li>
@@ -825,18 +924,18 @@
<h2 id="CVE-2026-49298">JWT Token Exposure in KubernetesExecutor Command-Line Arguments</h2>
<p>CVE-2026-49298 <a href="https://cve.org/CVERecord?id=CVE-2026-49298">[CVE]</a> <a href="./CVE-2026-49298.cve.json">[CVE json]</a> <a href="./CVE-2026-49298.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:34:31.163Z</em></p>
-<h3 id="affected-36">Affected</h3>
+<h3 id="affected-41">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.2</li>
</ul>
-<h3 id="description-36">Description</h3>
+<h3 id="description-41">Description</h3>
<p>A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate against the Execution API to be passed to the worker container as command-line arguments visible in the pod spec. An authenticated UI/API user with Kubernetes read-only access to the cluster (e.g. <code>pods/get</code> in the Airflow namespace) could harvest the JWT from <code>kubectl describe pod</code> output and then call state-mutating Execution API endpoints — triggering Dag runs, c [...]
-<h3 id="references-36">References</h3>
+<h3 id="references-41">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/60108">https://github.com/apache/airflow/pull/60108</a></li>
<li><a href="https://lists.apache.org/thread/wo09vrks8189dzsot39rvrx3vnx102tt">https://lists.apache.org/thread/wo09vrks8189dzsot39rvrx3vnx102tt</a></li>
</ul>
-<h3 id="credits-36">Credits</h3>
+<h3 id="credits-41">Credits</h3>
<ul>
<li>Nikolai Dvoinishnikov (<a href="mailto:nikdvy@gmail.com">nikdvy@gmail.com</a>) (finder)</li>
<li>Anton Kuznetsov (<a href="mailto:piratusxp@gmail.com">piratusxp@gmail.com</a>) (finder)</li>
@@ -845,18 +944,18 @@
<h2 id="CVE-2026-49297">Path traversal via GCS object names → local/SFTP filesystem (GCSToSFTPOperator + GCSTimeSpanFileTransformOperator)</h2>
<p>CVE-2026-49297 <a href="https://cve.org/CVERecord?id=CVE-2026-49297">[CVE]</a> <a href="./CVE-2026-49297.cve.json">[CVE json]</a> <a href="./CVE-2026-49297.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-07-04T05:57:06.977Z</em></p>
-<h3 id="affected-37">Affected</h3>
+<h3 id="affected-42">Affected</h3>
<ul>
<li>Apache Airflow Google provider before 22.2.1</li>
</ul>
-<h3 id="description-37">Description</h3>
+<h3 id="description-42">Description</h3>
<p>Apache Airflow's Google provider operators <code>GCSToSFTPOperator</code> and <code>GCSTimeSpanFileTransformOperator</code> joined GCS object names returned by the bucket listing API directly to a destination filesystem path without normalisation or containment check. A user with write access to the source GCS bucket (typically a different trust principal than the DAG author — partner uploads, ingest-only service accounts, public-data buckets) could create an object whose name contain [...]
-<h3 id="references-37">References</h3>
+<h3 id="references-42">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67667">https://github.com/apache/airflow/pull/67667</a></li>
<li><a href="https://lists.apache.org/thread/cb5nvoxsj1q7rv878cyqgtg150w0zglq?users@airflow.apache.org">https://lists.apache.org/thread/cb5nvoxsj1q7rv878cyqgtg150w0zglq?users@airflow.apache.org</a></li>
</ul>
-<h3 id="credits-37">Credits</h3>
+<h3 id="credits-42">Credits</h3>
<ul>
<li>anonymous (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -864,18 +963,18 @@
<h2 id="CVE-2026-49296">Per-DAG read bypass discloses co-located DAGs’ source via GET /api/v2/dagSources/{dag_id}</h2>
<p>CVE-2026-49296 <a href="https://cve.org/CVERecord?id=CVE-2026-49296">[CVE]</a> <a href="./CVE-2026-49296.cve.json">[CVE json]</a> <a href="./CVE-2026-49296.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:45:50.190Z</em></p>
-<h3 id="affected-38">Affected</h3>
+<h3 id="affected-43">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.3.0</li>
</ul>
-<h3 id="description-38">Description</h3>
+<h3 id="description-43">Description</h3>
<p>Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. <code>GET /api/v2/dagSources/{dag_id}</code> — and the equivalent Dag-source view in the UI — returned the entire source file without redacting Dags the caller was not authorized to read, bypassing per-DAG read authorization. Deployments that co-locate multiple Dags in a single file and rely on per-DAG access control to limit source visibility are [...]
-<h3 id="references-38">References</h3>
+<h3 id="references-43">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67662">https://github.com/apache/airflow/pull/67662</a></li>
<li><a href="https://lists.apache.org/thread/qqv41t3oydkn9o14r2rfz1wkdrsp5jzn">https://lists.apache.org/thread/qqv41t3oydkn9o14r2rfz1wkdrsp5jzn</a></li>
</ul>
-<h3 id="credits-38">Credits</h3>
+<h3 id="credits-43">Credits</h3>
<ul>
<li>Matteo Panzeri (Università di Pavia), GitHub @matte1782 (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -883,18 +982,18 @@
<h2 id="CVE-2026-49267">No certificate validation on SMTP STARTTLS connections</h2>
<p>CVE-2026-49267 <a href="https://cve.org/CVERecord?id=CVE-2026-49267">[CVE]</a> <a href="./CVE-2026-49267.cve.json">[CVE json]</a> <a href="./CVE-2026-49267.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:53:11.785Z</em></p>
-<h3 id="affected-39">Affected</h3>
+<h3 id="affected-44">Affected</h3>
<ul>
<li>Apache Airflow from 2.0.0 before 3.2.2</li>
</ul>
-<h3 id="description-39">Description</h3>
+<h3 id="description-44">Description</h3>
<p>Apache Airflow's EmailOperator and the underlying <code>airflow.utils.email</code> helpers established SMTP STARTTLS connections without verifying the remote certificate when the deployment used <code>[email] smtp_starttls=True</code> without <code>[email] smtp_ssl</code>. An attacker positioned between the worker and the configured SMTP server (network MITM — typical hostile-network attack-surface for environments where the SMTP relay sits outside the worker's trust boundary) could p [...]
-<h3 id="references-39">References</h3>
+<h3 id="references-44">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65346">https://github.com/apache/airflow/pull/65346</a></li>
<li><a href="https://lists.apache.org/thread/6v2ds757000msmjmovnnqryqzks83ps0">https://lists.apache.org/thread/6v2ds757000msmjmovnnqryqzks83ps0</a></li>
</ul>
-<h3 id="credits-39">Credits</h3>
+<h3 id="credits-44">Credits</h3>
<ul>
<li>Francis Bergin (@francisbergin) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -902,18 +1001,18 @@
<h2 id="CVE-2026-48892">Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options</h2>
<p>CVE-2026-48892 <a href="https://cve.org/CVERecord?id=CVE-2026-48892">[CVE]</a> <a href="./CVE-2026-48892.cve.json">[CVE json]</a> <a href="./CVE-2026-48892.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:45:44.357Z</em></p>
-<h3 id="affected-40">Affected</h3>
+<h3 id="affected-45">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.0</li>
</ul>
-<h3 id="description-40">Description</h3>
+<h3 id="description-45">Description</h3>
<p>The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like <code>AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID</code> and <code>AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID</code>) as synthetic config options whose option names were not in <code>sensitive_config_values</code>, so the masker did not redact them. An authenticated UI/API user with Config read permission could retrieve plaintext secrets-backend credentials (Vault <code>role_ [...]
-<h3 id="references-40">References</h3>
+<h3 id="references-45">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67622">https://github.com/apache/airflow/pull/67622</a></li>
<li><a href="https://lists.apache.org/thread/pq5yy40079h6tzh3fxvw28dd8dbk72hk">https://lists.apache.org/thread/pq5yy40079h6tzh3fxvw28dd8dbk72hk</a></li>
</ul>
-<h3 id="credits-40">Credits</h3>
+<h3 id="credits-45">Credits</h3>
<ul>
<li>Omkhar Arasaratnam (@omkhar) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -921,19 +1020,19 @@
<h2 id="CVE-2026-48891">/ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target</h2>
<p>CVE-2026-48891 <a href="https://cve.org/CVERecord?id=CVE-2026-48891">[CVE]</a> <a href="./CVE-2026-48891.cve.json">[CVE json]</a> <a href="./CVE-2026-48891.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:45:48.267Z</em></p>
-<h3 id="affected-41">Affected</h3>
+<h3 id="affected-46">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.0</li>
</ul>
-<h3 id="description-41">Description</h3>
+<h3 id="description-46">Description</h3>
<p>A bug in Apache Airflow's <code>/ui/dependencies</code> scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the <code>dep.source</code> and <code>dep.target</code> fields of trigger / sensor dependency entries. An authenticated UI user with read permission on some Dags could enumerate the identifiers of other Dags they were not authorized to read by inspecting the dependency graph for trigg [...]
-<h3 id="references-41">References</h3>
+<h3 id="references-46">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67627">https://github.com/apache/airflow/pull/67627</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-28563">https://www.cve.org/CVERecord?id=CVE-2026-28563</a></li>
<li><a href="https://lists.apache.org/thread/wzc8nflg94rq6w8f5tvtlo0o3g4wjrfl">https://lists.apache.org/thread/wzc8nflg94rq6w8f5tvtlo0o3g4wjrfl</a></li>
</ul>
-<h3 id="credits-41">Credits</h3>
+<h3 id="credits-46">Credits</h3>
<ul>
<li>Mitchell Benjamin / Revamp Studio (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -941,18 +1040,18 @@
<h2 id="CVE-2026-48828">Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key</h2>
<p>CVE-2026-48828 <a href="https://cve.org/CVERecord?id=CVE-2026-48828">[CVE]</a> <a href="./CVE-2026-48828.cve.json">[CVE json]</a> <a href="./CVE-2026-48828.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-16T14:45:42.320Z</em></p>
-<h3 id="affected-42">Affected</h3>
+<h3 id="affected-47">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.0</li>
</ul>
-<h3 id="description-42">Description</h3>
+<h3 id="description-47">Description</h3>
<p>The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based <code>should_hide_value_for_key</code> check (which triggers on secret-suffixed key names like <code>*_password</code> / <code>*_token</code> / <code>*_secret</code>) could not fire for JSON-decodable variable values. An authenticated UI/API user with bulk Variable read permission could retrieve plaintext values from JSON variables whose key would otherwise trigger redacti [...]
-<h3 id="references-42">References</h3>
+<h3 id="references-47">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67495">https://github.com/apache/airflow/pull/67495</a></li>
<li><a href="https://lists.apache.org/thread/y9kf314t6dhnv994hr11wj3tbow847yc">https://lists.apache.org/thread/y9kf314t6dhnv994hr11wj3tbow847yc</a></li>
</ul>
-<h3 id="credits-42">Credits</h3>
+<h3 id="credits-47">Credits</h3>
<ul>
<li>Omkhar Arasaratnam (@omkhar) (finder)</li>
<li>Shubham Raj (@shubhamraj-git) (remediation developer)</li>
@@ -960,19 +1059,19 @@
<h2 id="CVE-2026-48726">revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path</h2>
<p>CVE-2026-48726 <a href="https://cve.org/CVERecord?id=CVE-2026-48726">[CVE]</a> <a href="./CVE-2026-48726.cve.json">[CVE json]</a> <a href="./CVE-2026-48726.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:35:18.096Z</em></p>
-<h3 id="affected-43">Affected</h3>
+<h3 id="affected-48">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.2</li>
</ul>
-<h3 id="description-43">Description</h3>
+<h3 id="description-48">Description</h3>
<p>A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for <code>FabAuthManager</code> and <code>KeycloakAuthManager</code> did not actually reach the underlying <code>revoke_token()</code> call, so the JWT remained accepted by the API server until its natural expiry. An attacker holding a previously-issued JWT for a logged-out user could continue to make authenticated API calls as that us [...]
-<h3 id="references-43">References</h3>
+<h3 id="references-48">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67289">https://github.com/apache/airflow/pull/67289</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2025-57735">https://www.cve.org/CVERecord?id=CVE-2025-57735</a></li>
<li><a href="https://lists.apache.org/thread/630jg4z6cjkv4m2yv2ljgmf1zhdj1vqx">https://lists.apache.org/thread/630jg4z6cjkv4m2yv2ljgmf1zhdj1vqx</a></li>
</ul>
-<h3 id="credits-43">Credits</h3>
+<h3 id="credits-48">Credits</h3>
<ul>
<li>Bernardo Curi (r3ngar_bugado) (finder)</li>
<li>pierrejeambrun (remediation developer)</li>
@@ -980,18 +1079,18 @@
<h2 id="CVE-2026-46764">Event Log detail endpoint bypasses DAG-scoped event log permission filter</h2>
<p>CVE-2026-46764 <a href="https://cve.org/CVERecord?id=CVE-2026-46764">[CVE]</a> <a href="./CVE-2026-46764.cve.json">[CVE json]</a> <a href="./CVE-2026-46764.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:45:46.820Z</em></p>
-<h3 id="affected-44">Affected</h3>
+<h3 id="affected-49">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.2</li>
</ul>
-<h3 id="description-44">Description</h3>
+<h3 id="description-49">Description</h3>
<p>The Event Log detail endpoint <code>GET /api/v2/eventLogs/{event_log_id}</code> in Apache Airflow fetched audit-log rows directly by numeric ID after only the generic Audit Log permission check, while the collection endpoint <code>GET /api/v2/eventLogs</code> applied per-Dag scoping. An authenticated UI/API user with audit-log read permission for one Dag could retrieve audit-log entries for any other Dag by guessing or enumerating the numeric event log ID. Affects deployments that rel [...]
-<h3 id="references-44">References</h3>
+<h3 id="references-49">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/67112">https://github.com/apache/airflow/pull/67112</a></li>
<li><a href="https://lists.apache.org/thread/ctrbj7q3m86g4qxmo9ponojgmzrcoqpv">https://lists.apache.org/thread/ctrbj7q3m86g4qxmo9ponojgmzrcoqpv</a></li>
</ul>
-<h3 id="credits-44">Credits</h3>
+<h3 id="credits-49">Credits</h3>
<ul>
<li>Stoyan Stoyanov Trendafilov (trstoyan), independent security researcher (finder)</li>
<li>Pierre Jeambrun (@pierrejeambrun) (remediation developer)</li>
@@ -999,18 +1098,18 @@
<h2 id="CVE-2026-46745">LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token</h2>
<p>CVE-2026-46745 <a href="https://cve.org/CVERecord?id=CVE-2026-46745">[CVE]</a> <a href="./CVE-2026-46745.cve.json">[CVE json]</a> <a href="./CVE-2026-46745.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-25T11:30:22.680Z</em></p>
-<h3 id="affected-45">Affected</h3>
+<h3 id="affected-50">Affected</h3>
<ul>
<li>Apache Airflow FAB provider before 3.6.4</li>
</ul>
-<h3 id="description-45">Description</h3>
+<h3 id="description-50">Description</h3>
<p>Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.</p>
-<h3 id="references-45">References</h3>
+<h3 id="references-50">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/66417">https://github.com/apache/airflow/pull/66417</a></li>
<li><a href="https://lists.apache.org/thread/dvfy0bs181xwsrjrd3y5c55ztbzm8yhh">https://lists.apache.org/thread/dvfy0bs181xwsrjrd3y5c55ztbzm8yhh</a></li>
</ul>
-<h3 id="credits-45">Credits</h3>
+<h3 id="credits-50">Credits</h3>
<ul>
<li>Venkatraman Kumar (r3dw0lfsec), Securin (finder)</li>
<li>orbisai0security (automated scanner — Orbis Security AI) (remediation developer)</li>
@@ -1018,18 +1117,18 @@
<h2 id="CVE-2026-45426">Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access</h2>
<p>CVE-2026-45426 <a href="https://cve.org/CVERecord?id=CVE-2026-45426">[CVE]</a> <a href="./CVE-2026-45426.cve.json">[CVE json]</a> <a href="./CVE-2026-45426.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:47:13.162Z</em></p>
-<h3 id="affected-46">Affected</h3>
+<h3 id="affected-51">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.2</li>
</ul>
-<h3 id="description-46">Description</h3>
+<h3 id="description-51">Description</h3>
<p>Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued for at least one Dag. Apache Airflow's Log server authorized JWT tokens against Dag IDs by applying Python's <code>str.lstrip()</code> to the requested path segment when verifying the JWT's <code>sub</code> claim. <code>str.lstrip()</code> strips any of a <em>set</em> of characters from the left (not a prefix), so a JWT issued for a Dag named e.g. <code>dag_a</code> w [...]
-<h3 id="references-46">References</h3>
+<h3 id="references-51">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/66749">https://github.com/apache/airflow/pull/66749</a></li>
<li><a href="https://lists.apache.org/thread/hz1q7vg65vq2h4fobv5ww8tp257fbqj9">https://lists.apache.org/thread/hz1q7vg65vq2h4fobv5ww8tp257fbqj9</a></li>
</ul>
-<h3 id="credits-46">Credits</h3>
+<h3 id="credits-51">Credits</h3>
<ul>
<li>Michael Lip (theluckystrike) (finder)</li>
<li>Jarek Potiuk (@potiuk) (remediation developer)</li>
@@ -1037,18 +1136,18 @@
<h2 id="CVE-2026-45361">SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)</h2>
<p>CVE-2026-45361 <a href="https://cve.org/CVERecord?id=CVE-2026-45361">[CVE]</a> <a href="./CVE-2026-45361.cve.json">[CVE json]</a> <a href="./CVE-2026-45361.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T15:48:33.023Z</em></p>
-<h3 id="affected-47">Affected</h3>
+<h3 id="affected-52">Affected</h3>
<ul>
<li>Apache Airflow Google provider before 22.0.0</li>
</ul>
-<h3 id="description-47">Description</h3>
+<h3 id="description-52">Description</h3>
<p>Apache Airflow providers-google's <code>ComputeEngineSSHHook</code> disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to <code>apache-airflow-providers-google</code> 22.0.0 or later.</p>
-<h3 id="references-47">References</h3>
+<h3 id="references-52">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/66746">https://github.com/apache/airflow/pull/66746</a></li>
<li><a href="https://lists.apache.org/thread/3lpj7ppwxp7jtp81rnxk75xvln7qd7h2?users@airflow.apache.org">https://lists.apache.org/thread/3lpj7ppwxp7jtp81rnxk75xvln7qd7h2?users@airflow.apache.org</a></li>
</ul>
-<h3 id="credits-47">Credits</h3>
+<h3 id="credits-52">Credits</h3>
<ul>
<li>anonymous (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -1056,36 +1155,36 @@
<h2 id="CVE-2026-45360">Arbitrary import in custom deadline-reference deserialization</h2>
<p>CVE-2026-45360 <a href="https://cve.org/CVERecord?id=CVE-2026-45360">[CVE]</a> <a href="./CVE-2026-45360.cve.json">[CVE json]</a> <a href="./CVE-2026-45360.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:48:10.959Z</em></p>
-<h3 id="affected-48">Affected</h3>
+<h3 id="affected-53">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.2</li>
</ul>
-<h3 id="description-48">Description</h3>
+<h3 id="description-53">Description</h3>
<p>Apache Airflow's scheduler-side deadline-reference decoder (<code>SerializedCustomReference.deserialize_reference</code>) imported and dispatched arbitrary class paths drawn from DAG-author-controlled serialized state without an allowlist or plugin-registry gate. A DAG author whose code reaches the scheduler — the default on single-host deployments where the DAG bundle is importable from the scheduler process — could embed a custom <code>DeadlineReference</code> whose serialized form [...]
-<h3 id="references-48">References</h3>
+<h3 id="references-53">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/66737">https://github.com/apache/airflow/pull/66737</a></li>
<li><a href="https://lists.apache.org/thread/q227dghjwgfz8xsxrf2pwpz4wk43zm83">https://lists.apache.org/thread/q227dghjwgfz8xsxrf2pwpz4wk43zm83</a></li>
</ul>
-<h3 id="credits-48">Credits</h3>
+<h3 id="credits-53">Credits</h3>
<ul>
<li>Jarek Potiuk (remediation developer)</li>
</ul>
<h2 id="CVE-2026-45192">Incomplete Redaction of Sensitive Fields in Connection Extra API Response</h2>
<p>CVE-2026-45192 <a href="https://cve.org/CVERecord?id=CVE-2026-45192">[CVE]</a> <a href="./CVE-2026-45192.cve.json">[CVE json]</a> <a href="./CVE-2026-45192.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T06:51:50.457Z</em></p>
-<h3 id="affected-49">Affected</h3>
+<h3 id="affected-54">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.2</li>
</ul>
-<h3 id="description-49">Description</h3>
+<h3 id="description-54">Description</h3>
<p>A bug in the GET <code>/api/v2/connections/{connection_id}</code> REST API endpoint in Apache Airflow allowed an authenticated UI/API user with Connection-read permission to retrieve secrets stored in a Connection's <code>extra</code> JSON blob under field names not present in the redaction allowlist (<code>DEFAULT_SENSITIVE_FIELDS</code>) — for example, official Slack-provider credential field names were returned in plaintext. Affects deployments that store credentials in Connection [...]
-<h3 id="references-49">References</h3>
+<h3 id="references-54">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/66673">https://github.com/apache/airflow/pull/66673</a></li>
<li><a href="https://lists.apache.org/thread/r2q93dg2wp5h9sd9vh6y4y5ljqd9crdd">https://lists.apache.org/thread/r2q93dg2wp5h9sd9vh6y4y5ljqd9crdd</a></li>
</ul>
-<h3 id="credits-49">Credits</h3>
+<h3 id="credits-54">Credits</h3>
<ul>
<li>Or Sahar, Secure From Scratch (finder)</li>
<li>Jarek Potiuk (@potiuk) (remediation developer)</li>
@@ -1093,18 +1192,18 @@
<h2 id="CVE-2026-43826">OpenSearch task-log handler leaks credentials embedded in the host URL</h2>
<p>CVE-2026-43826 <a href="https://cve.org/CVERecord?id=CVE-2026-43826">[CVE]</a> <a href="./CVE-2026-43826.cve.json">[CVE json]</a> <a href="./CVE-2026-43826.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-10T20:27:25.758Z</em></p>
-<h3 id="affected-50">Affected</h3>
+<h3 id="affected-55">Affected</h3>
<ul>
<li>Apache Airflow Providers OpenSearch before 1.9.1</li>
</ul>
-<h3 id="description-50">Description</h3>
+<h3 id="description-55">Description</h3>
<p>The OpenSearch logging provider, when configured with a <code>host</code> URL that embeds credentials (for example <code>https://user:password@server.example.com:9200</code>), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to <code>apache-airflow-providers-opensearch</code> 1.9.1 or later and, as a defense-in-depth measure, configure the backend cr [...]
-<h3 id="references-50">References</h3>
+<h3 id="references-55">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65509">https://github.com/apache/airflow/pull/65509</a></li>
<li><a href="https://lists.apache.org/thread/bxsrqx1vwssovnwnrvgh9xcosptmf73y">https://lists.apache.org/thread/bxsrqx1vwssovnwnrvgh9xcosptmf73y</a></li>
</ul>
-<h3 id="credits-50">Credits</h3>
+<h3 id="credits-55">Credits</h3>
<ul>
<li>Aleksandr Sozinov (finder)</li>
<li>Owen-CH-Leung (finder)</li>
@@ -1113,36 +1212,36 @@
<h2 id="CVE-2026-42526">Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends</h2>
<p>CVE-2026-42526 <a href="https://cve.org/CVERecord?id=CVE-2026-42526">[CVE]</a> <a href="./CVE-2026-42526.cve.json">[CVE json]</a> <a href="./CVE-2026-42526.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-20T01:48:06.454Z</em></p>
-<h3 id="affected-51">Affected</h3>
+<h3 id="affected-56">Affected</h3>
<ul>
<li>Apache Airflow Amazon provider before 9.28.0</li>
</ul>
-<h3 id="description-51">Description</h3>
+<h3 id="description-56">Description</h3>
<p>In the AWS Secrets Manager and SSM Parameter Store secrets backends of <code>apache-airflow-providers-amazon</code> prior to 9.28.0, the team-scoping logic could resolve a <code>conn_id</code> containing a <code>/</code> (e.g. <code>&quot;my_team/conn&quot;</code>) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding <code>conn_i [...]
-<h3 id="references-51">References</h3>
+<h3 id="references-56">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65703">https://github.com/apache/airflow/pull/65703</a></li>
<li><a href="https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtyn">https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtyn</a></li>
</ul>
-<h3 id="credits-51">Credits</h3>
+<h3 id="credits-56">Credits</h3>
<ul>
<li>Justin Pakzad (remediation developer)</li>
</ul>
<h2 id="CVE-2026-42360">Rendered template truncation bypasses nested sensitive-key masking</h2>
<p>CVE-2026-42360 <a href="https://cve.org/CVERecord?id=CVE-2026-42360">[CVE]</a> <a href="./CVE-2026-42360.cve.json">[CVE json]</a> <a href="./CVE-2026-42360.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:50:36.896Z</em></p>
-<h3 id="affected-52">Affected</h3>
+<h3 id="affected-57">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.2</li>
</ul>
-<h3 id="description-52">Description</h3>
+<h3 id="description-57">Description</h3>
<p>A bug in Apache Airflow's rendered-template field handling caused nested sensitive-key masking (e.g. nested <code>password</code> / <code>token</code> / <code>secret</code> / <code>api_key</code> keys inside a JSON template structure) to be bypassed when the rendered field exceeded <code>[core] max_templated_field_length</code>: Airflow stringified the structure before redaction, losing the nested key context, and persisted the plaintext value into <code>rendered_fields</code>. An aut [...]
-<h3 id="references-52">References</h3>
+<h3 id="references-57">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65906">https://github.com/apache/airflow/pull/65906</a></li>
<li><a href="https://lists.apache.org/thread/obj79bpxnl7r5olz1gsn0g94y88glnl4">https://lists.apache.org/thread/obj79bpxnl7r5olz1gsn0g94y88glnl4</a></li>
</ul>
-<h3 id="credits-52">Credits</h3>
+<h3 id="credits-57">Credits</h3>
<ul>
<li>Vincent55 (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -1150,19 +1249,19 @@
<h2 id="CVE-2026-42359">Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator</h2>
<p>CVE-2026-42359 <a href="https://cve.org/CVERecord?id=CVE-2026-42359">[CVE]</a> <a href="./CVE-2026-42359.cve.json">[CVE json]</a> <a href="./CVE-2026-42359.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T15:13:25.919Z</em></p>
-<h3 id="affected-53">Affected</h3>
+<h3 id="affected-58">Affected</h3>
<ul>
<li>Apache Airflow from 3.2.0 before 3.2.2</li>
</ul>
-<h3 id="description-53">Description</h3>
+<h3 id="description-58">Description</h3>
<p>A bug in Apache Airflow's XCom PATCH endpoint <code>PATCH /api/v2/xcomEntries/{key}</code> allowed an authenticated UI/API user with XCom write permission on a Dag to set XCom entries under reserved key names (e.g. <code>return_value</code>) that the matching POST endpoint already validated against <code>FORBIDDEN_XCOM_KEYS</code>. The endpoint also accepted serialized payload shapes the triggerer's deserializer treats as code; combined, this allowed RCE on the triggerer when the affe [...]
-<h3 id="references-53">References</h3>
+<h3 id="references-58">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65915">https://github.com/apache/airflow/pull/65915</a></li>
<li><a href="https://lists.apache.org/thread/g8dqykpf1p90tysq8tln4qtkqwb1038s">https://lists.apache.org/thread/g8dqykpf1p90tysq8tln4qtkqwb1038s</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-33858">https://www.cve.org/CVERecord?id=CVE-2026-33858</a></li>
</ul>
-<h3 id="credits-53">Credits</h3>
+<h3 id="credits-58">Credits</h3>
<ul>
<li>Jeff Vier (@boinger) (finder)</li>
<li>Anisto Mejin (Izat) (finder)</li>
@@ -1172,18 +1271,18 @@
<h2 id="CVE-2026-42358">Variable masker depth-limit bypass returns cleartext nested secrets</h2>
<p>CVE-2026-42358 <a href="https://cve.org/CVERecord?id=CVE-2026-42358">[CVE]</a> <a href="./CVE-2026-42358.cve.json">[CVE json]</a> <a href="./CVE-2026-42358.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:49:56.426Z</em></p>
-<h3 id="affected-54">Affected</h3>
+<h3 id="affected-59">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.2</li>
</ul>
-<h3 id="description-54">Description</h3>
+<h3 id="description-59">Description</h3>
<p>A bug in Apache Airflow's Variable response masker caused nested-key redaction (triggered by secret-suffixed key names like <code>password</code>, <code>token</code>, <code>secret</code>, <code>api_key</code>) to be bypassed when the JSON value's nesting depth exceeded the shared secrets masker's recursion limit: the masker returned the original nested item before checking the sensitive key name. An authenticated UI/API user with Variable read permission could harvest plaintext secret [...]
-<h3 id="references-54">References</h3>
+<h3 id="references-59">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65912">https://github.com/apache/airflow/pull/65912</a></li>
<li><a href="https://lists.apache.org/thread/33635mv3zjb75wn5453c5yf9trs8x2om">https://lists.apache.org/thread/33635mv3zjb75wn5453c5yf9trs8x2om</a></li>
</ul>
-<h3 id="credits-54">Credits</h3>
+<h3 id="credits-59">Credits</h3>
<ul>
<li>Vincent55 (confirmed in original report sign-off) (finder)</li>
<li>Aymane MAZGUITI – unclej4ck (finder)</li>
@@ -1193,18 +1292,18 @@
<h2 id="CVE-2026-42252">BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern</h2>
<p>CVE-2026-42252 <a href="https://cve.org/CVERecord?id=CVE-2026-42252">[CVE]</a> <a href="./CVE-2026-42252.cve.json">[CVE json]</a> <a href="./CVE-2026-42252.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:51:17.651Z</em></p>
-<h3 id="affected-55">Affected</h3>
+<h3 id="affected-60">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.2</li>
</ul>
-<h3 id="description-55">Description</h3>
+<h3 id="description-60">Description</h3>
<p>Apache Airflow's official documentation at <code>core-concepts/dag-run.html</code> ("Passing Parameters when triggering Dags") showed a verbatim <code>BashOperator(bash_command=&quot;echo value: {{ dag_run.conf[&#x27;conf1&#x27;] }}&quot;)</code> example without any quoting / sanitization warning. Dag authors who copied the pattern verbatim into deployments where users had <code>Dag.can_trigger</code> permission on the affected Dag (typical multi-team deploym [...]
-<h3 id="references-55">References</h3>
+<h3 id="references-60">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/64129">https://github.com/apache/airflow/pull/64129</a></li>
<li><a href="https://lists.apache.org/thread/8f4sc0rfn154jprmnwtmlst4p9zfw3w7">https://lists.apache.org/thread/8f4sc0rfn154jprmnwtmlst4p9zfw3w7</a></li>
</ul>
-<h3 id="credits-55">Credits</h3>
+<h3 id="credits-60">Credits</h3>
<ul>
<li>anonymous (finder)</li>
<li>Kevin Yang (sjyangkevin) (remediation developer)</li>
@@ -1212,18 +1311,18 @@
<h2 id="CVE-2026-41084">API authorization bypass: bulk TaskInstances allows cross-DAG mutation</h2>
<p>CVE-2026-41084 <a href="https://cve.org/CVERecord?id=CVE-2026-41084">[CVE]</a> <a href="./CVE-2026-41084.cve.json">[CVE json]</a> <a href="./CVE-2026-41084.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:51:55.264Z</em></p>
-<h3 id="affected-56">Affected</h3>
+<h3 id="affected-61">Affected</h3>
<ul>
<li>Apache Airflow from 3.2.0 before 3.2.2</li>
</ul>
-<h3 id="description-56">Description</h3>
+<h3 id="description-61">Description</h3>
<p>A bug in Apache Airflow's bulk Task Instances API (<code>PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances</code>) evaluated authorization against the <code>dag_id</code> resolved from the URL path while operating on the <code>dag_id</code> / <code>dag_run_id</code> extracted from request-body entity fields. An authenticated UI/API user with edit permission on one Dag could mutate Task Instance state in any other Dag by keeping the authorized Dag's ID in the URL pa [...]
-<h3 id="references-56">References</h3>
+<h3 id="references-61">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/64288">https://github.com/apache/airflow/pull/64288</a></li>
<li><a href="https://lists.apache.org/thread/w0hdcqfr71hf9rl1bwvpjs7q9yp1bldk">https://lists.apache.org/thread/w0hdcqfr71hf9rl1bwvpjs7q9yp1bldk</a></li>
</ul>
-<h3 id="credits-56">Credits</h3>
+<h3 id="credits-61">Credits</h3>
<ul>
<li>Pirikara (finder)</li>
<li>GPK (gopidesupavan) (remediation developer)</li>
@@ -1231,18 +1330,18 @@
<h2 id="CVE-2026-41018">Elasticsearch task-log handler leaks credentials embedded in the host URL</h2>
<p>CVE-2026-41018 <a href="https://cve.org/CVERecord?id=CVE-2026-41018">[CVE]</a> <a href="./CVE-2026-41018.cve.json">[CVE json]</a> <a href="./CVE-2026-41018.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-10T20:38:57.776Z</em></p>
-<h3 id="affected-57">Affected</h3>
+<h3 id="affected-62">Affected</h3>
<ul>
<li>Apache Airflow Providers Elasticsearch before 6.5.3</li>
</ul>
-<h3 id="description-57">Description</h3>
+<h3 id="description-62">Description</h3>
<p>The Elasticsearch logging provider, when configured with a <code>host</code> URL that embeds credentials (for example <code>https://user:password@server.example.com:9200</code>), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to <code>apache-airflow-providers-elasticsearch</code> 6.5.3 or later and, as a defense-in-depth measure, configure the back [...]
-<h3 id="references-57">References</h3>
+<h3 id="references-62">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65349">https://github.com/apache/airflow/pull/65349</a></li>
<li><a href="https://lists.apache.org/thread/wz5l58drprmwlv6jxnq466x24jqbbhp7">https://lists.apache.org/thread/wz5l58drprmwlv6jxnq466x24jqbbhp7</a></li>
</ul>
-<h3 id="credits-57">Credits</h3>
+<h3 id="credits-62">Credits</h3>
<ul>
<li>Aleksandr Sozinov (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -1250,18 +1349,18 @@
<h2 id="CVE-2026-41017">JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy</h2>
<p>CVE-2026-41017 <a href="https://cve.org/CVERecord?id=CVE-2026-41017">[CVE]</a> <a href="./CVE-2026-41017.cve.json">[CVE json]</a> <a href="./CVE-2026-41017.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:52:32.340Z</em></p>
-<h3 id="affected-58">Affected</h3>
+<h3 id="affected-63">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.2</li>
</ul>
-<h3 id="description-58">Description</h3>
+<h3 id="description-63">Description</h3>
<p>Apache Airflow's <code>JWTRefreshMiddleware</code> set the JWT auth cookie without the <code>Secure</code> flag, so deployments running the Airflow API server behind an HTTPS-terminating reverse proxy (e.g. nginx / Envoy / a managed load balancer that terminates TLS and forwards plaintext to the API server, the default cloud-native topology) would have the user's session JWT replayed over any cleartext HTTP request to the same host. A network-positioned attacker (Wi-Fi MITM, hostile L [...]
-<h3 id="references-58">References</h3>
+<h3 id="references-63">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65348">https://github.com/apache/airflow/pull/65348</a></li>
<li><a href="https://lists.apache.org/thread/9jx0sk49c1250zflx0q3clc717qgjdch">https://lists.apache.org/thread/9jx0sk49c1250zflx0q3clc717qgjdch</a></li>
</ul>
-<h3 id="credits-58">Credits</h3>
+<h3 id="credits-63">Credits</h3>
<ul>
<li>Ran (@eddieran) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -1269,18 +1368,18 @@
<h2 id="CVE-2026-41016">No certificate validation on SMTP STARTTLS connections (SMTP provider — split from #265) ##</h2>
<p>CVE-2026-41016 <a href="https://cve.org/CVERecord?id=CVE-2026-41016">[CVE]</a> <a href="./CVE-2026-41016.cve.json">[CVE json]</a> <a href="./CVE-2026-41016.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-29T08:45:19.890Z</em></p>
-<h3 id="affected-59">Affected</h3>
+<h3 id="affected-64">Affected</h3>
<ul>
<li>Apache Airflow Providers SMTP from 2.0.0 before 3.0.0</li>
</ul>
-<h3 id="description-59">Description</h3>
+<h3 id="description-64">Description</h3>
<p>Apache Airflow’s SMTP provider <code>SmtpHook</code> called Python’s <code>smtplib.SMTP.starttls()</code> without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS upgrade, and capture the SMTP credentials sent during the subsequent <code>login()</code> call. Users are advised to upgrade to the <code>apache-airflow-p [...]
-<h3 id="references-59">References</h3>
+<h3 id="references-64">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65346">https://github.com/apache/airflow/pull/65346</a></li>
<li><a href="https://lists.apache.org/thread/gb202qy5r31bgdd3d51d7s5o1jh40kc4">https://lists.apache.org/thread/gb202qy5r31bgdd3d51d7s5o1jh40kc4</a></li>
</ul>
-<h3 id="credits-59">Credits</h3>
+<h3 id="credits-64">Credits</h3>
<ul>
<li>Francis Bergin (@francisbergin) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -1288,18 +1387,18 @@
<h2 id="CVE-2026-41014">per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints</h2>
<p>CVE-2026-41014 <a href="https://cve.org/CVERecord?id=CVE-2026-41014">[CVE]</a> <a href="./CVE-2026-41014.cve.json">[CVE json]</a> <a href="./CVE-2026-41014.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:53:50.879Z</em></p>
-<h3 id="affected-60">Affected</h3>
+<h3 id="affected-65">Affected</h3>
<ul>
<li>Apache Airflow from 3.2.0 before 3.2.2</li>
</ul>
-<h3 id="description-60">Description</h3>
+<h3 id="description-65">Description</h3>
<p>The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization. An authenticated UI/API user with global Asset:read permission could enumerate partition run state, schedule configuration, and asset wiring for Dags they were not authorized to read. Affects deployments that rely on per-Dag read scoping while granting users broader Asset access. Users are advised to upgrade to <code>apache-airflow</code> 3.2.2 or later.</p>
-<h3 id="references-60">References</h3>
+<h3 id="references-65">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65344">https://github.com/apache/airflow/pull/65344</a></li>
<li><a href="https://lists.apache.org/thread/12nbzwwby7g883w2j13gn7ny1545xob9">https://lists.apache.org/thread/12nbzwwby7g883w2j13gn7ny1545xob9</a></li>
</ul>
-<h3 id="credits-60">Credits</h3>
+<h3 id="credits-65">Credits</h3>
<ul>
<li>Yalguun Tumenkhuu (fg0x0) (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -1307,18 +1406,18 @@
<h2 id="CVE-2026-40963">DAG authorization bypass on /ui/structure/structure_data</h2>
<p>CVE-2026-40963 <a href="https://cve.org/CVERecord?id=CVE-2026-40963">[CVE]</a> <a href="./CVE-2026-40963.cve.json">[CVE json]</a> <a href="./CVE-2026-40963.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:54:32.443Z</em></p>
-<h3 id="affected-61">Affected</h3>
+<h3 id="affected-66">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.2</li>
</ul>
-<h3 id="description-61">Description</h3>
+<h3 id="description-66">Description</h3>
<p>The structure_data endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking whether the caller had read permission on those linked Dags. An authenticated UI/API user authorized for one Dag could enumerate linked Dag IDs and dependency metadata for other Dags they were not authorized to read. Affects deployments that rely on per-Dag read scoping to keep Dag dependency topology private across teams. Users are advised to upgrade to <code>apache [...]
-<h3 id="references-61">References</h3>
+<h3 id="references-66">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65342">https://github.com/apache/airflow/pull/65342</a></li>
<li><a href="https://lists.apache.org/thread/s907bhsksc37m59f0loqjcp1ryobrr60">https://lists.apache.org/thread/s907bhsksc37m59f0loqjcp1ryobrr60</a></li>
</ul>
-<h3 id="credits-61">Credits</h3>
+<h3 id="credits-66">Credits</h3>
<ul>
<li>Masamune - Unit515 OPSWAT (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -1326,18 +1425,18 @@
<h2 id="CVE-2026-40961">Open Redirect Bypass Vulnerability</h2>
<p>CVE-2026-40961 <a href="https://cve.org/CVERecord?id=CVE-2026-40961">[CVE]</a> <a href="./CVE-2026-40961.cve.json">[CVE json]</a> <a href="./CVE-2026-40961.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:55:03.222Z</em></p>
-<h3 id="affected-62">Affected</h3>
+<h3 id="affected-67">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.2</li>
</ul>
-<h3 id="description-62">Description</h3>
+<h3 id="description-67">Description</h3>
<p>A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the <code>is_safe_url</code> check, enabling redirection from a trusted Airflow domain to an attacker-controlled origin. Users are advised to upgrade to <code>apache-airflow</code> 3.2.2 or later. As a defense-in-depth mitigation, deployment operators can place Airflow behind a reverse proxy that strips off-domain <code>next=</code> query parameters before they reach the login e [...]
-<h3 id="references-62">References</h3>
+<h3 id="references-67">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65557">https://github.com/apache/airflow/pull/65557</a></li>
<li><a href="https://lists.apache.org/thread/qmt8ksh7gty6b8hr9w294t94j36jdv1q">https://lists.apache.org/thread/qmt8ksh7gty6b8hr9w294t94j36jdv1q</a></li>
</ul>
-<h3 id="credits-62">Credits</h3>
+<h3 id="credits-67">Credits</h3>
<ul>
<li>Fushuling@secsys (finder)</li>
<li>RacerZ@secsys (finder)</li>
@@ -1346,36 +1445,36 @@
<h2 id="CVE-2026-40948">OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager</h2>
<p>CVE-2026-40948 <a href="https://cve.org/CVERecord?id=CVE-2026-40948">[CVE]</a> <a href="./CVE-2026-40948.cve.json">[CVE json]</a> <a href="./CVE-2026-40948.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-19T23:44:07.936Z</em></p>
-<h3 id="affected-63">Affected</h3>
+<h3 id="affected-68">Affected</h3>
<ul>
<li>Apache Airflow Providers Keycloak from 0.0.1 before 0.7.0</li>
</ul>
-<h3 id="description-63">Description</h3>
+<h3 id="description-68">Description</h3>
<p>The Keycloak authentication manager in <code>apache-airflow-providers-keycloak</code> did not generate or validate the OAuth 2.0 <code>state</code> parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim’s browser and cause the victim to be logged into the attacker’s Airflow session (login-CSRF / session fixation), where any credentials the victim subsequently [...]
-<h3 id="references-63">References</h3>
+<h3 id="references-68">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/64114">https://github.com/apache/airflow/pull/64114</a></li>
<li><a href="https://lists.apache.org/thread/kc0odpr70hbqhdb9ksnz42fkqz2xld9q">https://lists.apache.org/thread/kc0odpr70hbqhdb9ksnz42fkqz2xld9q</a></li>
</ul>
-<h3 id="credits-63">Credits</h3>
+<h3 id="credits-68">Credits</h3>
<ul>
<li>Haruki Oyama (Waseda University) (finder)</li>
</ul>
<h2 id="CVE-2026-40861">Arbitrary File Read via Log Symlink following in FileTaskHandler</h2>
<p>CVE-2026-40861 <a href="https://cve.org/CVERecord?id=CVE-2026-40861">[CVE]</a> <a href="./CVE-2026-40861.cve.json">[CVE json]</a> <a href="./CVE-2026-40861.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-01T07:55:36.142Z</em></p>
-<h3 id="affected-64">Affected</h3>
+<h3 id="affected-69">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.2</li>
</ul>
-<h3 id="description-64">Description</h3>
+<h3 id="description-69">Description</h3>
<p>A Dag author could either (a) create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process (read-path attack — e.g. <code>/etc/passwd</code> or <code>airflow.cfg</code>) or (b) supply a <code>task_id</code> containing <code>..</code> sequences accepted by the Task SDK's <code>KEY_REGEX</code> (write-path attack), and in both cases the FileTaskHandler resolves the log path outside the configured <code>base_log_folder</code>, leaking [...]
-<h3 id="references-64">References</h3>
+<h3 id="references-69">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65325">https://github.com/apache/airflow/pull/65325</a></li>
<li><a href="https://lists.apache.org/thread/823334db2559xjlwt59gpzjz47thnscl">https://lists.apache.org/thread/823334db2559xjlwt59gpzjz47thnscl</a></li>
</ul>
-<h3 id="credits-64">Credits</h3>
+<h3 id="credits-69">Credits</h3>
<ul>
<li>Silas Boch (finder)</li>
<li>Lakshmikanthan K (letchupkt) (finder)</li>
@@ -1384,18 +1483,18 @@
<h2 id="CVE-2026-40690">Assets graph view bypasses DAG level access control displaying unrelated topologies and all DAGs names to unauthorized users</h2>
<p>CVE-2026-40690 <a href="https://cve.org/CVERecord?id=CVE-2026-40690">[CVE]</a> <a href="./CVE-2026-40690.cve.json">[CVE json]</a> <a href="./CVE-2026-40690.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-24T12:35:28.702Z</em></p>
-<h3 id="affected-65">Affected</h3>
+<h3 id="affected-70">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.1</li>
</ul>
-<h3 id="description-65">Description</h3>
+<h3 id="description-70">Description</h3>
<p>The asset dependency graph did not restrict nodes by the viewer’s DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment and learn the existence and names of DAGs and assets outside their authorized scope.<br><br>Users are recommended to upgrade to version 3.2.1, which fixes this issue.<br></p>
-<h3 id="references-65">References</h3>
+<h3 id="references-70">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/65273">https://github.com/apache/airflow/pull/65273</a></li>
<li><a href="https://lists.apache.org/thread/bqt7y4g2cpj396b0sd20lv510ff19ndl">https://lists.apache.org/thread/bqt7y4g2cpj396b0sd20lv510ff19ndl</a></li>
</ul>
-<h3 id="credits-65">Credits</h3>
+<h3 id="credits-70">Credits</h3>
<ul>
<li>Saurabh (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -1403,18 +1502,18 @@
<h2 id="CVE-2026-38743">Dags endpoint might provide access to otherwise inaccessible entities</h2>
<p>CVE-2026-38743 <a href="https://cve.org/CVERecord?id=CVE-2026-38743">[CVE]</a> <a href="./CVE-2026-38743.cve.json">[CVE json]</a> <a href="./CVE-2026-38743.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-24T12:36:37.917Z</em></p>
-<h3 id="affected-66">Affected</h3>
+<h3 id="affected-71">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.1</li>
</ul>
-<h3 id="description-66">Description</h3>
+<h3 id="description-71">Description</h3>
<p></p><span style="background-color: rgb(255, 255, 255);">The authenticated </span><code>/ui/dags</code><span style="background-color: rgb(255, 255, 255);"> endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance records: a logged-in Airflow user with read access to at least one DAG could retrieve HITL prompts (including their request parameters) and full TaskInstance details for DAGs outside their authorized scope. Because HITL prompts [...]
-<h3 id="references-66">References</h3>
+<h3 id="references-71">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/64822">https://github.com/apache/airflow/pull/64822</a></li>
<li><a href="https://lists.apache.org/thread/sk2wj0x48o8qb4p7c47gvnhjbm0mg396">https://lists.apache.org/thread/sk2wj0x48o8qb4p7c47gvnhjbm0mg396</a></li>
</ul>
-<h3 id="credits-66">Credits</h3>
+<h3 id="credits-71">Credits</h3>
<ul>
<li>Jed Cunningham (finder)</li>
<li>Kevin Yang (remediation developer)</li>
@@ -1422,18 +1521,18 @@
<h2 id="CVE-2026-34538">Authorization bypass in DagRun wait endpoint (XCom exposure)</h2>
<p>CVE-2026-34538 <a href="https://cve.org/CVERecord?id=CVE-2026-34538">[CVE]</a> <a href="./CVE-2026-34538.cve.json">[CVE json]</a> <a href="./CVE-2026-34538.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-09T09:09:19.260Z</em></p>
-<h3 id="affected-67">Affected</h3>
+<h3 id="affected-72">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.0</li>
</ul>
-<h3 id="description-67">Description</h3>
+<h3 id="description-72">Description</h3>
<p>Apache Airflow versions 3.0.0 through 3.1.8 <span style="background-color: rgb(255, 255, 255);">DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.<span style="background-color: rgb(255, 255, 255);">This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security model documentation that defines the Viewer role as read-only.</span><br></span><br><span st [...]
-<h3 id="references-67">References</h3>
+<h3 id="references-72">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/64415">https://github.com/apache/airflow/pull/64415</a></li>
<li><a href="https://lists.apache.org/thread/9mq3msqhmgjwdzbr6bgthj4brb3oz9fl">https://lists.apache.org/thread/9mq3msqhmgjwdzbr6bgthj4brb3oz9fl</a></li>
</ul>
-<h3 id="credits-67">Credits</h3>
+<h3 id="credits-72">Credits</h3>
<ul>
<li>selen (finder)</li>
<li>Kevin Yang (remediation developer)</li>
@@ -1441,18 +1540,18 @@
<h2 id="CVE-2026-33858">Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API</h2>
<p>CVE-2026-33858 <a href="https://cve.org/CVERecord?id=CVE-2026-33858">[CVE]</a> <a href="./CVE-2026-33858.cve.json">[CVE json]</a> <a href="./CVE-2026-33858.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-13T14:36:29.251Z</em></p>
-<h3 id="affected-68">Affected</h3>
+<h3 id="affected-73">Affected</h3>
<ul>
<li>Apache Airflow from 3.1.8 before 3.2.0</li>
</ul>
-<h3 id="description-68">Description</h3>
+<h3 id="description-73">Description</h3>
<p>Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low.</p><br>Users are recommended to upgrade to Apache Airflow 3.2.0, which resolves this issue.<br><br><br><br>
-<h3 id="references-68">References</h3>
+<h3 id="references-73">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/64148">https://github.com/apache/airflow/pull/64148</a></li>
<li><a href="https://lists.apache.org/thread/1npt3o2x81s0gw9tmfcv4n7p1z9hdmy0">https://lists.apache.org/thread/1npt3o2x81s0gw9tmfcv4n7p1z9hdmy0</a></li>
</ul>
-<h3 id="credits-68">Credits</h3>
+<h3 id="credits-73">Credits</h3>
<ul>
<li>wooseokdotkim (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -1460,19 +1559,19 @@
<h2 id="CVE-2026-33264">DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()</h2>
<p>CVE-2026-33264 <a href="https://cve.org/CVERecord?id=CVE-2026-33264">[CVE]</a> <a href="./CVE-2026-33264.cve.json">[CVE json]</a> <a href="./CVE-2026-33264.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-07-07T12:25:55.676Z</em></p>
-<h3 id="affected-69">Affected</h3>
+<h3 id="affected-74">Affected</h3>
<ul>
<li>Apache Airflow before 3.3.0</li>
</ul>
-<h3 id="description-69">Description</h3>
+<h3 id="description-74">Description</h3>
<p>A bug in <code>BaseSerialization.deserialize()</code> allowed unrestricted <code>import_string()</code> of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Users are advised to upgrade to <code>apache-airflow</code> 3.3.0 or [...]
-<h3 id="references-69">References</h3>
+<h3 id="references-74">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/66002">https://github.com/apache/airflow/pull/66002</a></li>
<li><a href="https://github.com/apache/airflow/pull/68528">https://github.com/apache/airflow/pull/68528</a></li>
<li><a href="https://lists.apache.org/thread/otvdw8qt2y7xy2n5nq9xby9ky4rf5ltj">https://lists.apache.org/thread/otvdw8qt2y7xy2n5nq9xby9ky4rf5ltj</a></li>
</ul>
-<h3 id="credits-69">Credits</h3>
+<h3 id="credits-74">Credits</h3>
<ul>
<li>Ziyu Lin (finder)</li>
<li>bugbunny.ai (tool)</li>
@@ -1484,18 +1583,18 @@
<h2 id="CVE-2026-32794">TLS Certificate Verification Disabled in Databricks Provider K8s Token Exchange</h2>
<p>CVE-2026-32794 <a href="https://cve.org/CVERecord?id=CVE-2026-32794">[CVE]</a> <a href="./CVE-2026-32794.cve.json">[CVE json]</a> <a href="./CVE-2026-32794.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-30T21:43:36.022Z</em></p>
-<h3 id="affected-70">Affected</h3>
+<h3 id="affected-75">Affected</h3>
<ul>
<li>Apache Airflow Provider for Databricks from 1.10.0 before 1.12.0</li>
</ul>
-<h3 id="description-70">Description</h3>
+<h3 id="description-75">Description</h3>
<p>Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o notice.</p><p>This issue affects Apache Airflow Provider for Databricks: from 1.10.0 before 1.12.0.</p><p>Users are recommended to upgrade to version 1.12.0, which fixes the issue.</p>
-<h3 id="references-70">References</h3>
+<h3 id="references-75">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/63704">https://github.com/apache/airflow/pull/63704</a></li>
<li><a href="https://lists.apache.org/thread/hn17yqsgsdtl81llvhf80rkp53hnz5nb">https://lists.apache.org/thread/hn17yqsgsdtl81llvhf80rkp53hnz5nb</a></li>
</ul>
-<h3 id="credits-70">Credits</h3>
+<h3 id="credits-75">Credits</h3>
<ul>
<li>Kai Aizen (reporter)</li>
<li>Marcin Wojtyczka (remediation developer)</li>
@@ -1503,18 +1602,18 @@
<h2 id="CVE-2026-32690">3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1</h2>
<p>CVE-2026-32690 <a href="https://cve.org/CVERecord?id=CVE-2026-32690">[CVE]</a> <a href="./CVE-2026-32690.cve.json">[CVE json]</a> <a href="./CVE-2026-32690.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-18T02:36:09.517Z</em></p>
-<h3 id="affected-71">Affected</h3>
+<h3 id="affected-76">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.0</li>
</ul>
-<h3 id="description-71">Description</h3>
+<h3 id="description-76">Description</h3>
<p>Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked.<br><br>If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to Apache Airflow 3.2.0 that has the fix implemented<br><br></p>
-<h3 id="references-71">References</h3>
+<h3 id="references-76">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/63480">https://github.com/apache/airflow/pull/63480</a></li>
<li><a href="https://lists.apache.org/thread/7rnzxofntcznqxnhsmjvvlvygwph7rn5">https://lists.apache.org/thread/7rnzxofntcznqxnhsmjvvlvygwph7rn5</a></li>
</ul>
-<h3 id="credits-71">Credits</h3>
+<h3 id="credits-76">Credits</h3>
<ul>
<li>Nguyen Anh Binh [IA Lab – FPT University] (finder)</li>
<li>Kevin Yang (remediation developer)</li>
@@ -1522,18 +1621,18 @@
<h2 id="CVE-2026-32228">Users with asset materialization permisssions could trigger Dags they had no access to</h2>
<p>CVE-2026-32228 <a href="https://cve.org/CVERecord?id=CVE-2026-32228">[CVE]</a> <a href="./CVE-2026-32228.cve.json">[CVE json]</a> <a href="./CVE-2026-32228.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-18T02:42:30.328Z</em></p>
-<h3 id="affected-72">Affected</h3>
+<h3 id="affected-77">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.0</li>
</ul>
-<h3 id="description-72">Description</h3>
+<h3 id="description-77">Description</h3>
<p>UI / API User with asset materialize permission could trigger dags they had no access to.<br>Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.</p>
-<h3 id="references-72">References</h3>
+<h3 id="references-77">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/63338">https://github.com/apache/airflow/pull/63338</a></li>
<li><a href="https://lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0nj">https://lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0nj</a></li>
</ul>
-<h3 id="credits-72">Credits</h3>
+<h3 id="credits-77">Credits</h3>
<ul>
<li>Masamune - Unit515 OPSWAT (finder)</li>
<li>Ahmad Abuzaid (finder)</li>
@@ -1542,20 +1641,20 @@
<h2 id="CVE-2026-31987">JWT token appearing in logs</h2>
<p>CVE-2026-31987 <a href="https://cve.org/CVERecord?id=CVE-2026-31987">[CVE]</a> <a href="./CVE-2026-31987.cve.json">[CVE json]</a> <a href="./CVE-2026-31987.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-16T17:49:35.608Z</em></p>
-<h3 id="affected-73">Affected</h3>
+<h3 id="affected-78">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.0</li>
</ul>
-<h3 id="description-73">Description</h3>
+<h3 id="description-78">Description</h3>
<p>JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. <br>Users are advised to upgrade to Airflow version that contains fix.<br><br>Users are recommended to upgrade to version 3.2.0, which fixes this issue. <br><br></p>
-<h3 id="references-73">References</h3>
+<h3 id="references-78">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/62964">https://github.com/apache/airflow/pull/62964</a></li>
<li><a href="https://github.com/apache/airflow/issues/62428">https://github.com/apache/airflow/issues/62428</a></li>
<li><a href="https://github.com/apache/airflow/issues/62773">https://github.com/apache/airflow/issues/62773</a></li>
<li><a href="https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g">https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g</a></li>
</ul>
-<h3 id="credits-73">Credits</h3>
+<h3 id="credits-78">Credits</h3>
<ul>
<li>unixengineer (finder)</li>
<li>Jason Imison (finder)</li>
@@ -1564,18 +1663,18 @@
<h2 id="CVE-2026-30912">Exposing stack trace in case of constraint error</h2>
<p>CVE-2026-30912 <a href="https://cve.org/CVERecord?id=CVE-2026-30912">[CVE]</a> <a href="./CVE-2026-30912.cve.json">[CVE json]</a> <a href="./CVE-2026-30912.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-18T02:41:53.492Z</em></p>
-<h3 id="affected-74">Affected</h3>
+<h3 id="affected-79">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.0</li>
</ul>
-<h3 id="description-74">Description</h3>
+<h3 id="description-79">Description</h3>
<p>In case of SQL errors, exception/stack trace of errors was exposed in API even if “api/expose_stack_traces” was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.</p>
-<h3 id="references-74">References</h3>
+<h3 id="references-79">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/63028">https://github.com/apache/airflow/pull/63028</a></li>
<li><a href="https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9">https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9</a></li>
</ul>
-<h3 id="credits-74">Credits</h3>
+<h3 id="credits-79">Credits</h3>
<ul>
<li>Masamune - Unit515 OPSWAT (finder)</li>
<li>Jason(Zhe-You) Liu (remediation developer)</li>
@@ -1583,18 +1682,18 @@
<h2 id="CVE-2026-30911">Execution API HITL Endpoints Missing Per-Task Authorization</h2>
<p>CVE-2026-30911 <a href="https://cve.org/CVERecord?id=CVE-2026-30911">[CVE]</a> <a href="./CVE-2026-30911.cve.json">[CVE json]</a> <a href="./CVE-2026-30911.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-17T10:53:00.535Z</em></p>
-<h3 id="affected-75">Affected</h3>
+<h3 id="affected-80">Affected</h3>
<ul>
<li>Apache Airflow from 3.1.0 before 3.1.8</li>
</ul>
-<h3 id="description-75">Description</h3>
+<h3 id="description-80">Description</h3>
<p>Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API’s Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance.<br><br><br>Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.<br><br></p>
-<h3 id="references-75">References</h3>
+<h3 id="references-80">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/62886">https://github.com/apache/airflow/pull/62886</a></li>
<li><a href="https://lists.apache.org/thread/1rs2v7fcko2otl6n9ytthcj87cmsgx51">https://lists.apache.org/thread/1rs2v7fcko2otl6n9ytthcj87cmsgx51</a></li>
</ul>
-<h3 id="credits-75">Credits</h3>
+<h3 id="credits-80">Credits</h3>
<ul>
<li>Kai Aizen (finder)</li>
<li>Aritra Basu (remediation developer)</li>
@@ -1602,18 +1701,18 @@
<h2 id="CVE-2026-30898">Bad example of BashOperator shell injection via dag_run.conf</h2>
<p>CVE-2026-30898 <a href="https://cve.org/CVERecord?id=CVE-2026-30898">[CVE]</a> <a href="./CVE-2026-30898.cve.json">[CVE json]</a> <a href="./CVE-2026-30898.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-18T02:40:37.049Z</em></p>
-<h3 id="affected-76">Affected</h3>
+<h3 id="affected-81">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.0</li>
</ul>
-<h3 id="description-76">Description</h3>
+<h3 id="description-81">Description</h3>
<p>An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker. Users should review if any of their own DAGs have adopted this incorrect advice.<br></p>
-<h3 id="references-76">References</h3>
+<h3 id="references-81">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/64129">https://github.com/apache/airflow/pull/64129</a></li>
<li><a href="https://lists.apache.org/thread/26zmhfj1t95c1hld2r14ho81nzh1bdc8">https://lists.apache.org/thread/26zmhfj1t95c1hld2r14ho81nzh1bdc8</a></li>
</ul>
-<h3 id="credits-76">Credits</h3>
+<h3 id="credits-81">Credits</h3>
<ul>
<li>Peyton Kennedy (p80n-sec) from Endor Labs (finder)</li>
<li>Kevin Yang (remediation developer)</li>
@@ -1621,18 +1720,18 @@
<h2 id="CVE-2026-28779">Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications</h2>
<p>CVE-2026-28779 <a href="https://cve.org/CVERecord?id=CVE-2026-28779">[CVE]</a> <a href="./CVE-2026-28779.cve.json">[CVE json]</a> <a href="./CVE-2026-28779.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-17T10:43:18.236Z</em></p>
-<h3 id="affected-77">Affected</h3>
+<h3 id="affected-82">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.1.8</li>
</ul>
-<h3 id="description-77">Description</h3>
+<h3 id="description-82">Description</h3>
<p>Apache Airflow versions 3.1.0 through 3.1.7 <span style="background-color: rgb(255, 255, 255);">session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.<br><p>This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itself.</p></span>Users are recommended to upgrade to Apache Airflow 3.1.8 or later [...]
-<h3 id="references-77">References</h3>
+<h3 id="references-82">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/62771">https://github.com/apache/airflow/pull/62771</a></li>
<li><a href="https://lists.apache.org/thread/r4n5znb8mcq14wo9v8ndml36nxlksdqb">https://lists.apache.org/thread/r4n5znb8mcq14wo9v8ndml36nxlksdqb</a></li>
</ul>
-<h3 id="credits-77">Credits</h3>
+<h3 id="credits-82">Credits</h3>
<ul>
<li>Daniel Wolf (finder)</li>
<li>Daniel Wolf (remediation developer)</li>
@@ -1640,18 +1739,18 @@
<h2 id="CVE-2026-28563">DAG authorization bypass</h2>
<p>CVE-2026-28563 <a href="https://cve.org/CVERecord?id=CVE-2026-28563">[CVE]</a> <a href="./CVE-2026-28563.cve.json">[CVE json]</a> <a href="./CVE-2026-28563.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-17T10:54:55.864Z</em></p>
-<h3 id="affected-78">Affected</h3>
+<h3 id="affected-83">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.1.8</li>
</ul>
-<h3 id="description-78">Description</h3>
+<h3 id="description-83">Description</h3>
<p>Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authorized to view.<br><br><br>Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.<br><br><br></p>
-<h3 id="references-78">References</h3>
+<h3 id="references-83">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/62046">https://github.com/apache/airflow/pull/62046</a></li>
<li><a href="https://lists.apache.org/thread/dwzf62qg9z8wvfsjknpfd8bvtwghd49s">https://lists.apache.org/thread/dwzf62qg9z8wvfsjknpfd8bvtwghd49s</a></li>
</ul>
-<h3 id="credits-78">Credits</h3>
+<h3 id="credits-83">Credits</h3>
<ul>
<li>Masamune - Unit515 OPSWAT (finder)</li>
<li>Shubham Raj (remediation developer)</li>
@@ -1659,18 +1758,18 @@
<h2 id="CVE-2026-27173">JWT Token Exposure in KubernetesExecutor Command-Line Arguments</h2>
<p>CVE-2026-27173 <a href="https://cve.org/CVERecord?id=CVE-2026-27173">[CVE]</a> <a href="./CVE-2026-27173.cve.json">[CVE json]</a> <a href="./CVE-2026-27173.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-22T18:42:19.144Z</em></p>
-<h3 id="affected-79">Affected</h3>
+<h3 id="affected-84">Affected</h3>
<ul>
<li>Apache Airflow CNCF Kubernetes provider before 10.17.0</li>
</ul>
-<h3 id="description-79">Description</h3>
+<h3 id="description-84">Description</h3>
<p>JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform actions that were only available to running tasks via Task SDK and potentially allow to modify state of Airflow Database for tasks.</p>
-<h3 id="references-79">References</h3>
+<h3 id="references-84">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/60108">https://github.com/apache/airflow/pull/60108</a></li>
<li><a href="https://lists.apache.org/thread/pk3m2z4s2rkmc0v6gh9hnch9spc6stqw">https://lists.apache.org/thread/pk3m2z4s2rkmc0v6gh9hnch9spc6stqw</a></li>
</ul>
-<h3 id="credits-79">Credits</h3>
+<h3 id="credits-84">Credits</h3>
<ul>
<li>Nikolai Dvoinishnikov, Welltory (finder)</li>
<li>Anton Kuznetsov, Welltory (finder)</li>
@@ -1679,36 +1778,36 @@
<h2 id="CVE-2026-26929">Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata</h2>
<p>CVE-2026-26929 <a href="https://cve.org/CVERecord?id=CVE-2026-26929">[CVE]</a> <a href="./CVE-2026-26929.cve.json">[CVE json]</a> <a href="./CVE-2026-26929.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-17T10:54:03.388Z</em></p>
-<h3 id="affected-80">Affected</h3>
+<h3 id="affected-85">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.1.8</li>
</ul>
-<h3 id="description-80">Description</h3>
+<h3 id="description-85">Description</h3>
<p>Apache Airflow versions 3.0.0 through 3.1.7<span style="background-color: rgb(255, 255, 255);"> FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to “~” (wildcard for all DAGs). As a result, version metadata of DAGs that the requester is not authorized to access is returned.</span><br><br><br>Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.<br><br><br></p>
-<h3 id="references-80">References</h3>
+<h3 id="references-85">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/61675">https://github.com/apache/airflow/pull/61675</a></li>
<li><a href="https://lists.apache.org/thread/g5o6khx83jwqvdyn0mlyb0krt35cs9ss">https://lists.apache.org/thread/g5o6khx83jwqvdyn0mlyb0krt35cs9ss</a></li>
</ul>
-<h3 id="credits-80">Credits</h3>
+<h3 id="credits-85">Credits</h3>
<ul>
<li>Pierre Jeambrun (remediation developer)</li>
</ul>
<h2 id="CVE-2026-25917">API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)</h2>
<p>CVE-2026-25917 <a href="https://cve.org/CVERecord?id=CVE-2026-25917">[CVE]</a> <a href="./CVE-2026-25917.cve.json">[CVE json]</a> <a href="./CVE-2026-25917.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-17T20:19:53.511Z</em></p>
-<h3 id="affected-81">Affected</h3>
+<h3 id="affected-86">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.0</li>
</ul>
-<h3 id="description-81">Description</h3>
+<h3 id="description-86">Description</h3>
<p>Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low.<br><br>Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.<br></p>
-<h3 id="references-81">References</h3>
+<h3 id="references-86">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/61641">https://github.com/apache/airflow/pull/61641</a></li>
<li><a href="https://lists.apache.org/thread/6whgpkqbh12rvpfmvcg8b0vwlv4hq3po">https://lists.apache.org/thread/6whgpkqbh12rvpfmvcg8b0vwlv4hq3po</a></li>
</ul>
-<h3 id="credits-81">Credits</h3>
+<h3 id="credits-86">Credits</h3>
<ul>
<li>Mahammad Huseynkhanli (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -1716,73 +1815,73 @@
<h2 id="CVE-2026-25604">Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass</h2>
<p>CVE-2026-25604 <a href="https://cve.org/CVERecord?id=CVE-2026-25604">[CVE]</a> <a href="./CVE-2026-25604.cve.json">[CVE json]</a> <a href="./CVE-2026-25604.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-09T10:39:37.628Z</em></p>
-<h3 id="affected-82">Affected</h3>
+<h3 id="affected-87">Affected</h3>
<ul>
<li>Apache Airflow Providers Amazon from 8.0.0 before 9.22.0</li>
</ul>
-<h3 id="description-82">Description</h3>
+<h3 id="description-87">Description</h3>
<p>In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. <br>This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.</p>You should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.<br><br>
-<h3 id="references-82">References</h3>
+<h3 id="references-87">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/61368">https://github.com/apache/airflow/pull/61368</a></li>
<li><a href="https://lists.apache.org/thread/spwwrsmwxod7fpttcd7n7zs46j839l77">https://lists.apache.org/thread/spwwrsmwxod7fpttcd7n7zs46j839l77</a></li>
</ul>
-<h3 id="credits-82">Credits</h3>
+<h3 id="credits-87">Credits</h3>
<ul>
<li>Sungwuk Jung (finder)</li>
</ul>
<h2 id="CVE-2026-25219">Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access</h2>
<p>CVE-2026-25219 <a href="https://cve.org/CVERecord?id=CVE-2026-25219">[CVE]</a> <a href="./CVE-2026-25219.cve.json">[CVE json]</a> <a href="./CVE-2026-25219.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-15T13:14:51.470Z</em></p>
-<h3 id="affected-83">Affected</h3>
+<h3 id="affected-88">Affected</h3>
<ul>
<li>Apache Airflow before 3.1.8</li>
</ul>
-<h3 id="description-83">Description</h3>
+<h3 id="description-88">Description</h3>
<p>The <code>access_key</code> and <code>connection_string</code> connection properties were not marked as sensitive names in secrets masker. This means that user with read permission could see the values in Connection UI, as well as when Connection was accidentaly logged to logs, those values could be seen in the logs. Azure Service Bus used those properties to store sensitive values. Possibly other providers could be also affected if they used the same fields to store sensitive data.<b [...]
-<h3 id="references-83">References</h3>
+<h3 id="references-88">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/61580">https://github.com/apache/airflow/pull/61580</a></li>
<li><a href="https://github.com/apache/airflow/pull/61582">https://github.com/apache/airflow/pull/61582</a></li>
<li><a href="https://lists.apache.org/thread/t4dlmqkn0njz4chk3g7mdgzb96y4ttqh">https://lists.apache.org/thread/t4dlmqkn0njz4chk3g7mdgzb96y4ttqh</a></li>
</ul>
-<h3 id="credits-83">Credits</h3>
+<h3 id="credits-88">Credits</h3>
<ul>
<li>Saurabh Banawar (finder)</li>
</ul>
<h2 id="CVE-2026-24098">Assigning single DAG permission leaked all DAGs Import Errors</h2>
<p>CVE-2026-24098 <a href="https://cve.org/CVERecord?id=CVE-2026-24098">[CVE]</a> <a href="./CVE-2026-24098.cve.json">[CVE json]</a> <a href="./CVE-2026-24098.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-10T18:13:52.941Z</em></p>
-<h3 id="affected-84">Affected</h3>
+<h3 id="affected-89">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.1.7</li>
</ul>
-<h3 id="description-84">Description</h3>
+<h3 id="description-89">Description</h3>
<p>Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. <br><br>Users are advised to upgrade to 3.1.7 or later, which resolves this issue</p>
-<h3 id="references-84">References</h3>
+<h3 id="references-89">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/60801">https://github.com/apache/airflow/pull/60801</a></li>
<li><a href="https://lists.apache.org/thread/nx96435v77xdst7ls5lk57kqvqyj095x">https://lists.apache.org/thread/nx96435v77xdst7ls5lk57kqvqyj095x</a></li>
</ul>
-<h3 id="credits-84">Credits</h3>
+<h3 id="credits-89">Credits</h3>
<ul>
<li>Saurabh (finder)</li>
</ul>
<h2 id="CVE-2026-22922">Airflow externalLogUrl Permission Bypass</h2>
<p>CVE-2026-22922 <a href="https://cve.org/CVERecord?id=CVE-2026-22922">[CVE]</a> <a href="./CVE-2026-22922.cve.json">[CVE json]</a> <a href="./CVE-2026-22922.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-02-09T10:33:48.256Z</em></p>
-<h3 id="affected-85">Affected</h3>
+<h3 id="affected-90">Affected</h3>
<ul>
<li>Apache Airflow from 3.1.0 before 3.1.7</li>
</ul>
-<h3 id="description-85">Description</h3>
+<h3 id="description-90">Description</h3>
<p>Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. <br><br>Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.<br></p>
-<h3 id="references-85">References</h3>
+<h3 id="references-90">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/60412">https://github.com/apache/airflow/pull/60412</a></li>
<li><a href="https://lists.apache.org/thread/gdb7vffhpmrj5hp1j0oj1j13o4vmsq40">https://lists.apache.org/thread/gdb7vffhpmrj5hp1j0oj1j13o4vmsq40</a></li>
</ul>
-<h3 id="credits-85">Credits</h3>
+<h3 id="credits-90">Credits</h3>
<ul>
<li>34selen (finder)</li>
<li>Shubham Raj (remediation developer)</li>
@@ -1790,18 +1889,18 @@
<h2 id="CVE-2025-69219">Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperator</h2>
<p>CVE-2025-69219 <a href="https://cve.org/CVERecord?id=CVE-2025-69219">[CVE]</a> <a href="./CVE-2025-69219.cve.json">[CVE json]</a> <a href="./CVE-2025-69219.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-09T10:19:56.479Z</em></p>
-<h3 id="affected-86">Affected</h3>
+<h3 id="affected-91">Affected</h3>
<ul>
<li>Apache Airflow Providers Http from 5.1.0 before 6.0.0</li>
</ul>
-<h3 id="description-86">Description</h3>
+<h3 id="description-91">Description</h3>
<p>A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same permissions as Dag Author. Since direct DB access is not usual and recommended for Airflow, the likelihood of it making any damage is low.<br><br>You should upgrade to version 6.0.0 of the provider to avoid even that risk.</p>
-<h3 id="references-86">References</h3>
+<h3 id="references-91">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/61662">https://github.com/apache/airflow/pull/61662</a></li>
<li><a href="https://lists.apache.org/thread/zjkfb2njklro68tqzym092r4w65m5dq0">https://lists.apache.org/thread/zjkfb2njklro68tqzym092r4w65m5dq0</a></li>
</ul>
-<h3 id="credits-86">Credits</h3>
+<h3 id="credits-91">Credits</h3>
<ul>
<li>skypher (finder)</li>
<li>Shauryae1337 (GitHub: <a href="https://github.com/Shauryae1337">https://github.com/Shauryae1337</a>) (finder)</li>
@@ -1810,19 +1909,19 @@
<h2 id="CVE-2025-68675">proxy credentials for various providers might leak in task logs</h2>
<p>CVE-2025-68675 <a href="https://cve.org/CVERecord?id=CVE-2025-68675">[CVE]</a> <a href="./CVE-2025-68675.cve.json">[CVE json]</a> <a href="./CVE-2025-68675.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-02-24T05:48:09.000Z</em></p>
-<h3 id="affected-87">Affected</h3>
+<h3 id="affected-92">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.1.6</li>
<li>Apache Airflow before 2.11.1</li>
</ul>
-<h3 id="description-87">Description</h3>
+<h3 id="description-92">Description</h3>
<p>In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result, when such connections are rendered or printed to logs, proxy credentials embedded in these fields could be exposed.<br><br>Users are recommended to upgrade to 3.1.6 or later for Airflow 3, an [...]
-<h3 id="references-87">References</h3>
+<h3 id="references-92">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/x6kply4nqd4vc4wgxtm6g9r2tt63s8c5">https://lists.apache.org/thread/x6kply4nqd4vc4wgxtm6g9r2tt63s8c5</a></li>
<li><a href="https://github.com/apache/airflow/pull/59688">https://github.com/apache/airflow/pull/59688</a></li>
</ul>
-<h3 id="credits-87">Credits</h3>
+<h3 id="credits-92">Credits</h3>
<ul>
<li>lwlkr <a href="https://github.com/kwkr">https://github.com/kwkr</a> (finder)</li>
<li>Ankit Chaurasia (remediation developer)</li>
@@ -1830,17 +1929,17 @@
<h2 id="CVE-2025-68438">Secrets in rendered templates could contain parts of sensitive values when truncated</h2>
<p>CVE-2025-68438 <a href="https://cve.org/CVERecord?id=CVE-2025-68438">[CVE]</a> <a href="./CVE-2025-68438.cve.json">[CVE json]</a> <a href="./CVE-2025-68438.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-01-16T10:06:05.336Z</em></p>
-<h3 id="affected-88">Affected</h3>
+<h3 id="affected-93">Affected</h3>
<ul>
<li>Apache Airflow from 3.1.0 before 3.1.6</li>
</ul>
-<h3 id="description-88">Description</h3>
+<h3 id="description-93">Description</h3>
<p>In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] <code>max_templated_field_length</code>, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include user-registered <code>mask_secret()</code> patterns, so secrets were not reliably masked before truncation and display.<br><br>Users are recommended to upgrade to 3.1.6 or l [...]
-<h3 id="references-88">References</h3>
+<h3 id="references-93">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/55n7b4nlsz3vo5n4h5lrj9bfsk8ctyff">https://lists.apache.org/thread/55n7b4nlsz3vo5n4h5lrj9bfsk8ctyff</a></li>
</ul>
-<h3 id="credits-88">Credits</h3>
+<h3 id="credits-93">Credits</h3>
<ul>
<li>William Ashe (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -1848,36 +1947,36 @@
<h2 id="CVE-2025-67895">Edge3 Worker RPC RCE on Airflow 2</h2>
<p>CVE-2025-67895 <a href="https://cve.org/CVERecord?id=CVE-2025-67895">[CVE]</a> <a href="./CVE-2025-67895.cve.json">[CVE json]</a> <a href="./CVE-2025-67895.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-12-17T11:48:30.034Z</em></p>
-<h3 id="affected-89">Affected</h3>
+<h3 id="affected-94">Affected</h3>
<ul>
<li>Apache Airflow Providers Edge3 before 2.0.0</li>
</ul>
-<h3 id="description-89">Description</h3>
+<h3 id="description-94">Description</h3>
<p>Edge3 Worker RPC RCE on Airflow 2.</p><p>This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if you installed and configured it on Airflow 2.</p><p></p><p>The Edge3 provider support in Airflow 2 has been always development-only and not officially released, however if you installed and configured Edge3 provider in Airflow 2, it implicitly enabled non-public (normally) API which was used to test Edge Provider in Airflow 2 during the development. This API allowed D [...]
-<h3 id="references-89">References</h3>
+<h3 id="references-94">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/59143">https://github.com/apache/airflow/pull/59143</a></li>
<li><a href="https://lists.apache.org/thread/hhnmmzkj5qx5gbk6pdkh8tcsx5oj1nqs">https://lists.apache.org/thread/hhnmmzkj5qx5gbk6pdkh8tcsx5oj1nqs</a></li>
</ul>
-<h3 id="credits-89">Credits</h3>
+<h3 id="credits-94">Credits</h3>
<ul>
<li>Lee (finder)</li>
</ul>
<h2 id="CVE-2025-66388">Secrets in rendered templates not redacted properly and exposed in the UI</h2>
<p>CVE-2025-66388 <a href="https://cve.org/CVERecord?id=CVE-2025-66388">[CVE]</a> <a href="./CVE-2025-66388.cve.json">[CVE json]</a> <a href="./CVE-2025-66388.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-12-15T11:30:42.649Z</em></p>
-<h3 id="affected-90">Affected</h3>
+<h3 id="affected-95">Affected</h3>
<ul>
<li>Apache Airflow from 3.1.0 before 3.1.4</li>
</ul>
-<h3 id="description-90">Description</h3>
+<h3 id="description-95">Description</h3>
<p>A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without the appropriate authorization.<br><br>Users are recommended to upgrade to version 3.1.4, which fixes this issue.</p>
-<h3 id="references-90">References</h3>
+<h3 id="references-95">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/58772">https://github.com/apache/airflow/pull/58772</a></li>
<li><a href="https://lists.apache.org/thread/mv9hzsx8grjf7gdlkxwppnpbtogtls2g">https://lists.apache.org/thread/mv9hzsx8grjf7gdlkxwppnpbtogtls2g</a></li>
</ul>
-<h3 id="credits-90">Credits</h3>
+<h3 id="credits-95">Credits</h3>
<ul>
<li>William Ashe (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -1885,18 +1984,18 @@
<h2 id="CVE-2025-66236">Secrets from Airflow config file logged in plain text in DAG run logs UI</h2>
<p>CVE-2025-66236 <a href="https://cve.org/CVERecord?id=CVE-2025-66236">[CVE]</a> <a href="./CVE-2025-66236.cve.json">[CVE json]</a> <a href="./CVE-2025-66236.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-13T14:20:35.201Z</em></p>
-<h3 id="affected-91">Affected</h3>
+<h3 id="affected-96">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.0</li>
</ul>
-<h3 id="description-91">Description</h3>
+<h3 id="description-96">Description</h3>
<p>Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay attention to security details and security model of Airflow. Some assumptions the Deployment Manager could make were not clear or explicit enough, even though Airflow's intentions and security model of Airflow did not suggest different assumptions. The overall security model [1], workload isolation [2], and JWT authentication details [3] are now descr [...]
-<h3 id="references-91">References</h3>
+<h3 id="references-96">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/58662">https://github.com/apache/airflow/pull/58662</a></li>
<li><a href="https://lists.apache.org/thread/g8fyy1tkmxkkfk7tx2v6h8mvwzpyykbo">https://lists.apache.org/thread/g8fyy1tkmxkkfk7tx2v6h8mvwzpyykbo</a></li>
</ul>
-<h3 id="credits-91">Credits</h3>
+<h3 id="credits-96">Credits</h3>
<ul>
<li>Saurabh Banawar (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -1904,20 +2003,20 @@
<h2 id="CVE-2025-65995">Disclosure of secrets to UI via kwargs</h2>
<p>CVE-2025-65995 <a href="https://cve.org/CVERecord?id=CVE-2025-65995">[CVE]</a> <a href="./CVE-2025-65995.cve.json">[CVE json]</a> <a href="./CVE-2025-65995.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-08T19:08:56.440Z</em></p>
-<h3 id="affected-92">Affected</h3>
+<h3 id="affected-97">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.1.4</li>
<li>Apache Airflow before 2.11.1</li>
</ul>
-<h3 id="description-92">Description</h3>
+<h3 id="description-97">Description</h3>
<p>When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG. <br><br>The issue has been fixed in Airflow 3.1.4 and 2.11.1, and users are strongly advised to upgrade to prevent potential disclosure of sensitive information.</p>
-<h3 id="references-92">References</h3>
+<h3 id="references-97">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/58252">https://github.com/apache/airflow/pull/58252</a></li>
<li><a href="https://lists.apache.org/thread/1qzlrjo2wmlzs0rrgzgslj2pzkor0dr2">https://lists.apache.org/thread/1qzlrjo2wmlzs0rrgzgslj2pzkor0dr2</a></li>
<li><a href="https://github.com/apache/airflow/pull/61883">https://github.com/apache/airflow/pull/61883</a></li>
</ul>
-<h3 id="credits-92">Credits</h3>
+<h3 id="credits-97">Credits</h3>
<ul>
<li>Frieder Gottman (Cariad) (finder)</li>
<li>Jens Scheffler (Bosch) (reporter)</li>
@@ -1926,53 +2025,53 @@
<h2 id="CVE-2025-62503">Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)</h2>
<p>CVE-2025-62503 <a href="https://cve.org/CVERecord?id=CVE-2025-62503">[CVE]</a> <a href="./CVE-2025-62503.cve.json">[CVE json]</a> <a href="./CVE-2025-62503.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-10-30T09:11:15.486Z</em></p>
-<h3 id="affected-93">Affected</h3>
+<h3 id="affected-98">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.1.1</li>
</ul>
-<h3 id="description-93">Description</h3>
+<h3 id="description-98">Description</h3>
<p>User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.<br><br><br></p>
-<h3 id="references-93">References</h3>
+<h3 id="references-98">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/3v58249qscyn1hg240gh8hqg9pb4okcr">https://lists.apache.org/thread/3v58249qscyn1hg240gh8hqg9pb4okcr</a></li>
</ul>
-<h3 id="credits-93">Credits</h3>
+<h3 id="credits-98">Credits</h3>
<ul>
<li>Maciej Kawka (finder)</li>
</ul>
<h2 id="CVE-2025-62402">Airflow 3 API: /api/v2/dagReports executes DAG Python in API</h2>
<p>CVE-2025-62402 <a href="https://cve.org/CVERecord?id=CVE-2025-62402">[CVE]</a> <a href="./CVE-2025-62402.cve.json">[CVE json]</a> <a href="./CVE-2025-62402.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-10-30T09:14:24.818Z</em></p>
-<h3 id="affected-94">Affected</h3>
+<h3 id="affected-99">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.1.1</li>
</ul>
-<h3 id="description-94">Description</h3>
+<h3 id="description-99">Description</h3>
<p>API users via <code>/api/v2/dagReports</code> could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.<br></p>
-<h3 id="references-94">References</h3>
+<h3 id="references-99">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/vbzxnxn031wb998hsd7vqnvh4z8nx6rs">https://lists.apache.org/thread/vbzxnxn031wb998hsd7vqnvh4z8nx6rs</a></li>
</ul>
-<h3 id="credits-94">Credits</h3>
+<h3 id="credits-99">Credits</h3>
<ul>
<li>kwkr (<a href="https://github.com/kwkr">https://github.com/kwkr</a>) (reporter)</li>
</ul>
<h2 id="CVE-2025-57735">Airflow Logout Not Invalidating JWT</h2>
<p>CVE-2025-57735 <a href="https://cve.org/CVERecord?id=CVE-2025-57735">[CVE]</a> <a href="./CVE-2025-57735.cve.json">[CVE json]</a> <a href="./CVE-2025-57735.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-09T11:12:40.266Z</em></p>
-<h3 id="affected-95">Affected</h3>
+<h3 id="affected-100">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before 3.2.0</li>
</ul>
-<h3 id="description-95">Description</h3>
+<h3 id="description-100">Description</h3>
<p>When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+</p><br><br>Users are recommended to upgrade to version 3.2.0, which fixes this issue.
-<h3 id="references-95">References</h3>
+<h3 id="references-100">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/61339">https://github.com/apache/airflow/pull/61339</a></li>
<li><a href="https://github.com/apache/airflow/pull/56633">https://github.com/apache/airflow/pull/56633</a></li>
<li><a href="https://lists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98">https://lists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98</a></li>
</ul>
-<h3 id="credits-95">Credits</h3>
+<h3 id="credits-100">Credits</h3>
<ul>
<li>Saurabh Banawar (finder)</li>
<li>Anish Giri (remediation developer)</li>
@@ -1981,159 +2080,159 @@
<h2 id="CVE-2025-54941">Command injection in “example_dag_decorator”</h2>
<p>CVE-2025-54941 <a href="https://cve.org/CVERecord?id=CVE-2025-54941">[CVE]</a> <a href="./CVE-2025-54941.cve.json">[CVE json]</a> <a href="./CVE-2025-54941.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-10-30T09:45:25.170Z</em></p>
-<h3 id="affected-96">Affected</h3>
+<h3 id="affected-101">Affected</h3>
<ul>
<li>Apache Airflow from 3.0.0 before < 3.0.5</li>
</ul>
-<h3 id="description-96">Description</h3>
+<h3 id="description-101">Description</h3>
<p>An example dag <code>example_dag_decorator</code> had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on worker. This however required that the example dags are enabled in production (not default) or the example dag code copied to build your own similar dag. If you used the <code>example_dag_decorator</code> please review it and apply the changes implemented in Airflow 3.0.5 accordingly.<br><br><br></p>
-<h3 id="references-96">References</h3>
+<h3 id="references-101">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/c6q6nofc6xl5bms039ks9b34v0v36df1">https://lists.apache.org/thread/c6q6nofc6xl5bms039ks9b34v0v36df1</a></li>
</ul>
-<h3 id="credits-96">Credits</h3>
+<h3 id="credits-101">Credits</h3>
<ul>
<li>Nacl (reporter)</li>
</ul>
<h2 id="CVE-2025-54831">Connection sensitive details exposed to users with READ permissions</h2>
<p>CVE-2025-54831 <a href="https://cve.org/CVERecord?id=CVE-2025-54831">[CVE]</a> <a href="./CVE-2025-54831.cve.json">[CVE json]</a> <a href="./CVE-2025-54831.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-09-26T07:28:57.402Z</em></p>
-<h3 id="affected-97">Affected</h3>
+<h3 id="affected-102">Affected</h3>
<ul>
<li>Apache Airflow at 3.0.3</li>
</ul>
-<h3 id="description-97">Description</h3>
+<h3 id="description-102">Description</h3>
<p></p><p>Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to <em>Connection Editing Users</em>, effectively applying a "write-only" model for sensitive values.</p>
<p>In Airflow 3.0.3, this model was unintentionally violated: sensitive connection information could be viewed by users with READ permissions through both the API and the UI. This behavior also bypassed the `<code>AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS`</code> configuration option.</p>
<p>This issue does not affect Airflow 2.x, where exposing sensitive information to connection editors was the intended and documented behavior.</p><p></p><p><br></p><p>Users of Airflow 3.0.3 are advised to upgrade Airflow to >=3.0.4.</p>
-<h3 id="references-97">References</h3>
+<h3 id="references-102">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/vblmfqtydrp5zgn2q8tj3slk5podxspf">https://lists.apache.org/thread/vblmfqtydrp5zgn2q8tj3slk5podxspf</a></li>
</ul>
<h2 id="CVE-2025-54550">RCE by race condition in example_xcom dag</h2>
<p>CVE-2025-54550 <a href="https://cve.org/CVERecord?id=CVE-2025-54550">[CVE]</a> <a href="./CVE-2025-54550.cve.json">[CVE json]</a> <a href="./CVE-2025-54550.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-19T23:47:06.426Z</em></p>
-<h3 id="affected-98">Affected</h3>
+<h3 id="affected-103">Affected</h3>
<ul>
<li>Apache Airflow before 3.2.0</li>
</ul>
-<h3 id="description-98">Description</h3>
+<h3 id="description-103">Description</h3>
<p>The example <code>example_xcom</code> that was included in airflow documentation implemented unsafe pattern of reading value<br>from xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary<br>execution of code on the worker. Since the UI users are already highly trusted, this is a Low severity vulnerability.</p><p>It does not affect Airflow release - example_dags are not supposed to be enabled in production environment, however [...]
-<h3 id="references-98">References</h3>
+<h3 id="references-103">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/3mf4cfx070ofsnf9qy0s2v5gqb5sc2g1">https://lists.apache.org/thread/3mf4cfx070ofsnf9qy0s2v5gqb5sc2g1</a></li>
<li><a href="https://github.com/apache/airflow/pull/63200">https://github.com/apache/airflow/pull/63200</a></li>
</ul>
-<h3 id="credits-97">Credits</h3>
+<h3 id="credits-102">Credits</h3>
<ul>
<li>Vincent55 Yang (finder)</li>
</ul>
<h2 id="CVE-2025-50213">Potential SQL injection in CopyFromExternalStageToSnowflakeOperator</h2>
<p>CVE-2025-50213 <a href="https://cve.org/CVERecord?id=CVE-2025-50213">[CVE]</a> <a href="./CVE-2025-50213.cve.json">[CVE json]</a> <a href="./CVE-2025-50213.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-06-24T07:06:50.934Z</em></p>
-<h3 id="affected-99">Affected</h3>
+<h3 id="affected-104">Affected</h3>
<ul>
<li>Apache Airflow Providers Snowflake before 6.4.0</li>
</ul>
-<h3 id="description-99">Description</h3>
+<h3 id="description-104">Description</h3>
<p>Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.</p><p>This issue affects Apache Airflow Providers Snowflake: before 6.4.0.</p><span style="background-color: rgb(255, 255, 255);"><span style="background-color: rgb(255, 255, 255);">Sanitation of table and stage parameters were added in</span> CopyFromExternalStageToSnowflakeOperator <span style="background-color: rgb(255, 255, 255);">t [...]
-<h3 id="references-99">References</h3>
+<h3 id="references-104">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/51734">https://github.com/apache/airflow/pull/51734</a></li>
<li><a href="https://lists.apache.org/thread/2kqfmyt2pghg5f6797g8hzvq331v8qx3">https://lists.apache.org/thread/2kqfmyt2pghg5f6797g8hzvq331v8qx3</a></li>
</ul>
-<h3 id="credits-98">Credits</h3>
+<h3 id="credits-103">Credits</h3>
<ul>
<li>Nhien Pham (@nhienit) at Galaxy One (finder)</li>
</ul>
<h2 id="CVE-2025-30473">Remote Code Execution via Sql Injection</h2>
<p>CVE-2025-30473 <a href="https://cve.org/CVERecord?id=CVE-2025-30473">[CVE]</a> <a href="./CVE-2025-30473.cve.json">[CVE json]</a> <a href="./CVE-2025-30473.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-04-07T08:31:55.441Z</em></p>
-<h3 id="affected-100">Affected</h3>
+<h3 id="affected-105">Affected</h3>
<ul>
<li>Apache Airflow Common SQL Provider before 1.24.1</li>
</ul>
-<h3 id="description-100">Description</h3>
+<h3 id="description-105">Description</h3>
<p>Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow Common SQL Provider.<br><br><span style="background-color: rgb(255, 255, 255);">When using the partition clause in SQLTableCheckOperator as parameter (which was a recommended pattern), Authenticated UI User could inject arbitrary SQL command when triggering DAG exposing partition_clause to the user.<br></span><span style="background-color: rgb(255, 255, 255);">This allo [...]
-<h3 id="references-100">References</h3>
+<h3 id="references-105">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/48098">https://github.com/apache/airflow/pull/48098</a></li>
<li><a href="https://lists.apache.org/thread/53klkv790cylqcop0350w7nfq1y6h0t2">https://lists.apache.org/thread/53klkv790cylqcop0350w7nfq1y6h0t2</a></li>
</ul>
-<h3 id="credits-99">Credits</h3>
+<h3 id="credits-104">Credits</h3>
<ul>
<li>nxczje (reporter)</li>
</ul>
<h2 id="CVE-2025-27555">Connection Secrets not masked in UI when Connection are added via Airflow cli</h2>
<p>CVE-2025-27555 <a href="https://cve.org/CVERecord?id=CVE-2025-27555">[CVE]</a> <a href="./CVE-2025-27555.cve.json">[CVE json]</a> <a href="./CVE-2025-27555.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-03-11T15:10:00.713Z</em></p>
-<h3 id="affected-101">Affected</h3>
+<h3 id="affected-106">Affected</h3>
<ul>
<li>Apache Airflow before 2.11.1</li>
</ul>
-<h3 id="description-101">Description</h3>
+<h3 id="description-106">Description</h3>
<p>Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive connection parameters were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow database. While this risk is limited to users with audit log access, it is recommended to upgrade to Airflow 2.11.1 or a later version, which addresses this iss [...]
-<h3 id="references-101">References</h3>
+<h3 id="references-106">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/61882">https://github.com/apache/airflow/pull/61882</a></li>
<li><a href="https://lists.apache.org/thread/nxovkp319jo8vg498gql1yswtb2frbkw">https://lists.apache.org/thread/nxovkp319jo8vg498gql1yswtb2frbkw</a></li>
</ul>
-<h3 id="credits-100">Credits</h3>
+<h3 id="credits-105">Credits</h3>
<ul>
<li>sw0rd1ight (finder)</li>
</ul>
<h2 id="CVE-2025-27018">SQL injection in MySQL provider core function</h2>
<p>CVE-2025-27018 <a href="https://cve.org/CVERecord?id=CVE-2025-27018">[CVE]</a> <a href="./CVE-2025-27018.cve.json">[CVE json]</a> <a href="./CVE-2025-27018.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-03-19T09:06:05.242Z</em></p>
-<h3 id="affected-102">Affected</h3>
+<h3 id="affected-107">Affected</h3>
<ul>
<li>Apache Airflow MySQL Provider before 6.2.0</li>
</ul>
-<h3 id="description-102">Description</h3>
+<h3 id="description-107">Description</h3>
<p>Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow MySQL Provider.</p><span style="background-color: rgb(255, 255, 255);">When user triggered a DAG with dump_sql or load_sql functions they could pass a table parameter from a UI, that could cause SQL injection by running SQL that was not intended.<br>It could lead to data corruption, modification and others.</span><br><p>This issue affects Apache Airflow MySQL Provider: [...]
-<h3 id="references-102">References</h3>
+<h3 id="references-107">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/47254">https://github.com/apache/airflow/pull/47254</a></li>
<li><a href="https://github.com/apache/airflow/pull/47255">https://github.com/apache/airflow/pull/47255</a></li>
<li><a href="https://lists.apache.org/thread/m8ohgkwz4mq9njohf66sjwqjdy28gvzf">https://lists.apache.org/thread/m8ohgkwz4mq9njohf66sjwqjdy28gvzf</a></li>
</ul>
-<h3 id="credits-101">Credits</h3>
+<h3 id="credits-106">Credits</h3>
<ul>
<li>Vincent55 (DEVCORE Internship Program) (finder)</li>
</ul>
<h2 id="CVE-2024-56373">SSTI to Code Execution in Airflow through Shared DB Information</h2>
<p>CVE-2024-56373 <a href="https://cve.org/CVERecord?id=CVE-2024-56373">[CVE]</a> <a href="./CVE-2024-56373.cve.json">[CVE json]</a> <a href="./CVE-2024-56373.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-02-24T10:06:39.270Z</em></p>
-<h3 id="affected-103">Affected</h3>
+<h3 id="affected-108">Affected</h3>
<ul>
<li>Apache Airflow before 2.11.1</li>
</ul>
-<h3 id="description-103">Description</h3>
+<h3 id="description-108">Description</h3>
<p>DAG Author (who already has quite a lot of permissions) could manipulate database of Airflow 2 in the way to execute arbitrary code in the web-server context, which they should normally not be able to do, leading to potentially remote code execution in the context of web-server (server-side) as a result of a user viewing historical task information.</p>The functionality responsible for that (log template history) has been disabled by default in 2.11.1 and users should upgrade to Airfl [...]
-<h3 id="references-103">References</h3>
+<h3 id="references-108">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/61880">https://github.com/apache/airflow/pull/61880</a></li>
<li><a href="https://lists.apache.org/thread/2vrmrhcht6g7cp5yjxpnrk2wtrncm6cy">https://lists.apache.org/thread/2vrmrhcht6g7cp5yjxpnrk2wtrncm6cy</a></li>
</ul>
-<h3 id="credits-102">Credits</h3>
+<h3 id="credits-107">Credits</h3>
<ul>
<li>Seokchan Yoon. (finder)</li>
</ul>
<h2 id="CVE-2024-50378">Secrets not masked in UI when sensitive variables are set via Airflow cli</h2>
<p>CVE-2024-50378 <a href="https://cve.org/CVERecord?id=CVE-2024-50378">[CVE]</a> <a href="./CVE-2024-50378.cve.json">[CVE json]</a> <a href="./CVE-2024-50378.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-11-08T14:37:07.862Z</em></p>
-<h3 id="affected-104">Affected</h3>
+<h3 id="affected-109">Affected</h3>
<ul>
<li>Apache Airflow before 2.10.3</li>
</ul>
-<h3 id="description-104">Description</h3>
+<h3 id="description-109">Description</h3>
<p>Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive variables were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow database. While this risk is limited to users with audit log access, it is recommended to upgrade to Airflow 2.10.3 or a later version, which addresses this issue. Users wh [...]
-<h3 id="references-104">References</h3>
+<h3 id="references-109">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/43123">https://github.com/apache/airflow/pull/43123</a></li>
<li><a href="https://lists.apache.org/thread/17rxys384lzfd6nhm3fztzgvk47zy7jb">https://lists.apache.org/thread/17rxys384lzfd6nhm3fztzgvk47zy7jb</a></li>
</ul>
-<h3 id="credits-103">Credits</h3>
+<h3 id="credits-108">Credits</h3>
<ul>
<li>Saurabh Banawar (finder)</li>
<li>Shubham Raj (remediation developer)</li>
@@ -2141,18 +2240,18 @@
<h2 id="CVE-2024-45784">Sensitive configuration values are not masked in the logs by default</h2>
<p>CVE-2024-45784 <a href="https://cve.org/CVERecord?id=CVE-2024-45784">[CVE]</a> <a href="./CVE-2024-45784.cve.json">[CVE json]</a> <a href="./CVE-2024-45784.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-11-15T08:20:02.608Z</em></p>
-<h3 id="affected-105">Affected</h3>
+<h3 id="affected-110">Affected</h3>
<ul>
<li>Apache Airflow before 2.10.3</li>
</ul>
-<h3 id="description-105">Description</h3>
+<h3 id="description-110">Description</h3>
<p>Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG authors to unintentionally or intentionally log sensitive configuration variables. Unauthorized users could access these logs, potentially exposing critical data that could be exploited to compromise the security of the Airflow deployment. In version 2.10.3, secrets are now masked in task logs to prevent sensitive configuration v [...]
-<h3 id="references-105">References</h3>
+<h3 id="references-110">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/43040">https://github.com/apache/airflow/pull/43040</a></li>
<li><a href="https://lists.apache.org/thread/k2jm55jztlbmk4zrlh10syvq3n57hl4h">https://lists.apache.org/thread/k2jm55jztlbmk4zrlh10syvq3n57hl4h</a></li>
</ul>
-<h3 id="credits-104">Credits</h3>
+<h3 id="credits-109">Credits</h3>
<ul>
<li>Saurabh Banawar (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -2160,18 +2259,18 @@
<h2 id="CVE-2024-45498">Command Injection in an example DAG</h2>
<p>CVE-2024-45498 <a href="https://cve.org/CVERecord?id=CVE-2024-45498">[CVE]</a> <a href="./CVE-2024-45498.cve.json">[CVE json]</a> <a href="./CVE-2024-45498.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-09-07T07:43:42.216Z</em></p>
-<h3 id="affected-106">Affected</h3>
+<h3 id="affected-111">Affected</h3>
<ul>
<li>Apache Airflow at 2.10.0</li>
</ul>
-<h3 id="description-106">Description</h3>
+<h3 id="description-111">Description</h3>
<p>Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the dangerous example; see <a target="_blank" rel="nofollow" href="https://github.com/apache/airflow/pull/41873"><a href="https://github.com/apache/airflow/pull/41873">https://github.com/apache [...]
-<h3 id="references-106">References</h3>
+<h3 id="references-111">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/41873">https://github.com/apache/airflow/pull/41873</a></li>
<li><a href="https://lists.apache.org/thread/tl7lzczcqdmqj2pcpbvtjdpd2tb9561n">https://lists.apache.org/thread/tl7lzczcqdmqj2pcpbvtjdpd2tb9561n</a></li>
</ul>
-<h3 id="credits-105">Credits</h3>
+<h3 id="credits-110">Credits</h3>
<ul>
<li>Nhien Pham (aka nhienit) at Galaxy One (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -2179,18 +2278,18 @@
<h2 id="CVE-2024-45034">Authenticated DAG authors could execute code on scheduler nodes</h2>
<p>CVE-2024-45034 <a href="https://cve.org/CVERecord?id=CVE-2024-45034">[CVE]</a> <a href="./CVE-2024-45034.cve.json">[CVE json]</a> <a href="./CVE-2024-45034.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-09-07T07:45:26.032Z</em></p>
-<h3 id="affected-107">Affected</h3>
+<h3 id="affected-112">Affected</h3>
<ul>
<li>Apache Airflow before 2.10.1</li>
</ul>
-<h3 id="description-107">Description</h3>
+<h3 id="description-112">Description</h3>
<p>Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. <br>Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.</p>
-<h3 id="references-107">References</h3>
+<h3 id="references-112">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/41672">https://github.com/apache/airflow/pull/41672</a></li>
<li><a href="https://lists.apache.org/thread/b4fcw33vh60yfg9990n5vmc7sy2dcgjx">https://lists.apache.org/thread/b4fcw33vh60yfg9990n5vmc7sy2dcgjx</a></li>
</ul>
-<h3 id="credits-106">Credits</h3>
+<h3 id="credits-111">Credits</h3>
<ul>
<li>Seokchan Yoon: <a href="https://github.com/ch4n3-yoon">https://github.com/ch4n3-yoon</a> (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -2198,31 +2297,31 @@
<h2 id="CVE-2024-45033">Application does not invalidate session after password change via Airflow cli</h2>
<p>CVE-2024-45033 <a href="https://cve.org/CVERecord?id=CVE-2024-45033">[CVE]</a> <a href="./CVE-2024-45033.cve.json">[CVE json]</a> <a href="./CVE-2024-45033.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-01-08T08:41:37.392Z</em></p>
-<h3 id="affected-108">Affected</h3>
+<h3 id="affected-113">Affected</h3>
<ul>
<li>Apache Airflow Fab Provider before 1.5.2</li>
</ul>
-<h3 id="description-108">Description</h3>
+<h3 id="description-113">Description</h3>
<p>Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider.</p><p>This issue affects Apache Airflow Fab Provider: before 1.5.2.<br><br><span style="background-color: rgb(255, 255, 255);">When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password was changed. This only happened when the password was changed wit [...]
-<h3 id="references-108">References</h3>
+<h3 id="references-113">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/45139">https://github.com/apache/airflow/pull/45139</a></li>
<li><a href="https://lists.apache.org/thread/yw535346rk766ybzpqtvrl36sjj789st">https://lists.apache.org/thread/yw535346rk766ybzpqtvrl36sjj789st</a></li>
</ul>
-<h3 id="credits-107">Credits</h3>
+<h3 id="credits-112">Credits</h3>
<ul>
<li>Saurabh Banawar (reporter)</li>
</ul>
<h2 id="CVE-2024-42447">FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow</h2>
<p>CVE-2024-42447 <a href="https://cve.org/CVERecord?id=CVE-2024-42447">[CVE]</a> <a href="./CVE-2024-42447.cve.json">[CVE json]</a> <a href="./CVE-2024-42447.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-08-04T20:03:30.234Z</em></p>
-<h3 id="affected-109">Affected</h3>
+<h3 id="affected-114">Affected</h3>
<ul>
<li>Apache Airflow Providers FAB from 1.2.0 through 1.2.1</li>
</ul>
-<h3 id="description-109">Description</h3>
+<h3 id="description-114">Description</h3>
<p>Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB.</p><p>This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out. </p><p>* FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected)</p><p>* FAB provider 1.2.0 affected all versions of Airflow.<br></p><p><span style="backgroun [...]
-<h3 id="references-109">References</h3>
+<h3 id="references-114">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/40784">https://github.com/apache/airflow/pull/40784</a></li>
<li><a href="https://lists.apache.org/thread/2zoo8cjlwfjhbfdxfgltcm0hnc0qmc52">https://lists.apache.org/thread/2zoo8cjlwfjhbfdxfgltcm0hnc0qmc52</a></li>
@@ -2230,18 +2329,18 @@
<h2 id="CVE-2024-41937">Stored XSS Vulnerability on provider link</h2>
<p>CVE-2024-41937 <a href="https://cve.org/CVERecord?id=CVE-2024-41937">[CVE]</a> <a href="./CVE-2024-41937.cve.json">[CVE json]</a> <a href="./CVE-2024-41937.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-08-21T15:31:11.725Z</em></p>
-<h3 id="affected-110">Affected</h3>
+<h3 id="affected-115">Affected</h3>
<ul>
<li>Apache Airflow before 2.10.0</li>
</ul>
-<h3 id="description-110">Description</h3>
+<h3 id="description-115">Description</h3>
<p>Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This would require the provider to be installed on the web server and the user to click the provider link.<br>Users should upgrade to 2.10.0 or later, which fixes this vulnerability.</p>
-<h3 id="references-110">References</h3>
+<h3 id="references-115">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/40933">https://github.com/apache/airflow/pull/40933</a></li>
<li><a href="https://lists.apache.org/thread/lwlmgg6hqfmkpvw5py4w53hxyl37jl6d">https://lists.apache.org/thread/lwlmgg6hqfmkpvw5py4w53hxyl37jl6d</a></li>
</ul>
-<h3 id="credits-108">Credits</h3>
+<h3 id="credits-113">Credits</h3>
<ul>
<li>sw0rd1ight (<a href="https://github.com/sw0rd1ight">https://github.com/sw0rd1ight</a>) (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -2249,18 +2348,18 @@
<h2 id="CVE-2024-39877">DAG Author Code Execution possibility in airflow-scheduler</h2>
<p>CVE-2024-39877 <a href="https://cve.org/CVERecord?id=CVE-2024-39877">[CVE]</a> <a href="./CVE-2024-39877.cve.json">[CVE json]</a> <a href="./CVE-2024-39877.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-07-17T07:54:23.158Z</em></p>
-<h3 id="affected-111">Affected</h3>
+<h3 id="affected-116">Affected</h3>
<ul>
<li>Apache Airflow from 2.4.0 before 2.9.3</li>
</ul>
-<h3 id="description-111">Description</h3>
+<h3 id="description-116">Description</h3>
<p>Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability.</p>
-<h3 id="references-111">References</h3>
+<h3 id="references-116">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/40522">https://github.com/apache/airflow/pull/40522</a></li>
<li><a href="https://lists.apache.org/thread/1xhj9dkp37d6pzn24ll2mf94wbqnb2y1">https://lists.apache.org/thread/1xhj9dkp37d6pzn24ll2mf94wbqnb2y1</a></li>
</ul>
-<h3 id="credits-109">Credits</h3>
+<h3 id="credits-114">Credits</h3>
<ul>
<li>Seokchan Yoon (<a href="https://github.com/ch4n3-yoon">https://github.com/ch4n3-yoon</a>) (finder)</li>
<li>Wei Lee (remediation developer)</li>
@@ -2268,18 +2367,18 @@
<h2 id="CVE-2024-39863">Potential XSS Vulnerability</h2>
<p>CVE-2024-39863 <a href="https://cve.org/CVERecord?id=CVE-2024-39863">[CVE]</a> <a href="./CVE-2024-39863.cve.json">[CVE json]</a> <a href="./CVE-2024-39863.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-07-22T08:50:05.686Z</em></p>
-<h3 id="affected-112">Affected</h3>
+<h3 id="affected-117">Affected</h3>
<ul>
<li>Apache Airflow before 2.9.3</li>
</ul>
-<h3 id="description-112">Description</h3>
+<h3 id="description-117">Description</h3>
<p>Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue.<br></p>
-<h3 id="references-112">References</h3>
+<h3 id="references-117">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/40475">https://github.com/apache/airflow/pull/40475</a></li>
<li><a href="https://lists.apache.org/thread/gxkvs279f1mbvckv5q65worr6how20o3">https://lists.apache.org/thread/gxkvs279f1mbvckv5q65worr6how20o3</a></li>
</ul>
-<h3 id="credits-110">Credits</h3>
+<h3 id="credits-115">Credits</h3>
<ul>
<li>Seokchan Yoon (<a href="https://github.com/ch4n3-yoon">https://github.com/ch4n3-yoon</a>) (finder)</li>
<li>Amogh Desai (remediation developer)</li>
@@ -2287,18 +2386,18 @@
<h2 id="CVE-2024-32077">XSS vulnerability in Task Instance Log/Log Details</h2>
<p>CVE-2024-32077 <a href="https://cve.org/CVERecord?id=CVE-2024-32077">[CVE]</a> <a href="./CVE-2024-32077.cve.json">[CVE json]</a> <a href="./CVE-2024-32077.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-05-14T10:43:17.698Z</em></p>
-<h3 id="affected-113">Affected</h3>
+<h3 id="affected-118">Affected</h3>
<ul>
<li>Apache Airflow from 2.9.0 before 2.9.1</li>
</ul>
-<h3 id="description-113">Description</h3>
+<h3 id="description-118">Description</h3>
<p>Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs. <br>Users are recommended to upgrade to version 2.9.1, which fixes this issue.<br></p>
-<h3 id="references-113">References</h3>
+<h3 id="references-118">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/38882">https://github.com/apache/airflow/pull/38882</a></li>
<li><a href="https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77">https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77</a></li>
</ul>
-<h3 id="credits-111">Credits</h3>
+<h3 id="credits-116">Credits</h3>
<ul>
<li>Ming (finder)</li>
<li>Jens Scheffler (remediation developer)</li>
@@ -2306,18 +2405,18 @@
<h2 id="CVE-2024-31869">Sensitive configuration for providers displayed when “non-sensitive-only” config used</h2>
<p>CVE-2024-31869 <a href="https://cve.org/CVERecord?id=CVE-2024-31869">[CVE]</a> <a href="./CVE-2024-31869.cve.json">[CVE json]</a> <a href="./CVE-2024-31869.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-04-18T07:18:58.062Z</em></p>
-<h3 id="affected-114">Affected</h3>
+<h3 id="affected-119">Affected</h3>
<ul>
<li>Apache Airflow from 2.7.0 through 2.8.4</li>
</ul>
-<h3 id="description-114">Description</h3>
+<h3 id="description-119">Description</h3>
<p>Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration <span style="background-color: rgb(255, 255, 255);">via the “configuration” UI page </span>when “non-sensitive-only” was set as “webserver.expose_config” configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your &ldquo [...]
-<h3 id="references-114">References</h3>
+<h3 id="references-119">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/38795">https://github.com/apache/airflow/pull/38795</a></li>
<li><a href="https://lists.apache.org/thread/pz6vg7wcjk901rmsgt86h76g6kfcgtk3">https://lists.apache.org/thread/pz6vg7wcjk901rmsgt86h76g6kfcgtk3</a></li>
</ul>
-<h3 id="credits-112">Credits</h3>
+<h3 id="credits-117">Credits</h3>
<ul>
<li>Manmeet Rangoola (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -2325,56 +2424,56 @@
<h2 id="CVE-2024-29735">Potentially harmful permission changing by log task handler</h2>
<p>CVE-2024-29735 <a href="https://cve.org/CVERecord?id=CVE-2024-29735">[CVE]</a> <a href="./CVE-2024-29735.cve.json">[CVE json]</a> <a href="./CVE-2024-29735.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-03-26T16:52:39.118Z</em></p>
-<h3 id="affected-115">Affected</h3>
+<h3 id="affected-120">Affected</h3>
<ul>
<li>Apache Airflow from 2.8.2 through 2.8.3</li>
</ul>
-<h3 id="description-115">Description</h3>
+<h3 id="description-120">Description</h3>
<p>Improper Preservation of Permissions vulnerability in Apache Airflow.<p>This issue affects Apache Airflow from 2.8.2 through 2.8.3.</p><p></p><p>Airflow’s local file task handler in Airflow incorrectly set permissions for all parent folders of log folder, in default configuration adding write access to Unix <code>group</code> of the folders. In the case Airflow is run with the root user (not recommended) it added group write permission to all folders up to the root of the filesy [...]
-<h3 id="references-115">References</h3>
+<h3 id="references-120">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/37310">https://github.com/apache/airflow/pull/37310</a></li>
<li><a href="https://lists.apache.org/thread/8khb1rtbznh100o325fb8xw5wjvtv536">https://lists.apache.org/thread/8khb1rtbznh100o325fb8xw5wjvtv536</a></li>
</ul>
-<h3 id="credits-113">Credits</h3>
+<h3 id="credits-118">Credits</h3>
<ul>
<li>Matej Murin (finder)</li>
</ul>
<h2 id="CVE-2024-29733">FTP_TLS instance with unverified SSL context</h2>
<p>CVE-2024-29733 <a href="https://cve.org/CVERecord?id=CVE-2024-29733">[CVE]</a> <a href="./CVE-2024-29733.cve.json">[CVE json]</a> <a href="./CVE-2024-29733.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-04-21T17:21:52.458Z</em></p>
-<h3 id="affected-116">Affected</h3>
+<h3 id="affected-121">Affected</h3>
<ul>
<li>Apache Airflow FTP Provider before 3.7.0</li>
</ul>
-<h3 id="description-116">Description</h3>
+<h3 id="description-121">Description</h3>
<p>Improper Certificate Validation vulnerability in Apache Airflow FTP Provider.<br><br><p>The FTP hook lacks complete certificate validation in FTP_TLS connections, which can potentially be leveraged. Implementing proper certificate validation by passing context=ssl.create_default_context() during FTP_TLS instantiation is used as mitigation to validate the certificates properly.</p><p><span style="background-color: var(--wht);">This issue affects Apache Airflow FTP Provider: before 3.7. [...]
-<h3 id="references-116">References</h3>
+<h3 id="references-121">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/38266">https://github.com/apache/airflow/pull/38266</a></li>
<li><a href="https://github.com/apache/airflow/blob/95e26118b828c364755f3a8c96870f3591b01c31/airflow/providers/ftp/hooks/ftp.py#L280">https://github.com/apache/airflow/blob/95e26118b828c364755f3a8c96870f3591b01c31/airflow/providers/ftp/hooks/ftp.py#L280</a></li>
<li><a href="https://docs.python.org/3/library/ssl.html#best-defaults">https://docs.python.org/3/library/ssl.html#best-defaults</a></li>
<li><a href="https://lists.apache.org/thread/265t5zbmtjs6h9fkw52wtp03nsbplky2">https://lists.apache.org/thread/265t5zbmtjs6h9fkw52wtp03nsbplky2</a></li>
</ul>
-<h3 id="credits-114">Credits</h3>
+<h3 id="credits-119">Credits</h3>
<ul>
<li>Eric Brown of Secure Sauce LLC (finder)</li>
</ul>
<h2 id="CVE-2024-28746">Ignored Airflow Permissions</h2>
<p>CVE-2024-28746 <a href="https://cve.org/CVERecord?id=CVE-2024-28746">[CVE]</a> <a href="./CVE-2024-28746.cve.json">[CVE json]</a> <a href="./CVE-2024-28746.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-03-14T08:40:55.534Z</em></p>
-<h3 id="affected-117">Affected</h3>
+<h3 id="affected-122">Affected</h3>
<ul>
<li>Apache Airflow from 2.8.0 before 2.8.3</li>
</ul>
-<h3 id="description-117">Description</h3>
+<h3 id="description-122">Description</h3>
<p>Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access. <br><br>Users of Apache Airflow are recommended to upgrade to version 2.8.3 or newer to mitigate the risk associated with this vulnerability<br></p>
-<h3 id="references-117">References</h3>
+<h3 id="references-122">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/37881">https://github.com/apache/airflow/pull/37881</a></li>
<li><a href="https://lists.apache.org/thread/b4pffc7w7do6qgk4jjbyxvdz5odrvny7">https://lists.apache.org/thread/b4pffc7w7do6qgk4jjbyxvdz5odrvny7</a></li>
</ul>
-<h3 id="credits-115">Credits</h3>
+<h3 id="credits-120">Credits</h3>
<ul>
<li>Alex Liotta (finder)</li>
<li>Vincent(Vincbeck) (remediation developer)</li>
@@ -2382,19 +2481,19 @@
<h2 id="CVE-2024-27906">Dag Code and Import Error Permissions Ignored</h2>
<p>CVE-2024-27906 <a href="https://cve.org/CVERecord?id=CVE-2024-27906">[CVE]</a> <a href="./CVE-2024-27906.cve.json">[CVE json]</a> <a href="./CVE-2024-27906.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-05-06T13:12:04.279Z</em></p>
-<h3 id="affected-118">Affected</h3>
+<h3 id="affected-123">Affected</h3>
<ul>
<li>Apache Airflow before 2.8.2</li>
</ul>
-<h3 id="description-118">Description</h3>
+<h3 id="description-123">Description</h3>
<p>Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI.<br><br>Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability<br></p>
-<h3 id="references-118">References</h3>
+<h3 id="references-123">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/37290">https://github.com/apache/airflow/pull/37290</a></li>
<li><a href="https://github.com/apache/airflow/pull/37468">https://github.com/apache/airflow/pull/37468</a></li>
<li><a href="https://lists.apache.org/thread/on4f7t5sqr3vfgp1pvkck79wv7mq9st5">https://lists.apache.org/thread/on4f7t5sqr3vfgp1pvkck79wv7mq9st5</a></li>
</ul>
-<h3 id="credits-116">Credits</h3>
+<h3 id="credits-121">Credits</h3>
<ul>
<li>Alex Liotta (finder)</li>
<li>Sreenivasulu Suuda (finder)</li>
@@ -2404,75 +2503,75 @@
<h2 id="CVE-2024-26280">Overly broad default permissions for Viewer/Ops (audit logs)</h2>
<p>CVE-2024-26280 <a href="https://cve.org/CVERecord?id=CVE-2024-26280">[CVE]</a> <a href="./CVE-2024-26280.cve.json">[CVE json]</a> <a href="./CVE-2024-26280.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-03-01T11:05:52.165Z</em></p>
-<h3 id="affected-119">Affected</h3>
+<h3 id="affected-124">Affected</h3>
<ul>
<li>Apache Airflow before 2.8.2</li>
</ul>
-<h3 id="description-119">Description</h3>
+<h3 id="description-124">Description</h3>
<p>Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by default, they need to be explicitly granted permissions to see the logs. Only admin users have audit log permission by default.<br><br>Users of Apache Airflow are recommended to upgrade to version [...]
-<h3 id="references-119">References</h3>
+<h3 id="references-124">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/37501">https://github.com/apache/airflow/pull/37501</a></li>
<li><a href="https://lists.apache.org/thread/knskxxxml95091rsnpxkpo1jjp8rj0fh">https://lists.apache.org/thread/knskxxxml95091rsnpxkpo1jjp8rj0fh</a></li>
</ul>
-<h3 id="credits-117">Credits</h3>
+<h3 id="credits-122">Credits</h3>
<ul>
<li>Yusuf AYDIN (@h1_yusuf) (finder)</li>
</ul>
<h2 id="CVE-2024-25142">Cache Control - Storage of Sensitive Data in Browser Cache </h2>
<p>CVE-2024-25142 <a href="https://cve.org/CVERecord?id=CVE-2024-25142">[CVE]</a> <a href="./CVE-2024-25142.cve.json">[CVE json]</a> <a href="./CVE-2024-25142.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-06-14T08:25:32.229Z</em></p>
-<h3 id="affected-120">Affected</h3>
+<h3 id="affected-125">Affected</h3>
<ul>
<li>Apache Airflow before 2.9.2</li>
</ul>
-<h3 id="description-120">Description</h3>
+<h3 id="description-125">Description</h3>
<p>Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. </p><p>Airflow did not return "Cache-Control" header for dynamic content, which in case of some browsers could result in potentially storing sensitive data in local cache of the browser.</p><p>This issue affects Apache Airflow: before 2.9.2.</p><p>Users are recommended to upgrade to version 2.9.2, which fixes the issue.</p>
-<h3 id="references-120">References</h3>
+<h3 id="references-125">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/39550">https://github.com/apache/airflow/pull/39550</a></li>
<li><a href="https://lists.apache.org/thread/cg1j28lk0fhzthk0of1g7vy7p2n1j7nr">https://lists.apache.org/thread/cg1j28lk0fhzthk0of1g7vy7p2n1j7nr</a></li>
</ul>
-<h3 id="credits-118">Credits</h3>
+<h3 id="credits-123">Credits</h3>
<ul>
<li>Jens Scheffler (reporter)</li>
</ul>
<h2 id="CVE-2024-25141">Certificate validation isn’t respected even if SSL is enabled for apache-airflow-providers-mongo </h2>
<p>CVE-2024-25141 <a href="https://cve.org/CVERecord?id=CVE-2024-25141">[CVE]</a> <a href="./CVE-2024-25141.cve.json">[CVE json]</a> <a href="./CVE-2024-25141.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-02-20T20:30:25.779Z</em></p>
-<h3 id="affected-121">Affected</h3>
+<h3 id="affected-126">Affected</h3>
<ul>
<li>Apache Airflow Mongo Provider from 1.0.0 before 4.0.0</li>
</ul>
-<h3 id="description-121">Description</h3>
+<h3 id="description-126">Description</h3>
<p><span style="background-color: rgb(255, 255, 255);">When </span><code>ssl</code><span style="background-color: rgb(255, 255, 255);"> was enabled for Mongo Hook, default settings included “allow_insecure” which caused that certificates were not validated. This was unexpected and undocumented.</span><br>Users are recommended to upgrade to version 4.0.0, which fixes this issue.</p>
-<h3 id="references-121">References</h3>
+<h3 id="references-126">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/37214">https://github.com/apache/airflow/pull/37214</a></li>
<li><a href="https://lists.apache.org/thread/sqgbfqngjmn45ommmrgj7hvs7fgspsgm">https://lists.apache.org/thread/sqgbfqngjmn45ommmrgj7hvs7fgspsgm</a></li>
</ul>
-<h3 id="credits-119">Credits</h3>
+<h3 id="credits-124">Credits</h3>
<ul>
<li>Noah Stapp (reporter)</li>
</ul>
<h2 id="CVE-2023-51702">Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service</h2>
<p>CVE-2023-51702 <a href="https://cve.org/CVERecord?id=CVE-2023-51702">[CVE]</a> <a href="./CVE-2023-51702.cve.json">[CVE json]</a> <a href="./CVE-2023-51702.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-01-24T12:56:15.440Z</em></p>
-<h3 id="affected-122">Affected</h3>
+<h3 id="affected-127">Affected</h3>
<ul>
<li>Apache Airflow CNCF Kubernetes provider from 5.2.0 before 7.0.0</li>
<li>Apache Airflow from 2.3.0 before 2.6.1</li>
</ul>
-<h3 id="description-122">Description</h3>
+<h3 id="description-127">Description</h3>
<p>Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an Airflow version between 2.3.0 and 2.6.0, the configuration dictionary will be logged as plain text in the triggerer service without masking. This allows anyone with access to the metadata or t [...]
-<h3 id="references-122">References</h3>
+<h3 id="references-127">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29498">https://github.com/apache/airflow/pull/29498</a></li>
<li><a href="https://github.com/apache/airflow/pull/30110">https://github.com/apache/airflow/pull/30110</a></li>
<li><a href="https://github.com/apache/airflow/pull/36492">https://github.com/apache/airflow/pull/36492</a></li>
<li><a href="https://lists.apache.org/thread/89x3q6lz5pykrkr1fkr04k4rfn9pvnv9">https://lists.apache.org/thread/89x3q6lz5pykrkr1fkr04k4rfn9pvnv9</a></li>
</ul>
-<h3 id="credits-120">Credits</h3>
+<h3 id="credits-125">Credits</h3>
<ul>
<li>Hussein Awala (finder)</li>
<li>Hussein Awala (remediation developer)</li>
@@ -2480,36 +2579,36 @@
<h2 id="CVE-2023-50944">Bypass permission verification to read code of other dags</h2>
<p>CVE-2023-50944 <a href="https://cve.org/CVERecord?id=CVE-2023-50944">[CVE]</a> <a href="./CVE-2023-50944.cve.json">[CVE json]</a> <a href="./CVE-2023-50944.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-01-24T12:58:17.032Z</em></p>
-<h3 id="affected-123">Affected</h3>
+<h3 id="affected-128">Affected</h3>
<ul>
<li>Apache Airflow before 2.8.1</li>
</ul>
-<h3 id="description-123">Description</h3>
+<h3 id="description-128">Description</h3>
<p>Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don’t have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue.<br></p>
-<h3 id="references-123">References</h3>
+<h3 id="references-128">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/36257">https://github.com/apache/airflow/pull/36257</a></li>
<li><a href="https://lists.apache.org/thread/92krb5mpcq8qrw4t4j5oooqw7hgd8q7h">https://lists.apache.org/thread/92krb5mpcq8qrw4t4j5oooqw7hgd8q7h</a></li>
</ul>
-<h3 id="credits-121">Credits</h3>
+<h3 id="credits-126">Credits</h3>
<ul>
<li>Timon8 Zhang (finder)</li>
</ul>
<h2 id="CVE-2023-50943">Potential pickle deserialization vulnerability in XComs</h2>
<p>CVE-2023-50943 <a href="https://cve.org/CVERecord?id=CVE-2023-50943">[CVE]</a> <a href="./CVE-2023-50943.cve.json">[CVE json]</a> <a href="./CVE-2023-50943.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-01-24T12:57:05.049Z</em></p>
-<h3 id="affected-124">Affected</h3>
+<h3 id="affected-129">Affected</h3>
<ul>
<li>Apache Airflow before 2.8.1</li>
</ul>
-<h3 id="description-124">Description</h3>
+<h3 id="description-129">Description</h3>
<p>Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of “enable_xcom_pickling=False” configuration setting resulting in poisoned data after XCom deserialization. This vulnerability is considered low since it requires a DAG author to exploit it. Users are recommended to upgrade to version 2.8.1 or later, which fixes this issue.<br></p>
-<h3 id="references-124">References</h3>
+<h3 id="references-129">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/36255">https://github.com/apache/airflow/pull/36255</a></li>
<li><a href="https://lists.apache.org/thread/fx278v0twqzxkcts70tc04cp3f8p56pn">https://lists.apache.org/thread/fx278v0twqzxkcts70tc04cp3f8p56pn</a></li>
</ul>
-<h3 id="credits-122">Credits</h3>
+<h3 id="credits-127">Credits</h3>
<ul>
<li>Peng Zhou (<a href="mailto:zpbrent@gmail.com">zpbrent@gmail.com</a>) (finder)</li>
<li>Hussein Awala (remediation developer)</li>
@@ -2517,18 +2616,18 @@
<h2 id="CVE-2023-50783">Improper access control vulnerability on the “varimport” endpoint</h2>
<p>CVE-2023-50783 <a href="https://cve.org/CVERecord?id=CVE-2023-50783">[CVE]</a> <a href="./CVE-2023-50783.cve.json">[CVE json]</a> <a href="./CVE-2023-50783.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-12-21T09:28:46.089Z</em></p>
-<h3 id="affected-125">Affected</h3>
+<h3 id="affected-130">Affected</h3>
<ul>
<li>Apache Airflow before 2.8.0</li>
</ul>
-<h3 id="description-125">Description</h3>
+<h3 id="description-130">Description</h3>
<p>Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable.<br>This flaw compromises the integrity of variable management, potentially leading to unauthorized data modification.<br>Users are recommended to upgrade to 2.8.0, which fixes this issue</p>
-<h3 id="references-125">References</h3>
+<h3 id="references-130">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33932">https://github.com/apache/airflow/pull/33932</a></li>
<li><a href="https://lists.apache.org/thread/rs7cr3yp726mb89s1m844hy9pq7frgcn">https://lists.apache.org/thread/rs7cr3yp726mb89s1m844hy9pq7frgcn</a></li>
</ul>
-<h3 id="credits-123">Credits</h3>
+<h3 id="credits-128">Credits</h3>
<ul>
<li>balis0ng (finder)</li>
<li>Ephraim Anierobi (remediation developer)</li>
@@ -2536,18 +2635,18 @@
<h2 id="CVE-2023-49920">Missing CSRF protection on DAG/trigger</h2>
<p>CVE-2023-49920 <a href="https://cve.org/CVERecord?id=CVE-2023-49920">[CVE]</a> <a href="./CVE-2023-49920.cve.json">[CVE json]</a> <a href="./CVE-2023-49920.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-12-21T09:27:07.715Z</em></p>
-<h3 id="affected-126">Affected</h3>
+<h3 id="affected-131">Affected</h3>
<ul>
<li>Apache Airflow from 2.7.0 before 2.8.0</li>
</ul>
-<h3 id="description-126">Description</h3>
+<h3 id="description-131">Description</h3>
<p>Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user’s consent.<br>Users are advised to upgrade to version 2.8.0 or later which is not affected</p>
-<h3 id="references-126">References</h3>
+<h3 id="references-131">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/36026">https://github.com/apache/airflow/pull/36026</a></li>
<li><a href="https://lists.apache.org/thread/mnwd2vcfw3gms6ft6kl951vfbqrxsnjq">https://lists.apache.org/thread/mnwd2vcfw3gms6ft6kl951vfbqrxsnjq</a></li>
</ul>
-<h3 id="credits-124">Credits</h3>
+<h3 id="credits-129">Credits</h3>
<ul>
<li>Tareq Ahamed ( 0xt4req) (finder)</li>
<li>Jens Scheffler (remediation developer)</li>
@@ -2555,18 +2654,18 @@
<h2 id="CVE-2023-48291">Improper access control to DAG resources</h2>
<p>CVE-2023-48291 <a href="https://cve.org/CVERecord?id=CVE-2023-48291">[CVE]</a> <a href="./CVE-2023-48291.cve.json">[CVE json]</a> <a href="./CVE-2023-48291.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-12-21T09:30:40.260Z</em></p>
-<h3 id="affected-127">Affected</h3>
+<h3 id="affected-132">Affected</h3>
<ul>
<li>Apache Airflow before 2.8.0</li>
</ul>
-<h3 id="description-127">Description</h3>
+<h3 id="description-132">Description</h3>
<p>Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn’t.<br><br>This is a missing fix for CVE-2023-42792 in Apache Airflow 2.7.2 <br><br>Users of Apache Airflow are strongly advised to upgrade to version 2.8.0 or newe [...]
-<h3 id="references-127">References</h3>
+<h3 id="references-132">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/34366">https://github.com/apache/airflow/pull/34366</a></li>
<li><a href="https://lists.apache.org/thread/3nl0h014274yjlt1hd02z0q78ftyz0z3">https://lists.apache.org/thread/3nl0h014274yjlt1hd02z0q78ftyz0z3</a></li>
</ul>
-<h3 id="credits-125">Credits</h3>
+<h3 id="credits-130">Credits</h3>
<ul>
<li>balis0ng (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -2574,18 +2673,18 @@
<h2 id="CVE-2023-47265">DAG Params alllow to embed unchecked Javascript</h2>
<p>CVE-2023-47265 <a href="https://cve.org/CVERecord?id=CVE-2023-47265">[CVE]</a> <a href="./CVE-2023-47265.cve.json">[CVE json]</a> <a href="./CVE-2023-47265.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-12-21T09:28:05.966Z</em></p>
-<h3 id="affected-128">Affected</h3>
+<h3 id="affected-133">Affected</h3>
<ul>
<li>Apache Airflow from 2.6.0 before 2.8.0</li>
</ul>
-<h3 id="description-128">Description</h3>
+<h3 id="description-133">Description</h3>
<p>Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG. This Javascript can be executed on the client side of any of the user who looks at the tasks in the browser sandbox. While this issue does not allow to exit the browser sandbox or manipulation of the server-side data - more than the DAG author already has, it allows to modify what the user l [...]
-<h3 id="references-128">References</h3>
+<h3 id="references-133">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/35460">https://github.com/apache/airflow/pull/35460</a></li>
<li><a href="https://lists.apache.org/thread/128f3zl375vb1qv93k82zhnwkpl233pr">https://lists.apache.org/thread/128f3zl375vb1qv93k82zhnwkpl233pr</a></li>
</ul>
-<h3 id="credits-126">Credits</h3>
+<h3 id="credits-131">Credits</h3>
<ul>
<li>Jens Scheffler (finder)</li>
<li>Andrey Anshin (finder)</li>
@@ -2594,18 +2693,18 @@
<h2 id="CVE-2023-47037">Apache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access)</h2>
<p>CVE-2023-47037 <a href="https://cve.org/CVERecord?id=CVE-2023-47037">[CVE]</a> <a href="./CVE-2023-47037.cve.json">[CVE json]</a> <a href="./CVE-2023-47037.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-11-12T13:12:20.076Z</em></p>
-<h3 id="affected-129">Affected</h3>
+<h3 id="affected-134">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.3</li>
</ul>
-<h3 id="description-129">Description</h3>
+<h3 id="description-134">Description</h3>
<p><span style="background-color: rgb(255, 255, 255);">We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then. </span></p><p><span style="background-color: rgb(255, 255, 255);">Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, et [...]
-<h3 id="references-129">References</h3>
+<h3 id="references-134">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33413">https://github.com/apache/airflow/pull/33413</a></li>
<li><a href="https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0">https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0</a></li>
</ul>
-<h3 id="credits-127">Credits</h3>
+<h3 id="credits-132">Credits</h3>
<ul>
<li>Tareq Ahamed from Hackerone (reporter)</li>
<li>Augusto Hidalgo (remediation developer)</li>
@@ -2613,18 +2712,18 @@
<h2 id="CVE-2023-46288">Sensitive parameters exposed in API when “non-sensitive-only” configuration is set</h2>
<p>CVE-2023-46288 <a href="https://cve.org/CVERecord?id=CVE-2023-46288">[CVE]</a> <a href="./CVE-2023-46288.cve.json">[CVE json]</a> <a href="./CVE-2023-46288.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-10-23T18:13:01.162Z</em></p>
-<h3 id="affected-130">Affected</h3>
+<h3 id="affected-135">Affected</h3>
<ul>
<li>Apache Airflow from 2.4.0 before 2.7.0</li>
</ul>
-<h3 id="description-130">Description</h3>
+<h3 id="description-135">Description</h3>
<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.<p>This issue affects Apache Airflow from 2.4.0 to 2.7.0.</p><p>Sensitive configuration information has been exposed to authenticated users with the ability to read configuration via Airflow REST API for configuration even when the <code>expose_config</code> option is set to <code>non-sensitive-only</code>. The expose_config option is False by default. It is recommended to upgrade to a version t [...]
-<h3 id="references-130">References</h3>
+<h3 id="references-135">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/32261">https://github.com/apache/airflow/pull/32261</a></li>
<li><a href="https://lists.apache.org/thread/yw4vzm0c5lqkwm0bxv6qy03yfd1od4nw">https://lists.apache.org/thread/yw4vzm0c5lqkwm0bxv6qy03yfd1od4nw</a></li>
</ul>
-<h3 id="credits-128">Credits</h3>
+<h3 id="credits-133">Credits</h3>
<ul>
<li>id_No2015429 of 3H Secruity Team (finder)</li>
<li>Lee, Wei (finder)</li>
@@ -2633,37 +2732,37 @@
<h2 id="CVE-2023-46215">Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend</h2>
<p>CVE-2023-46215 <a href="https://cve.org/CVERecord?id=CVE-2023-46215">[CVE]</a> <a href="./CVE-2023-46215.cve.json">[CVE json]</a> <a href="./CVE-2023-46215.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-10-28T07:10:54.392Z</em></p>
-<h3 id="affected-131">Affected</h3>
+<h3 id="affected-136">Affected</h3>
<ul>
<li>Apache Airflow Celery provider from 3.3.0 through 3.4.0</li>
<li>Apache Airflow from 1.10.0 before 2.7.0</li>
</ul>
-<h3 id="description-131">Description</h3>
+<h3 id="description-136">Description</h3>
<p>Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow.<br><br><p>Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend<br>Note: the vulnerability is about the information exposed in the logs not about accessing the logs.</p><p>This issue affects Apache Airflow Celery provider: from 3.3.0 through 3.4.0; Apache Airflow: from 1.10.0 through 2.6.3.</p><p>Users are recommended [...]
-<h3 id="references-131">References</h3>
+<h3 id="references-136">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/34954">https://github.com/apache/airflow/pull/34954</a></li>
<li><a href="https://lists.apache.org/thread/wm1jfmks7r6m7bj0mq4lmw3998svn46n">https://lists.apache.org/thread/wm1jfmks7r6m7bj0mq4lmw3998svn46n</a></li>
</ul>
-<h3 id="credits-129">Credits</h3>
+<h3 id="credits-134">Credits</h3>
<ul>
<li>husseinawala (finder)</li>
</ul>
<h2 id="CVE-2023-45348">Configuration information leakage vulnerability</h2>
<p>CVE-2023-45348 <a href="https://cve.org/CVERecord?id=CVE-2023-45348">[CVE]</a> <a href="./CVE-2023-45348.cve.json">[CVE json]</a> <a href="./CVE-2023-45348.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-10-14T09:46:37.359Z</em></p>
-<h3 id="affected-132">Affected</h3>
+<h3 id="affected-137">Affected</h3>
<ul>
<li>Apache Airflow from 2.7.0 before 2.7.2</li>
</ul>
-<h3 id="description-132">Description</h3>
+<h3 id="description-137">Description</h3>
<p>Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when the “expose_config” option is set to “non-sensitive-only”. The <code>expose_config</code> option is False by default.<br>It is recommended to upgrade to a version that is not affected.</p>
-<h3 id="references-132">References</h3>
+<h3 id="references-137">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/34712">https://github.com/apache/airflow/pull/34712</a></li>
<li><a href="https://lists.apache.org/thread/sy4l5d6tn58hr8r61r2fkt1f0qock9z9">https://lists.apache.org/thread/sy4l5d6tn58hr8r61r2fkt1f0qock9z9</a></li>
</ul>
-<h3 id="credits-130">Credits</h3>
+<h3 id="credits-135">Credits</h3>
<ul>
<li>L3yx of Syclover Security Team (finder)</li>
<li>Hussein Awala (remediation developer)</li>
@@ -2671,18 +2770,18 @@
<h2 id="CVE-2023-42792">Improper access control to DAG resources</h2>
<p>CVE-2023-42792 <a href="https://cve.org/CVERecord?id=CVE-2023-42792">[CVE]</a> <a href="./CVE-2023-42792.cve.json">[CVE json]</a> <a href="./CVE-2023-42792.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-10-14T09:47:04.851Z</em></p>
-<h3 id="affected-133">Affected</h3>
+<h3 id="affected-138">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.2</li>
</ul>
-<h3 id="description-133">Description</h3>
+<h3 id="description-138">Description</h3>
<p>Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn’t.<br><br>Users of Apache Airflow are strongly advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.<br></p>
-<h3 id="references-133">References</h3>
+<h3 id="references-138">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/34366">https://github.com/apache/airflow/pull/34366</a></li>
<li><a href="https://lists.apache.org/thread/1spbo9nkn49fc2hnxqm9tf6mgqwp9tjq">https://lists.apache.org/thread/1spbo9nkn49fc2hnxqm9tf6mgqwp9tjq</a></li>
</ul>
-<h3 id="credits-131">Credits</h3>
+<h3 id="credits-136">Credits</h3>
<ul>
<li>balis0ng (finder)</li>
<li>Jarek Potiuk (remediation developer)</li>
@@ -2690,18 +2789,18 @@
<h2 id="CVE-2023-42781">Permission verification bypass allows viewing dagruns of other dags</h2>
<p>CVE-2023-42781 <a href="https://cve.org/CVERecord?id=CVE-2023-42781">[CVE]</a> <a href="./CVE-2023-42781.cve.json">[CVE json]</a> <a href="./CVE-2023-42781.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-11-12T13:14:05.928Z</em></p>
-<h3 id="affected-134">Affected</h3>
+<h3 id="affected-139">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.3</li>
</ul>
-<h3 id="description-134">Description</h3>
+<h3 id="description-139">Description</h3>
<p>Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. This is a different issue than CVE-2023-42663 but leading to similar outcome.<br>Users of Apache Airflow are advised to upgrade to version 2.7.3 or newer to mitigate the risk associated with this vulnerability.</p>
-<h3 id="references-134">References</h3>
+<h3 id="references-139">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/34939">https://github.com/apache/airflow/pull/34939</a></li>
<li><a href="https://lists.apache.org/thread/7dnl8nszdxqyns57f3dw0sloy5dfl9o1">https://lists.apache.org/thread/7dnl8nszdxqyns57f3dw0sloy5dfl9o1</a></li>
</ul>
-<h3 id="credits-132">Credits</h3>
+<h3 id="credits-137">Credits</h3>
<ul>
<li>balis0ng (finder)</li>
<li>Hussein Awala (remediation developer)</li>
@@ -2709,18 +2808,18 @@
<h2 id="CVE-2023-42780">Improper access control vulnerability in the “List dag warnings” feature</h2>
<p>CVE-2023-42780 <a href="https://cve.org/CVERecord?id=CVE-2023-42780">[CVE]</a> <a href="./CVE-2023-42780.cve.json">[CVE json]</a> <a href="./CVE-2023-42780.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-10-14T09:46:05.032Z</em></p>
-<h3 id="affected-135">Affected</h3>
+<h3 id="affected-140">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.2</li>
</ul>
-<h3 id="description-135">Description</h3>
+<h3 id="description-140">Description</h3>
<p>Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAGs. It would reveal the dag_ids and the stack-traces of import errors for those DAGs with import errors.<br>Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.<br><br></p>
-<h3 id="references-135">References</h3>
+<h3 id="references-140">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/34355">https://github.com/apache/airflow/pull/34355</a></li>
<li><a href="https://lists.apache.org/thread/h5tvsvov8j55wojt5sojdprs05oby34d">https://lists.apache.org/thread/h5tvsvov8j55wojt5sojdprs05oby34d</a></li>
</ul>
-<h3 id="credits-133">Credits</h3>
+<h3 id="credits-138">Credits</h3>
<ul>
<li>balis0ng (finder)</li>
<li>Hussein Awala (remediation developer)</li>
@@ -2728,18 +2827,18 @@
<h2 id="CVE-2023-42663">Bypass permission verification to view task instances of other dags</h2>
<p>CVE-2023-42663 <a href="https://cve.org/CVERecord?id=CVE-2023-42663">[CVE]</a> <a href="./CVE-2023-42663.cve.json">[CVE json]</a> <a href="./CVE-2023-42663.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-10-14T09:47:24.055Z</em></p>
-<h3 id="affected-136">Affected</h3>
+<h3 id="affected-141">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.2</li>
</ul>
-<h3 id="description-136">Description</h3>
+<h3 id="description-141">Description</h3>
<p>Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs.<br>Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.<br></p>
-<h3 id="references-136">References</h3>
+<h3 id="references-141">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/34315">https://github.com/apache/airflow/pull/34315</a></li>
<li><a href="https://lists.apache.org/thread/xj86cvfkxgd0cyqfmz6mh1bsfc61c6o9">https://lists.apache.org/thread/xj86cvfkxgd0cyqfmz6mh1bsfc61c6o9</a></li>
</ul>
-<h3 id="credits-134">Credits</h3>
+<h3 id="credits-139">Credits</h3>
<ul>
<li>balis0ng (finder)</li>
<li>Ephraim Anierobi (remediation developer)</li>
@@ -2747,74 +2846,74 @@
<h2 id="CVE-2023-41267">Apache HDFS Provider error message suggested installation of incorrect pip package</h2>
<p>CVE-2023-41267 <a href="https://cve.org/CVERecord?id=CVE-2023-41267">[CVE]</a> <a href="./CVE-2023-41267.cve.json">[CVE json]</a> <a href="./CVE-2023-41267.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-09-14T07:46:36.891Z</em></p>
-<h3 id="affected-137">Affected</h3>
+<h3 id="affected-142">Affected</h3>
<ul>
<li>Apache Airflow HDFS Provider before 4.1.1</li>
</ul>
-<h3 id="description-137">Description</h3>
+<h3 id="description-142">Description</h3>
<p><span style="background-color: rgb(255, 255, 255);">In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The Airflow team has since taken ownership of the package (neutralizing the risk), and fixed the doc strings in version 4.1.1</span><br></p>
-<h3 id="references-137">References</h3>
+<h3 id="references-142">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33813">https://github.com/apache/airflow/pull/33813</a></li>
<li><a href="https://lists.apache.org/thread/ggthr5pn42bn6wcr25hxnykjzh4ntw7z">https://lists.apache.org/thread/ggthr5pn42bn6wcr25hxnykjzh4ntw7z</a></li>
</ul>
-<h3 id="credits-135">Credits</h3>
+<h3 id="credits-140">Credits</h3>
<ul>
<li>AnupamAs01 (finder)</li>
</ul>
<h2 id="CVE-2023-40712">Secrets can be unmasked in the “Rendered Template” </h2>
<p>CVE-2023-40712 <a href="https://cve.org/CVERecord?id=CVE-2023-40712">[CVE]</a> <a href="./CVE-2023-40712.cve.json">[CVE json]</a> <a href="./CVE-2023-40712.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-09-12T11:05:46.999Z</em></p>
-<h3 id="affected-138">Affected</h3>
+<h3 id="affected-143">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.1</li>
</ul>
-<h3 id="description-138">Description</h3>
+<h3 id="description-143">Description</h3>
<p>Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI.<br><br>Users are strongly advised to upgrade to version 2.7.1 or later which has removed the vulnerability.</p>
-<h3 id="references-138">References</h3>
+<h3 id="references-143">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33512">https://github.com/apache/airflow/pull/33512</a></li>
<li><a href="https://github.com/apache/airflow/pull/33516">https://github.com/apache/airflow/pull/33516</a></li>
<li><a href="https://lists.apache.org/thread/jw1yv4lt6hpowqbb0x4o3tdp0jhx2bts">https://lists.apache.org/thread/jw1yv4lt6hpowqbb0x4o3tdp0jhx2bts</a></li>
</ul>
-<h3 id="credits-136">Credits</h3>
+<h3 id="credits-141">Credits</h3>
<ul>
<li>klexadoc (finder)</li>
</ul>
<h2 id="CVE-2023-40611">Apache Airflow Dag Runs Broken Access Control Vulnerability</h2>
<p>CVE-2023-40611 <a href="https://cve.org/CVERecord?id=CVE-2023-40611">[CVE]</a> <a href="./CVE-2023-40611.cve.json">[CVE json]</a> <a href="./CVE-2023-40611.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-09-12T11:05:20.884Z</em></p>
-<h3 id="affected-139">Affected</h3>
+<h3 id="affected-144">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.1</li>
</ul>
-<h3 id="description-139">Description</h3>
+<h3 id="description-144">Description</h3>
<p>Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.<br><br>Users should upgrade to version 2.7.1 or later which has removed the vulnerability.<br></p>
-<h3 id="references-139">References</h3>
+<h3 id="references-144">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33413">https://github.com/apache/airflow/pull/33413</a></li>
<li><a href="https://lists.apache.org/thread/8y9xk1s3j4qr36yzqn8ogbn9fl7pxrn0">https://lists.apache.org/thread/8y9xk1s3j4qr36yzqn8ogbn9fl7pxrn0</a></li>
</ul>
-<h3 id="credits-137">Credits</h3>
+<h3 id="credits-142">Credits</h3>
<ul>
<li>happyhacking (finder)</li>
</ul>
<h2 id="CVE-2023-40273">Session fixation in Apache Airflow web interface</h2>
<p>CVE-2023-40273 <a href="https://cve.org/CVERecord?id=CVE-2023-40273">[CVE]</a> <a href="./CVE-2023-40273.cve.json">[CVE json]</a> <a href="./CVE-2023-40273.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-09-12T06:41:25.454Z</em></p>
-<h3 id="affected-140">Affected</h3>
+<h3 id="affected-145">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.0</li>
</ul>
-<h3 id="description-140">Description</h3>
+<h3 id="description-145">Description</h3>
<p>The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database (for <code>database</code> session backend), or changing the secure_key and restarting the webserver, there were no mechanisms to force-logout the user (and all other users with that).</p><p>With this fix implement [...]
-<h3 id="references-140">References</h3>
+<h3 id="references-145">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33347">https://github.com/apache/airflow/pull/33347</a></li>
<li><a href="https://lists.apache.org/thread/9rdmv8ln4y4ncbyrlmjrsj903x4l80nj">https://lists.apache.org/thread/9rdmv8ln4y4ncbyrlmjrsj903x4l80nj</a></li>
<li><a href="https://www.openwall.com/lists/oss-security/2023/08/23/1">https://www.openwall.com/lists/oss-security/2023/08/23/1</a></li>
</ul>
-<h3 id="credits-138">Credits</h3>
+<h3 id="credits-143">Credits</h3>
<ul>
<li>Yusuf AYDIN (@h1_yusuf) (finder)</li>
<li>L3yx of Syclover Security Team. (finder)</li>
@@ -2824,53 +2923,53 @@
<h2 id="CVE-2023-40272">Apache Airflow Spark Provider Arbitrary File Read via JDBC</h2>
<p>CVE-2023-40272 <a href="https://cve.org/CVERecord?id=CVE-2023-40272">[CVE]</a> <a href="./CVE-2023-40272.cve.json">[CVE json]</a> <a href="./CVE-2023-40272.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-08-17T13:52:26.145Z</em></p>
-<h3 id="affected-141">Affected</h3>
+<h3 id="affected-146">Affected</h3>
<ul>
<li>Apache Airflow Spark Provider before 4.1.3</li>
</ul>
-<h3 id="description-141">Description</h3>
+<h3 id="description-146">Description</h3>
<p>Apache Airflow Spark Provider, versions before 4.1.3, is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection giving an opportunity to read files on the Airflow server.<br>It is recommended to upgrade to a version that is not affected.</p><p></p>
-<h3 id="references-141">References</h3>
+<h3 id="references-146">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/t03gktyzyor20rh06okd91jtqmw6k1l7">https://lists.apache.org/thread/t03gktyzyor20rh06okd91jtqmw6k1l7</a></li>
</ul>
-<h3 id="credits-139">Credits</h3>
+<h3 id="credits-144">Credits</h3>
<ul>
<li>sw0rd1ight (finder)</li>
</ul>
<h2 id="CVE-2023-40195">Apache Airflow Spark Provider Deserialization Vulnerability RCE</h2>
<p>CVE-2023-40195 <a href="https://cve.org/CVERecord?id=CVE-2023-40195">[CVE]</a> <a href="./CVE-2023-40195.cve.json">[CVE json]</a> <a href="./CVE-2023-40195.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-08-28T07:49:59.173Z</em></p>
-<h3 id="affected-142">Affected</h3>
+<h3 id="affected-147">Affected</h3>
<ul>
<li>Apache Airflow Spark Provider before 4.1.3</li>
</ul>
-<h3 id="description-142">Description</h3>
+<h3 id="description-147">Description</h3>
<p>Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Software Foundation Apache Airflow Spark Provider.<br><br><br><span style="background-color: rgb(255, 255, 255);">When the Apache Spark provider is installed on an Airflow deployment, an Airflow user that is authorized to configure Spark hooks can effectively run arbitrary code on the Airflow node by pointing it at a malicious Spark server. Prior to version 4.1.3, this w [...]
-<h3 id="references-142">References</h3>
+<h3 id="references-147">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33233">https://github.com/apache/airflow/pull/33233</a></li>
<li><a href="https://lists.apache.org/thread/fzy95b1d6zv31j5wrx3znhzcscck2o24">https://lists.apache.org/thread/fzy95b1d6zv31j5wrx3znhzcscck2o24</a></li>
</ul>
-<h3 id="credits-140">Credits</h3>
+<h3 id="credits-145">Credits</h3>
<ul>
<li>happyhacking-k (finder)</li>
</ul>
<h2 id="CVE-2023-39553">Apache Airflow Drill Provider Arbitrary File Read Vulnerability</h2>
<p>CVE-2023-39553 <a href="https://cve.org/CVERecord?id=CVE-2023-39553">[CVE]</a> <a href="./CVE-2023-39553.cve.json">[CVE json]</a> <a href="./CVE-2023-39553.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-08-11T18:42:20.040Z</em></p>
-<h3 id="affected-143">Affected</h3>
+<h3 id="affected-148">Affected</h3>
<ul>
<li>Apache Airflow Drill Provider before 2.4.3</li>
</ul>
-<h3 id="description-143">Description</h3>
+<h3 id="description-148">Description</h3>
<p>Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.<br><br><span style="background-color: rgb(255, 255, 255);">Apache Airflow Drill Provider is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection with DrillHook giving an opportunity to read files on the Airflow server.</span><br><p>This issue affects Apache Airflow Drill Provider: before 2.4.3.<br><span style="background-col [...]
-<h3 id="references-143">References</h3>
+<h3 id="references-148">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33074">https://github.com/apache/airflow/pull/33074</a></li>
<li><a href="https://lists.apache.org/thread/ozpl0opmob49rkcz8svo8wkxyw1395sf">https://lists.apache.org/thread/ozpl0opmob49rkcz8svo8wkxyw1395sf</a></li>
</ul>
-<h3 id="credits-141">Credits</h3>
+<h3 id="credits-146">Credits</h3>
<ul>
<li>sw0rd1ight of Caiji Sec Team and 4ra1n of Chaitin Tech (finder)</li>
<li>happyhacking (finder)</li>
@@ -2878,75 +2977,75 @@
<h2 id="CVE-2023-39508">Airflow “Run task” feature allows execution with unnecessary priviledges</h2>
<p>CVE-2023-39508 <a href="https://cve.org/CVERecord?id=CVE-2023-39508">[CVE]</a> <a href="./CVE-2023-39508.cve.json">[CVE json]</a> <a href="./CVE-2023-39508.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-08-05T06:47:11.955Z</em></p>
-<h3 id="affected-144">Affected</h3>
+<h3 id="affected-149">Affected</h3>
<ul>
<li>Apache Airflow before 2.6.0</li>
</ul>
-<h3 id="description-144">Description</h3>
+<h3 id="description-149">Description</h3>
<p>Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.<p>The “Run Task” feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the webserver context as well as allows to bypas limitation of access the user has to certain DAGs. The “Run Task” feature is considered dangerous and it has been removed enti [...]
-<h3 id="references-144">References</h3>
+<h3 id="references-149">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29706">https://github.com/apache/airflow/pull/29706</a></li>
<li><a href="https://lists.apache.org/thread/j2nkjd0zqvtqk85s6ywpx3c35pvzyx15">https://lists.apache.org/thread/j2nkjd0zqvtqk85s6ywpx3c35pvzyx15</a></li>
</ul>
-<h3 id="credits-142">Credits</h3>
+<h3 id="credits-147">Credits</h3>
<ul>
<li>balis0ng (finder)</li>
</ul>
<h2 id="CVE-2023-39441">SMTP/IMAP client components allowed MITM due to missing Certificate Validation</h2>
<p>CVE-2023-39441 <a href="https://cve.org/CVERecord?id=CVE-2023-39441">[CVE]</a> <a href="./CVE-2023-39441.cve.json">[CVE json]</a> <a href="./CVE-2023-39441.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-08-23T15:39:49.970Z</em></p>
-<h3 id="affected-145">Affected</h3>
+<h3 id="affected-150">Affected</h3>
<ul>
<li>Apache Airflow SMTP Provider before 1.30</li>
<li>Apache Airflow IMAP Provider before 3.3.0</li>
<li>Apache Airflow before 2.7.0</li>
</ul>
-<h3 id="description-145">Description</h3>
+<h3 id="description-150">Description</h3>
<p><span style="background-color: rgb(255, 255, 255);">Apache Airflow SMTP Provider </span><span style="background-color: rgb(255, 255, 255);">before 1.3.0</span><span style="background-color: rgb(255, 255, 255);">, Apache Airflow IMAP Provider </span><span style="background-color: rgb(255, 255, 255);">before 3.3.0, and</span><span style="background-color: rgb(255, 255, 255);"> Apache Airflow </span><span style="background-color: rgb(255, 255, 255);">before 2.7.0 are affected by the </sp [...]
-<h3 id="references-145">References</h3>
+<h3 id="references-150">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33075">https://github.com/apache/airflow/pull/33075</a></li>
<li><a href="https://github.com/apache/airflow/pull/33108">https://github.com/apache/airflow/pull/33108</a></li>
<li><a href="https://github.com/apache/airflow/pull/33070">https://github.com/apache/airflow/pull/33070</a></li>
<li><a href="https://lists.apache.org/thread/xzp4wgjg2b1o6ylk2595df8bstlbo1lb">https://lists.apache.org/thread/xzp4wgjg2b1o6ylk2595df8bstlbo1lb</a></li>
</ul>
-<h3 id="credits-143">Credits</h3>
+<h3 id="credits-148">Credits</h3>
<ul>
<li>Martin Schobert, Pentagrid AG (finder)</li>
</ul>
<h2 id="CVE-2023-37415">Improper Input Validation in Hive Provider with proxy_user</h2>
<p>CVE-2023-37415 <a href="https://cve.org/CVERecord?id=CVE-2023-37415">[CVE]</a> <a href="./CVE-2023-37415.cve.json">[CVE json]</a> <a href="./CVE-2023-37415.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-07-13T07:35:30.726Z</em></p>
-<h3 id="affected-146">Affected</h3>
+<h3 id="affected-151">Affected</h3>
<ul>
<li>Apache Airflow Apache Hive Provider before 6.1.2</li>
</ul>
-<h3 id="description-146">Description</h3>
+<h3 id="description-151">Description</h3>
<p>Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider.<br><br>Patching on top of CVE-2023-35797<br><p>Before 6.1.2<span style="background-color: rgb(255, 255, 255);"> the proxy_user option can also inject semicolon.<br></span><br>This issue affects Apache Airflow Apache Hive Provider: before 6.1.2.<br><br></p><p>It is recommended updating provider version to 6.1.2 in order to avoid this vulnerability.</p><p></p></p>
-<h3 id="references-146">References</h3>
+<h3 id="references-151">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/9wx0jlckbnycjh8nj5qfwxo423zvm41k">https://lists.apache.org/thread/9wx0jlckbnycjh8nj5qfwxo423zvm41k</a></li>
</ul>
-<h3 id="credits-144">Credits</h3>
+<h3 id="credits-149">Credits</h3>
<ul>
<li>Son Tran from VNPT - VCI (reporter)</li>
</ul>
<h2 id="CVE-2023-37379">Exposure of sensitive connection information, DOS and SSRF on “test connection” feature</h2>
<p>CVE-2023-37379 <a href="https://cve.org/CVERecord?id=CVE-2023-37379">[CVE]</a> <a href="./CVE-2023-37379.cve.json">[CVE json]</a> <a href="./CVE-2023-37379.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-08-23T15:38:53.691Z</em></p>
-<h3 id="affected-147">Affected</h3>
+<h3 id="affected-152">Affected</h3>
<ul>
<li>Apache Airflow before 2.7.0</li>
</ul>
-<h3 id="description-147">Description</h3>
+<h3 id="description-152">Description</h3>
<p>Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connection feature by sending many requests, leading to a denial of service (DoS) condition on the server. Furthermore, malicious actors can leverage this vulnerability to establish harmful connections with the server.</p><p>Users of Ap [...]
-<h3 id="references-147">References</h3>
+<h3 id="references-152">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/32052">https://github.com/apache/airflow/pull/32052</a></li>
<li><a href="https://lists.apache.org/thread/g5c9vcn27lr14go48thrjpo6f4vw571r">https://lists.apache.org/thread/g5c9vcn27lr14go48thrjpo6f4vw571r</a></li>
</ul>
-<h3 id="credits-145">Credits</h3>
+<h3 id="credits-150">Credits</h3>
<ul>
<li>kuteminh11 (finder)</li>
<li>khoabda of Zalo Security Team (finder)</li>
@@ -2957,18 +3056,18 @@
<h2 id="CVE-2023-36543">ReDoS via dags function</h2>
<p>CVE-2023-36543 <a href="https://cve.org/CVERecord?id=CVE-2023-36543">[CVE]</a> <a href="./CVE-2023-36543.cve.json">[CVE json]</a> <a href="./CVE-2023-36543.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-07-21T10:49:41.270Z</em></p>
-<h3 id="affected-148">Affected</h3>
+<h3 id="affected-153">Affected</h3>
<ul>
<li>Apache Airflow before 2.6.3</li>
</ul>
-<h3 id="description-148">Description</h3>
+<h3 id="description-153">Description</h3>
<p>Apache Airflow, versions before 2.6.3, has a vulnerability where an authenticated user can use crafted input to make the current request hang. It is recommended to upgrade to a version that is not affected</p>
-<h3 id="references-148">References</h3>
+<h3 id="references-153">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/32060">https://github.com/apache/airflow/pull/32060</a></li>
<li><a href="https://lists.apache.org/thread/tokfs980504ylgk3cv3hjlnrtbv4tng4">https://lists.apache.org/thread/tokfs980504ylgk3cv3hjlnrtbv4tng4</a></li>
</ul>
-<h3 id="credits-146">Credits</h3>
+<h3 id="credits-151">Credits</h3>
<ul>
<li>National Cyber Security VietNam (NCS VietNam) (finder)</li>
<li>hungtd (finder)</li>
@@ -2976,124 +3075,124 @@
<h2 id="CVE-2023-35908">Access to DAGs without relevant permission</h2>
<p>CVE-2023-35908 <a href="https://cve.org/CVERecord?id=CVE-2023-35908">[CVE]</a> <a href="./CVE-2023-35908.cve.json">[CVE json]</a> <a href="./CVE-2023-35908.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-07-12T09:14:08.022Z</em></p>
-<h3 id="affected-149">Affected</h3>
+<h3 id="affected-154">Affected</h3>
<ul>
<li>Apache Airflow before 2.6.3</li>
</ul>
-<h3 id="description-149">Description</h3>
+<h3 id="description-154">Description</h3>
<p>Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL. It is recommended to upgrade to a version that is not affected</p>
-<h3 id="references-149">References</h3>
+<h3 id="references-154">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/32014">https://github.com/apache/airflow/pull/32014</a></li>
<li><a href="https://lists.apache.org/thread/vsflptk5dt30vrfggn96nx87d7zr6yvw">https://lists.apache.org/thread/vsflptk5dt30vrfggn96nx87d7zr6yvw</a></li>
</ul>
-<h3 id="credits-147">Credits</h3>
+<h3 id="credits-152">Credits</h3>
<ul>
<li>Name : Karthikeyan Singaravelan Employer : Visa (finder)</li>
</ul>
<h2 id="CVE-2023-35798">Airflow Apache ODBC and MSSQL Providers Arbitrary File Read Vulnerability</h2>
<p>CVE-2023-35798 <a href="https://cve.org/CVERecord?id=CVE-2023-35798">[CVE]</a> <a href="./CVE-2023-35798.cve.json">[CVE json]</a> <a href="./CVE-2023-35798.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-06-27T11:39:49.794Z</em></p>
-<h3 id="affected-150">Affected</h3>
+<h3 id="affected-155">Affected</h3>
<ul>
<li>Apache Airflow ODBC Provider before 4.0.0</li>
<li>Apache Airflow MSSQL Provider before 3.4.1</li>
</ul>
-<h3 id="description-150">Description</h3>
+<h3 id="description-155">Description</h3>
<p>Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.<p>This vulnerability is considered low since it requires DAG code to use <code><span style="background-color: rgb(255, 255, 255);">get_sqlalchemy_connection</code> and someone with access to connection resources specifically updating the connection to <span style="background-color: rgb(255, 255, 255);">exploit it.</span><b [...]
-<h3 id="references-150">References</h3>
+<h3 id="references-155">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/31984">https://github.com/apache/airflow/pull/31984</a></li>
<li><a href="https://lists.apache.org/thread/951rb9m7wwox5p30tdvcfjxq8j1mp4pj">https://lists.apache.org/thread/951rb9m7wwox5p30tdvcfjxq8j1mp4pj</a></li>
</ul>
-<h3 id="credits-148">Credits</h3>
+<h3 id="credits-153">Credits</h3>
<ul>
<li>id_No2015429 of 3H Secruity Team (finder)</li>
</ul>
<h2 id="CVE-2023-35797">Apache Airflow Hive Provider Beeline RCE with Principal</h2>
<p>CVE-2023-35797 <a href="https://cve.org/CVERecord?id=CVE-2023-35797">[CVE]</a> <a href="./CVE-2023-35797.cve.json">[CVE json]</a> <a href="./CVE-2023-35797.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-07-03T09:08:49.038Z</em></p>
-<h3 id="affected-151">Affected</h3>
+<h3 id="affected-156">Affected</h3>
<ul>
<li>Apache Airflow Apache Hive Provider before 6.1.1</li>
</ul>
-<h3 id="description-151">Description</h3>
+<h3 id="description-156">Description</h3>
<p>Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider.<br><p>This issue affects Apache Airflow Apache Hive Provider: before 6.1.1.<br><br><span style="background-color: rgb(255, 255, 255);">Before version 6.1.1 it was </span><span style="background-color: rgb(255, 255, 255);">possible to bypass the security check to RCE via</span><br><span style="background-color: rgb(255, 255, 255);">principal parameter. For this to be <span style="backgro [...]
-<h3 id="references-151">References</h3>
+<h3 id="references-156">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/31983">https://github.com/apache/airflow/pull/31983</a></li>
<li><a href="https://lists.apache.org/thread/30y19ok07fw52x5hnkbhwqo3ho0wwc1y">https://lists.apache.org/thread/30y19ok07fw52x5hnkbhwqo3ho0wwc1y</a></li>
</ul>
-<h3 id="credits-149">Credits</h3>
+<h3 id="credits-154">Credits</h3>
<ul>
<li>id_No2015429 of 3H Secruity Team (reporter)</li>
</ul>
<h2 id="CVE-2023-35005">Information disclosure on configuration view</h2>
<p>CVE-2023-35005 <a href="https://cve.org/CVERecord?id=CVE-2023-35005">[CVE]</a> <a href="./CVE-2023-35005.cve.json">[CVE json]</a> <a href="./CVE-2023-35005.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-06-19T08:15:11.464Z</em></p>
-<h3 id="affected-152">Affected</h3>
+<h3 id="affected-157">Affected</h3>
<ul>
<li>Apache Airflow from 2.5.0 before 2.6.2</li>
</ul>
-<h3 id="description-152">Description</h3>
+<h3 id="description-157">Description</h3>
<div>In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations.</div><div>This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all uncensored values are actually sentitive.</div><br><div>This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are recommended to update to version 2.6.2 or later.<br></div>
-<h3 id="references-152">References</h3>
+<h3 id="references-157">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/31788">https://github.com/apache/airflow/pull/31788</a></li>
<li><a href="https://github.com/apache/airflow/pull/31820">https://github.com/apache/airflow/pull/31820</a></li>
<li><a href="https://lists.apache.org/thread/o4f2cxh0054m9tlxpb81c1yhylor5gjd">https://lists.apache.org/thread/o4f2cxh0054m9tlxpb81c1yhylor5gjd</a></li>
</ul>
-<h3 id="credits-150">Credits</h3>
+<h3 id="credits-155">Credits</h3>
<ul>
<li>Piotr Chomiak from Astro product security team (finder)</li>
</ul>
<h2 id="CVE-2023-34395">Remote code execution vulnerability</h2>
<p>CVE-2023-34395 <a href="https://cve.org/CVERecord?id=CVE-2023-34395">[CVE]</a> <a href="./CVE-2023-34395.cve.json">[CVE json]</a> <a href="./CVE-2023-34395.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-06-27T11:36:51.331Z</em></p>
-<h3 id="affected-153">Affected</h3>
+<h3 id="affected-158">Affected</h3>
<ul>
<li>Apache Airflow ODBC Provider before 4.0.0</li>
</ul>
-<h3 id="description-153">Description</h3>
+<h3 id="description-158">Description</h3>
<p>Improper Neutralization of Argument Delimiters in a Command (‘Argument Injection’) vulnerability in Apache Software Foundation Apache Airflow ODBC Provider.<br><span style="background-color: rgb(255, 255, 255);">In OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution.<br></span>Starting version 4.0.0 driver can be set only from [...]
-<h3 id="references-153">References</h3>
+<h3 id="references-158">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/31713">https://github.com/apache/airflow/pull/31713</a></li>
<li><a href="https://lists.apache.org/thread/l26yykftzbhc9tgcph8cso88bc2lqwwd">https://lists.apache.org/thread/l26yykftzbhc9tgcph8cso88bc2lqwwd</a></li>
</ul>
-<h3 id="credits-151">Credits</h3>
+<h3 id="credits-156">Credits</h3>
<ul>
<li>KmhlYXJ0 (finder)</li>
</ul>
<h2 id="CVE-2023-33234">KubernetesPodOperator RCE via connection configuration</h2>
<p>CVE-2023-33234 <a href="https://cve.org/CVERecord?id=CVE-2023-33234">[CVE]</a> <a href="./CVE-2023-33234.cve.json">[CVE json]</a> <a href="./CVE-2023-33234.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-05-30T10:56:52.167Z</em></p>
-<h3 id="affected-154">Affected</h3>
+<h3 id="affected-159">Affected</h3>
<ul>
<li>Apache Airflow CNCF Kubernetes Provider from 5.0.0 through 6.1.0</li>
</ul>
-<h3 id="description-154">Description</h3>
+<h3 id="description-159">Description</h3>
<p>Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection.<br><br>In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner. Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.<br><br></p>
-<h3 id="references-154">References</h3>
+<h3 id="references-159">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/n1vpgl6h2qsdm52o9m2tx1oo86tl4gnq">https://lists.apache.org/thread/n1vpgl6h2qsdm52o9m2tx1oo86tl4gnq</a></li>
</ul>
<h2 id="CVE-2023-29247">Stored XSS on Apache Airflow</h2>
<p>CVE-2023-29247 <a href="https://cve.org/CVERecord?id=CVE-2023-29247">[CVE]</a> <a href="./CVE-2023-29247.cve.json">[CVE json]</a> <a href="./CVE-2023-29247.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-05-08T09:01:33.604Z</em></p>
-<h3 id="affected-155">Affected</h3>
+<h3 id="affected-160">Affected</h3>
<ul>
<li>Apache Airflow before 2.6.0</li>
</ul>
-<h3 id="description-155">Description</h3>
+<h3 id="description-160">Description</h3>
<p>Task instance details page in the UI is vulnerable to a stored XSS.<p>This issue affects Apache Airflow: before 2.6.0.</p><br></p>
-<h3 id="references-155">References</h3>
+<h3 id="references-160">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/30447">https://github.com/apache/airflow/pull/30447</a></li>
<li><a href="https://github.com/apache/airflow/pull/30779">https://github.com/apache/airflow/pull/30779</a></li>
<li><a href="https://lists.apache.org/thread/kqf5lxmko133780clsp827xfsh4xd3fl">https://lists.apache.org/thread/kqf5lxmko133780clsp827xfsh4xd3fl</a></li>
</ul>
-<h3 id="credits-152">Credits</h3>
+<h3 id="credits-157">Credits</h3>
<ul>
<li>taidh from VNPT - VCI (finder)</li>
<li>kuteminh11 (finder)</li>
@@ -3101,72 +3200,72 @@
<h2 id="CVE-2023-28710">Apache Airflow Spark Provider Arbitrary File Read via JDBC</h2>
<p>CVE-2023-28710 <a href="https://cve.org/CVERecord?id=CVE-2023-28710">[CVE]</a> <a href="./CVE-2023-28710.cve.json">[CVE json]</a> <a href="./CVE-2023-28710.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-04-07T14:55:42.112Z</em></p>
-<h3 id="affected-156">Affected</h3>
+<h3 id="affected-161">Affected</h3>
<ul>
<li>Apache Airflow Spark Provider before 4.0.1</li>
</ul>
-<h3 id="description-156">Description</h3>
+<h3 id="description-161">Description</h3>
<p>Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Spark Provider.<p>This issue affects Apache Airflow Spark Provider: before 4.0.1.</p></p>
-<h3 id="references-156">References</h3>
+<h3 id="references-161">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/30223">https://github.com/apache/airflow/pull/30223</a></li>
<li><a href="https://lists.apache.org/thread/lb9w9114ow00h2nkn8bjm106v5x1p1d2">https://lists.apache.org/thread/lb9w9114ow00h2nkn8bjm106v5x1p1d2</a></li>
</ul>
-<h3 id="credits-153">Credits</h3>
+<h3 id="credits-158">Credits</h3>
<ul>
<li>Xie Jianming of Nsfocus (finder)</li>
</ul>
<h2 id="CVE-2023-28707">Airflow Apache Drill Provider Arbitrary File Read Vulnerability</h2>
<p>CVE-2023-28707 <a href="https://cve.org/CVERecord?id=CVE-2023-28707">[CVE]</a> <a href="./CVE-2023-28707.cve.json">[CVE json]</a> <a href="./CVE-2023-28707.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-04-07T14:53:21.428Z</em></p>
-<h3 id="affected-157">Affected</h3>
+<h3 id="affected-162">Affected</h3>
<ul>
<li>Apache Airflow Drill Provider before 2.3.2</li>
</ul>
-<h3 id="description-157">Description</h3>
+<h3 id="description-162">Description</h3>
<p>Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.<p>This issue affects Apache Airflow Drill Provider: before 2.3.2.</p></p>
-<h3 id="references-157">References</h3>
+<h3 id="references-162">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/30215">https://github.com/apache/airflow/pull/30215</a></li>
<li><a href="https://lists.apache.org/thread/dfoj7q1nd0vhhsl8fjg63z4j6mfmdxtk">https://lists.apache.org/thread/dfoj7q1nd0vhhsl8fjg63z4j6mfmdxtk</a></li>
</ul>
-<h3 id="credits-154">Credits</h3>
+<h3 id="credits-159">Credits</h3>
<ul>
<li>Kai Zhao of 3H Secruity Team (finder)</li>
</ul>
<h2 id="CVE-2023-28706">Apache Airflow Hive Provider Beeline Remote Command Execution</h2>
<p>CVE-2023-28706 <a href="https://cve.org/CVERecord?id=CVE-2023-28706">[CVE]</a> <a href="./CVE-2023-28706.cve.json">[CVE json]</a> <a href="./CVE-2023-28706.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-04-07T14:54:35.049Z</em></p>
-<h3 id="affected-158">Affected</h3>
+<h3 id="affected-163">Affected</h3>
<ul>
<li>Apache Airflow Hive Provider before 6.0.0</li>
</ul>
-<h3 id="description-158">Description</h3>
+<h3 id="description-163">Description</h3>
<p>Improper Control of Generation of Code (‘Code Injection’) vulnerability in Apache Software Foundation Apache Airflow Hive Provider.<p>This issue affects Apache Airflow Hive Provider: before 6.0.0.</p></p>
-<h3 id="references-158">References</h3>
+<h3 id="references-163">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/30212">https://github.com/apache/airflow/pull/30212</a></li>
<li><a href="https://lists.apache.org/thread/dl20xxd51xvlx0zzc0wzgxfjwgtbbxo3">https://lists.apache.org/thread/dl20xxd51xvlx0zzc0wzgxfjwgtbbxo3</a></li>
</ul>
-<h3 id="credits-155">Credits</h3>
+<h3 id="credits-160">Credits</h3>
<ul>
<li>sw0rd1ight of Caiji Sec Team and 4ra1n of Chaitin Tech (finder)</li>
</ul>
<h2 id="CVE-2023-27604">Airflow Sqoop Provider RCE Vulnerability</h2>
<p>CVE-2023-27604 <a href="https://cve.org/CVERecord?id=CVE-2023-27604">[CVE]</a> <a href="./CVE-2023-27604.cve.json">[CVE json]</a> <a href="./CVE-2023-27604.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-08-28T07:47:27.394Z</em></p>
-<h3 id="affected-159">Affected</h3>
+<h3 id="affected-164">Affected</h3>
<ul>
<li>Apache Airflow Sqoop Provider before 4.0.0</li>
</ul>
-<h3 id="description-159">Description</h3>
+<h3 id="description-164">Description</h3>
<p>Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the connections, which makes it possible to implement RCE attacks via ‘sqoop import –connect’, obtain airflow server permissions, etc. T<span style="background-color: rgb(255, 255, 255);">he attacker needs to be logged in and have authorization (permissions) to create/edit connections.<br></span><br> It is recommended to upgrade to a version that is n [...]
-<h3 id="references-159">References</h3>
+<h3 id="references-164">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/33039">https://github.com/apache/airflow/pull/33039</a></li>
<li><a href="https://lists.apache.org/thread/lswlxf11do51ob7f6xyyg8qp3n7wdrgd">https://lists.apache.org/thread/lswlxf11do51ob7f6xyyg8qp3n7wdrgd</a></li>
</ul>
-<h3 id="credits-156">Credits</h3>
+<h3 id="credits-161">Credits</h3>
<ul>
<li>happyhacking-k (finder)</li>
<li>Xie Jianming of Caiji Sec Team (finder)</li>
@@ -3175,18 +3274,18 @@
<h2 id="CVE-2023-25956">Arbitrary file read via AWS provider</h2>
<p>CVE-2023-25956 <a href="https://cve.org/CVERecord?id=CVE-2023-25956">[CVE]</a> <a href="./CVE-2023-25956.cve.json">[CVE json]</a> <a href="./CVE-2023-25956.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-03-07T08:23:39.736Z</em></p>
-<h3 id="affected-160">Affected</h3>
+<h3 id="affected-165">Affected</h3>
<ul>
<li>Apache Airflow AWS Provider before 7.2.1</li>
</ul>
-<h3 id="description-160">Description</h3>
+<h3 id="description-165">Description</h3>
<p>Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider.<br><br><p>This issue affects Apache Airflow AWS Provider versions before 7.2.1.</p></p>
-<h3 id="references-160">References</h3>
+<h3 id="references-165">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29587">https://github.com/apache/airflow/pull/29587</a></li>
<li><a href="https://lists.apache.org/thread/07pl9y4gdpw2c6rzqm77dvkm2z2kb5gv">https://lists.apache.org/thread/07pl9y4gdpw2c6rzqm77dvkm2z2kb5gv</a></li>
</ul>
-<h3 id="credits-157">Credits</h3>
+<h3 id="credits-162">Credits</h3>
<ul>
<li>Son Tran from VNPT - VCI (finder)</li>
<li>kuteminh11 (finder)</li>
@@ -3194,144 +3293,144 @@
<h2 id="CVE-2023-25754">Privilege escalation using airflow logs</h2>
<p>CVE-2023-25754 <a href="https://cve.org/CVERecord?id=CVE-2023-25754">[CVE]</a> <a href="./CVE-2023-25754.cve.json">[CVE json]</a> <a href="./CVE-2023-25754.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-05-08T11:57:41.997Z</em></p>
-<h3 id="affected-161">Affected</h3>
+<h3 id="affected-166">Affected</h3>
<ul>
<li>Apache Airflow before 2.6.0</li>
</ul>
-<h3 id="description-161">Description</h3>
+<h3 id="description-166">Description</h3>
<p>Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.<p>This issue affects Apache Airflow: before 2.6.0.</p></p>
-<h3 id="references-161">References</h3>
+<h3 id="references-166">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29506">https://github.com/apache/airflow/pull/29506</a></li>
<li><a href="https://lists.apache.org/thread/3y83gr0qb8t49ppfk4fb2yk7md8ltq4v">https://lists.apache.org/thread/3y83gr0qb8t49ppfk4fb2yk7md8ltq4v</a></li>
</ul>
-<h3 id="credits-158">Credits</h3>
+<h3 id="credits-163">Credits</h3>
<ul>
<li><a href="mailto:ksw9722@naver.com">ksw9722@naver.com</a> (finder)</li>
</ul>
<h2 id="CVE-2023-25696">Apache Airflow Hive Provider Beeline RCE</h2>
<p>CVE-2023-25696 <a href="https://cve.org/CVERecord?id=CVE-2023-25696">[CVE]</a> <a href="./CVE-2023-25696.cve.json">[CVE json]</a> <a href="./CVE-2023-25696.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-02-24T11:48:19.499Z</em></p>
-<h3 id="affected-162">Affected</h3>
+<h3 id="affected-167">Affected</h3>
<ul>
<li>Apache Airflow Hive Provider before 5.1.3</li>
</ul>
-<h3 id="description-162">Description</h3>
+<h3 id="description-167">Description</h3>
<p>Improper Input Validation vulnerability in the Apache Airflow Hive Provider.<br><br><p>This issue affects Apache Airflow Hive Provider versions before 5.1.3.</p></p>
-<h3 id="references-162">References</h3>
+<h3 id="references-167">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29502">https://github.com/apache/airflow/pull/29502</a></li>
<li><a href="https://lists.apache.org/thread/99g0qm56wmgdxmbtdsvhj4rdnxhpzpml">https://lists.apache.org/thread/99g0qm56wmgdxmbtdsvhj4rdnxhpzpml</a></li>
</ul>
-<h3 id="credits-159">Credits</h3>
+<h3 id="credits-164">Credits</h3>
<ul>
<li>id_No2015429 of 3H Secruity Team (finder)</li>
</ul>
<h2 id="CVE-2023-25695">Information disclosure in Apache Airflow</h2>
<p>CVE-2023-25695 <a href="https://cve.org/CVERecord?id=CVE-2023-25695">[CVE]</a> <a href="./CVE-2023-25695.cve.json">[CVE json]</a> <a href="./CVE-2023-25695.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-03-15T09:37:07.873Z</em></p>
-<h3 id="affected-163">Affected</h3>
+<h3 id="affected-168">Affected</h3>
<ul>
<li>Apache Airflow before 2.5.2</li>
</ul>
-<h3 id="description-163">Description</h3>
+<h3 id="description-168">Description</h3>
<p>Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.<p>This issue affects Apache Airflow: before 2.5.2.</p></p>
-<h3 id="references-163">References</h3>
+<h3 id="references-168">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29501">https://github.com/apache/airflow/pull/29501</a></li>
<li><a href="https://lists.apache.org/thread/z8w6ckzs61ql365tv4d19k82o67r15p2">https://lists.apache.org/thread/z8w6ckzs61ql365tv4d19k82o67r15p2</a></li>
</ul>
-<h3 id="credits-160">Credits</h3>
+<h3 id="credits-165">Credits</h3>
<ul>
<li>kuteminh11 (finder)</li>
</ul>
<h2 id="CVE-2023-25693">Sqoop Apache Airflow Provider Remote Code Execution Vulnerability</h2>
<p>CVE-2023-25693 <a href="https://cve.org/CVERecord?id=CVE-2023-25693">[CVE]</a> <a href="./CVE-2023-25693.cve.json">[CVE json]</a> <a href="./CVE-2023-25693.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-02-24T11:48:09.839Z</em></p>
-<h3 id="affected-164">Affected</h3>
+<h3 id="affected-169">Affected</h3>
<ul>
<li>Apache Airflow Sqoop Provider before 3.1.1</li>
</ul>
-<h3 id="description-164">Description</h3>
+<h3 id="description-169">Description</h3>
<p>Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider.<br><br><p>This issue affects Apache Airflow Sqoop Provider versions before 3.1.1.</p></p>
-<h3 id="references-164">References</h3>
+<h3 id="references-169">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29500">https://github.com/apache/airflow/pull/29500</a></li>
<li><a href="https://lists.apache.org/thread/79qn8g5xbq036f8crb115obvr22l52q4">https://lists.apache.org/thread/79qn8g5xbq036f8crb115obvr22l52q4</a></li>
</ul>
-<h3 id="credits-161">Credits</h3>
+<h3 id="credits-166">Credits</h3>
<ul>
<li>L3yx of Syclover Security Team (finder)</li>
</ul>
<h2 id="CVE-2023-25692">Google Cloud Sql Provider Denial Of Service</h2>
<p>CVE-2023-25692 <a href="https://cve.org/CVERecord?id=CVE-2023-25692">[CVE]</a> <a href="./CVE-2023-25692.cve.json">[CVE json]</a> <a href="./CVE-2023-25692.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-02-24T11:47:58.411Z</em></p>
-<h3 id="affected-165">Affected</h3>
+<h3 id="affected-170">Affected</h3>
<ul>
<li>Apache Airflow Google Provider before 8.10.0</li>
</ul>
-<h3 id="description-165">Description</h3>
+<h3 id="description-170">Description</h3>
<p>Improper Input Validation vulnerability in the Apache Airflow Google Provider.<br><br><p>This issue affects Apache Airflow Google Provider versions before 8.10.0.</p></p>
-<h3 id="references-165">References</h3>
+<h3 id="references-170">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29499">https://github.com/apache/airflow/pull/29499</a></li>
<li><a href="https://lists.apache.org/thread/ks4l78l5rwdpmvfn7y7yhs179nyxtlsh">https://lists.apache.org/thread/ks4l78l5rwdpmvfn7y7yhs179nyxtlsh</a></li>
</ul>
-<h3 id="credits-162">Credits</h3>
+<h3 id="credits-167">Credits</h3>
<ul>
<li>Xie Jianming of Caiji Sec Team (finder)</li>
</ul>
<h2 id="CVE-2023-25691">Google Cloud Sql Provider Remote Command Execution</h2>
<p>CVE-2023-25691 <a href="https://cve.org/CVERecord?id=CVE-2023-25691">[CVE]</a> <a href="./CVE-2023-25691.cve.json">[CVE json]</a> <a href="./CVE-2023-25691.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-02-24T11:35:47.925Z</em></p>
-<h3 id="affected-166">Affected</h3>
+<h3 id="affected-171">Affected</h3>
<ul>
<li>Apache Airflow Google Provider before 8.10.0</li>
</ul>
-<h3 id="description-166">Description</h3>
+<h3 id="description-171">Description</h3>
<p>Improper Input Validation vulnerability in the Apache Airflow Google Provider.<br><br><p>This issue affects Apache Airflow Google Provider versions before 8.10.0.</p></p>
-<h3 id="references-166">References</h3>
+<h3 id="references-171">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/29497">https://github.com/apache/airflow/pull/29497</a></li>
<li><a href="https://lists.apache.org/thread/zdr8ovfttbh7kj0lydgcw88tbt2nmkcy">https://lists.apache.org/thread/zdr8ovfttbh7kj0lydgcw88tbt2nmkcy</a></li>
</ul>
-<h3 id="credits-163">Credits</h3>
+<h3 id="credits-168">Credits</h3>
<ul>
<li>Xie Jianming of Caiji Sec Team (finder)</li>
</ul>
<h2 id="CVE-2023-22888">Scheduler remote DoS</h2>
<p>CVE-2023-22888 <a href="https://cve.org/CVERecord?id=CVE-2023-22888">[CVE]</a> <a href="./CVE-2023-22888.cve.json">[CVE json]</a> <a href="./CVE-2023-22888.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-07-12T09:17:51.316Z</em></p>
-<h3 id="affected-167">Affected</h3>
+<h3 id="affected-172">Affected</h3>
<ul>
<li>Apache Airflow before 2.6.3</li>
</ul>
-<h3 id="description-167">Description</h3>
+<h3 id="description-172">Description</h3>
<p>Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to cause a service disruption by manipulating the run_id parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected</p>
-<h3 id="references-167">References</h3>
+<h3 id="references-172">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/32293">https://github.com/apache/airflow/pull/32293</a></li>
<li><a href="https://lists.apache.org/thread/dnlht2hvm7k81k5tgjtsfmk27c76kq7z">https://lists.apache.org/thread/dnlht2hvm7k81k5tgjtsfmk27c76kq7z</a></li>
</ul>
-<h3 id="credits-164">Credits</h3>
+<h3 id="credits-169">Credits</h3>
<ul>
<li>Zhipeng Zhang (@timon8) (finder)</li>
</ul>
<h2 id="CVE-2023-22887">Apache Airflow path traversal by authenticated user</h2>
<p>CVE-2023-22887 <a href="https://cve.org/CVERecord?id=CVE-2023-22887">[CVE]</a> <a href="./CVE-2023-22887.cve.json">[CVE json]</a> <a href="./CVE-2023-22887.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-07-13T10:31:08.518Z</em></p>
-<h3 id="affected-168">Affected</h3>
+<h3 id="affected-173">Affected</h3>
<ul>
<li>Apache Airflow before 2.6.3</li>
</ul>
-<h3 id="description-168">Description</h3>
+<h3 id="description-173">Description</h3>
<p>Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended directory structure by manipulating the run_id parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected</p>
-<h3 id="references-168">References</h3>
+<h3 id="references-173">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/32293">https://github.com/apache/airflow/pull/32293</a></li>
<li><a href="https://lists.apache.org/thread/rxddqs76r6rkxsg1n24d029zys67qwwo">https://lists.apache.org/thread/rxddqs76r6rkxsg1n24d029zys67qwwo</a></li>
</ul>
-<h3 id="credits-165">Credits</h3>
+<h3 id="credits-170">Credits</h3>
<ul>
<li>Zhipeng Zhang (@Timon8) (finder)</li>
<li>KietNA from National Cyber Security (NCS) (finder)</li>
@@ -3339,17 +3438,17 @@
<h2 id="CVE-2023-22886">RCE Vulnerability</h2>
<p>CVE-2023-22886 <a href="https://cve.org/CVERecord?id=CVE-2023-22886">[CVE]</a> <a href="./CVE-2023-22886.cve.json">[CVE json]</a> <a href="./CVE-2023-22886.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-06-29T09:40:58.058Z</em></p>
-<h3 id="affected-169">Affected</h3>
+<h3 id="affected-174">Affected</h3>
<ul>
<li>Apache Airflow JDBC Provider before 4.0.0</li>
</ul>
-<h3 id="description-169">Description</h3>
+<h3 id="description-174">Description</h3>
<p>Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider.<br><span style="background-color: rgb(255, 255, 255);">Airflow JDBC Provider Connection’s [Connection URL] parameters had no</span><br><span style="background-color: rgb(255, 255, 255);">restrictions, which made it possible to implement RCE attacks via</span><br><span style="background-color: rgb(255, 255, 255);">different type JDBC drivers, obtain airflow server permission.</span><br>< [...]
-<h3 id="references-169">References</h3>
+<h3 id="references-174">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/ynbjwp4n0vzql0xzhog1gkp1ovncf8j3">https://lists.apache.org/thread/ynbjwp4n0vzql0xzhog1gkp1ovncf8j3</a></li>
</ul>
-<h3 id="credits-166">Credits</h3>
+<h3 id="credits-171">Credits</h3>
<ul>
<li>heart Y (finder)</li>
<li>happyhacking (finder)</li>
@@ -3357,32 +3456,32 @@
<h2 id="CVE-2023-22884">Arbitrary file read via MySQL provider in Apache Airflow</h2>
<p>CVE-2023-22884 <a href="https://cve.org/CVERecord?id=CVE-2023-22884">[CVE]</a> <a href="./CVE-2023-22884.cve.json">[CVE json]</a> <a href="./CVE-2023-22884.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-01-21T13:02:09.736Z</em></p>
-<h3 id="affected-170">Affected</h3>
+<h3 id="affected-175">Affected</h3>
<ul>
<li>Apache Airflow before 2.5.1</li>
<li>Apache Airflow MySQL Provider before 4.0.0</li>
</ul>
-<h3 id="description-170">Description</h3>
+<h3 id="description-175">Description</h3>
<p>Improper Neutralization of Special Elements used in a Command (‘Command Injection’) vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.<p>This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL Provider: before 4.0.0.</p></p>
-<h3 id="references-170">References</h3>
+<h3 id="references-175">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/28811">https://github.com/apache/airflow/pull/28811</a></li>
<li><a href="https://lists.apache.org/thread/0l0j3nt0t7fzrcjl2ch0jgj6c58kxs5h">https://lists.apache.org/thread/0l0j3nt0t7fzrcjl2ch0jgj6c58kxs5h</a></li>
</ul>
-<h3 id="credits-167">Credits</h3>
+<h3 id="credits-172">Credits</h3>
<ul>
<li>Son Tran from VNPT - VCI (reporter)</li>
</ul>
<h2 id="CVE-2022-46651">Security vulnerability on AirFlow Connections</h2>
<p>CVE-2022-46651 <a href="https://cve.org/CVERecord?id=CVE-2022-46651">[CVE]</a> <a href="./CVE-2022-46651.cve.json">[CVE json]</a> <a href="./CVE-2022-46651.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-07-12T09:16:59.771Z</em></p>
-<h3 id="affected-171">Affected</h3>
+<h3 id="affected-176">Affected</h3>
<ul>
<li>Apache Airflow before 2.6.3</li>
</ul>
-<h3 id="description-171">Description</h3>
+<h3 id="description-176">Description</h3>
<p>Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability.<br></p>
-<h3 id="references-171">References</h3>
+<h3 id="references-176">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/32309">https://github.com/apache/airflow/pull/32309</a></li>
<li><a href="https://lists.apache.org/thread/n45h3y82og125rnlgt6rbm9szfb6q24d">https://lists.apache.org/thread/n45h3y82og125rnlgt6rbm9szfb6q24d</a></li>
@@ -3390,271 +3489,271 @@
<h2 id="CVE-2022-46421">Hive Provider RCE vulnerability with hive_cli_params</h2>
<p>CVE-2022-46421 <a href="https://cve.org/CVERecord?id=CVE-2022-46421">[CVE]</a> <a href="./CVE-2022-46421.cve.json">[CVE json]</a> <a href="./CVE-2022-46421.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-12-20T10:18:24.768Z</em></p>
-<h3 id="affected-172">Affected</h3>
+<h3 id="affected-177">Affected</h3>
<ul>
<li>Apache Airflow Hive Provider before 5.0.0</li>
</ul>
-<h3 id="description-172">Description</h3>
+<h3 id="description-177">Description</h3>
<p>Improper Neutralization of Special Elements used in a Command (‘Command Injection’) vulnerability in Apache Software Foundation Apache Airflow Hive Provider.<p>This issue affects Apache Airflow Hive Provider: before 5.0.0.</p></p>
-<h3 id="references-172">References</h3>
+<h3 id="references-177">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/28101">https://github.com/apache/airflow/pull/28101</a></li>
<li><a href="https://lists.apache.org/thread/09twdoyoybldlfj5gvk0qswtofh0rmp4">https://lists.apache.org/thread/09twdoyoybldlfj5gvk0qswtofh0rmp4</a></li>
</ul>
-<h3 id="credits-168">Credits</h3>
+<h3 id="credits-173">Credits</h3>
<ul>
<li>id_No2015429 of 3H Security Team (finder)</li>
</ul>
<h2 id="CVE-2022-45402">Apache Airflow: Open redirect during login</h2>
<p>CVE-2022-45402 <a href="https://cve.org/CVERecord?id=CVE-2022-45402">[CVE]</a> <a href="./CVE-2022-45402.cve.json">[CVE json]</a> <a href="./CVE-2022-45402.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-15T08:49:17.848Z</em></p>
-<h3 id="affected-173">Affected</h3>
+<h3 id="affected-178">Affected</h3>
<ul>
<li>Apache Airflow from unspecified before 2.4.3</li>
</ul>
-<h3 id="description-173">Description</h3>
+<h3 id="description-178">Description</h3>
<p>In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver’s <code>/login</code> endpoint.</p>
-<h3 id="references-173">References</h3>
+<h3 id="references-178">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/27576">https://github.com/apache/airflow/pull/27576</a></li>
<li><a href="https://lists.apache.org/thread/nf4xrkoo6c81g6fdn4vj8k9x2686o9nh">https://lists.apache.org/thread/nf4xrkoo6c81g6fdn4vj8k9x2686o9nh</a></li>
</ul>
-<h3 id="credits-169">Credits</h3>
+<h3 id="credits-174">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank Bugra Eskici for reporting this issue.</li>
</ul>
<h2 id="CVE-2022-43985">Apache Airflow prior to 2.4.2 has an open redirect</h2>
<p>CVE-2022-43985 <a href="https://cve.org/CVERecord?id=CVE-2022-43985">[CVE]</a> <a href="./CVE-2022-43985.cve.json">[CVE json]</a> <a href="./CVE-2022-43985.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-02T08:40:14.097Z</em></p>
-<h3 id="affected-174">Affected</h3>
+<h3 id="affected-179">Affected</h3>
<ul>
<li>Apache Airflow from unspecified before 2.4.2</li>
</ul>
-<h3 id="description-174">Description</h3>
+<h3 id="description-179">Description</h3>
<p>In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver’s <code>/confirm</code> endpoint.</p>
-<h3 id="references-174">References</h3>
+<h3 id="references-179">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/27143">https://github.com/apache/airflow/pull/27143</a></li>
<li><a href="https://lists.apache.org/thread/m13y9s5kw92fw9l8j4qd85h0txp4kfcq">https://lists.apache.org/thread/m13y9s5kw92fw9l8j4qd85h0txp4kfcq</a></li>
</ul>
-<h3 id="credits-170">Credits</h3>
+<h3 id="credits-175">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank Axel Chong (@Haxatron) [https://hackerone.com/haxatron1] for reporting this issue.</li>
</ul>
<h2 id="CVE-2022-43982">Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL</h2>
<p>CVE-2022-43982 <a href="https://cve.org/CVERecord?id=CVE-2022-43982">[CVE]</a> <a href="./CVE-2022-43982.cve.json">[CVE json]</a> <a href="./CVE-2022-43982.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-02T08:37:19.773Z</em></p>
-<h3 id="affected-175">Affected</h3>
+<h3 id="affected-180">Affected</h3>
<ul>
<li>Apache Airflow from unspecified before 2.4.2</li>
</ul>
-<h3 id="description-175">Description</h3>
+<h3 id="description-180">Description</h3>
<p>In Apache Airflow versions prior to 2.4.2, the “Trigger DAG with config” screen was susceptible to XSS attacks via the <code>origin</code> query argument.</p>
-<h3 id="references-175">References</h3>
+<h3 id="references-180">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/27143">https://github.com/apache/airflow/pull/27143</a></li>
<li><a href="https://lists.apache.org/thread/vqnvdrfsw9z7v7c46qh3psjgr7wy959l">https://lists.apache.org/thread/vqnvdrfsw9z7v7c46qh3psjgr7wy959l</a></li>
</ul>
-<h3 id="credits-171">Credits</h3>
+<h3 id="credits-176">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank id_No2015429 of 3H Security Team for reporting this issue.</li>
</ul>
<h2 id="CVE-2022-41672">Session still functional after user is deactivated</h2>
<p>CVE-2022-41672 <a href="https://cve.org/CVERecord?id=CVE-2022-41672">[CVE]</a> <a href="./CVE-2022-41672.cve.json">[CVE json]</a> <a href="./CVE-2022-41672.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-10-07T06:56:43.156Z</em></p>
-<h3 id="affected-176">Affected</h3>
+<h3 id="affected-181">Affected</h3>
<ul>
<li>Apache Airflow from unspecified through 2.4.0</li>
</ul>
-<h3 id="description-176">Description</h3>
+<h3 id="description-181">Description</h3>
<p>In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn’t prevent an already authenticated user from being able to continue using the UI or API.</p>
-<h3 id="references-176">References</h3>
+<h3 id="references-181">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/26635">https://github.com/apache/airflow/pull/26635</a></li>
<li><a href="https://lists.apache.org/thread/ohf3pvd3dftb8zb01yngbn1jtkq5m08y">https://lists.apache.org/thread/ohf3pvd3dftb8zb01yngbn1jtkq5m08y</a></li>
</ul>
-<h3 id="credits-172">Credits</h3>
+<h3 id="credits-177">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank Axel Chong (@Haxatron) for reporting this issue.</li>
</ul>
<h2 id="CVE-2022-41131">Apache Airflow Hive Provider vulnerability (command injection via hive_cli connection)</h2>
<p>CVE-2022-41131 <a href="https://cve.org/CVERecord?id=CVE-2022-41131">[CVE]</a> <a href="./CVE-2022-41131.cve.json">[CVE json]</a> <a href="./CVE-2022-41131.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-22T09:38:16.454Z</em></p>
-<h3 id="affected-177">Affected</h3>
+<h3 id="affected-182">Affected</h3>
<ul>
<li>Apache Airflow Hive Provider from unspecified before 4.1.0</li>
<li>Apache Airflow at 2.3.0</li>
</ul>
-<h3 id="description-177">Description</h3>
+<h3 id="description-182">Description</h3>
<p>Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG files. This issue affects Hive Provider versions prior to 4.1.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case HIve Provider is installed (Hive Provider 4.1.0 can only be installed for Airflow 2.3 [...]
-<h3 id="references-177">References</h3>
+<h3 id="references-182">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/27647">https://github.com/apache/airflow/pull/27647</a></li>
<li><a href="https://lists.apache.org/thread/wwo3qp0z8gv54yzn7hr04wy4n8gb0vhl">https://lists.apache.org/thread/wwo3qp0z8gv54yzn7hr04wy4n8gb0vhl</a></li>
</ul>
-<h3 id="credits-173">Credits</h3>
+<h3 id="credits-178">Credits</h3>
<ul>
<li>Apache Airflow PMC wants to thank id_No2015429 of 3H Security Team for reporting the issue.</li>
</ul>
<h2 id="CVE-2022-40954">Apache Airflow Spark Provider RCE that bypass restrictions to read arbitrary files</h2>
<p>CVE-2022-40954 <a href="https://cve.org/CVERecord?id=CVE-2022-40954">[CVE]</a> <a href="./CVE-2022-40954.cve.json">[CVE json]</a> <a href="./CVE-2022-40954.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-22T09:40:32.614Z</em></p>
-<h3 id="affected-178">Affected</h3>
+<h3 id="affected-183">Affected</h3>
<ul>
<li>Apache Airflow Spark Provider from unspecified before 4.0.0</li>
<li>Apache Airflow from unspecified before 2.3.0</li>
</ul>
-<h3 id="description-178">Description</h3>
+<h3 id="description-183">Description</h3>
<p>Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Spark Provider is installed (Spark Provider 4.0.0 can only be installed for Airflow 2.3.0 [...]
-<h3 id="references-178">References</h3>
+<h3 id="references-183">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/27646">https://github.com/apache/airflow/pull/27646</a></li>
<li><a href="https://lists.apache.org/thread/0tmdlnmjs5t4gsx5fy73tb6zd3jztq45">https://lists.apache.org/thread/0tmdlnmjs5t4gsx5fy73tb6zd3jztq45</a></li>
</ul>
-<h3 id="credits-174">Credits</h3>
+<h3 id="credits-179">Credits</h3>
<ul>
<li>Apache Airflow PMC wants to thank id_No2015429 of 3H Security Team for reporting the issue.</li>
</ul>
<h2 id="CVE-2022-40754">Open Redirect</h2>
<p>CVE-2022-40754 <a href="https://cve.org/CVERecord?id=CVE-2022-40754">[CVE]</a> <a href="./CVE-2022-40754.cve.json">[CVE json]</a> <a href="./CVE-2022-40754.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-09-21T07:22:31.671Z</em></p>
-<h3 id="affected-179">Affected</h3>
+<h3 id="affected-184">Affected</h3>
<ul>
<li>Apache Airflow from unspecified before 2.4.0</li>
</ul>
-<h3 id="description-179">Description</h3>
+<h3 id="description-184">Description</h3>
<p>In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver’s <code>/confirm</code> endpoint.</p>
-<h3 id="references-179">References</h3>
+<h3 id="references-184">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/26409">https://github.com/apache/airflow/pull/26409</a></li>
<li><a href="https://lists.apache.org/thread/cn098dcp5x3c402xrb06p3l7nz5goffm">https://lists.apache.org/thread/cn098dcp5x3c402xrb06p3l7nz5goffm</a></li>
</ul>
-<h3 id="credits-175">Credits</h3>
+<h3 id="credits-180">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank Konstantin Weddige (Lutra Security) for reporting this issue.</li>
</ul>
<h2 id="CVE-2022-40604">Format String Vulnerability</h2>
<p>CVE-2022-40604 <a href="https://cve.org/CVERecord?id=CVE-2022-40604">[CVE]</a> <a href="./CVE-2022-40604.cve.json">[CVE json]</a> <a href="./CVE-2022-40604.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-09-21T07:22:50.780Z</em></p>
-<h3 id="affected-180">Affected</h3>
+<h3 id="affected-185">Affected</h3>
<ul>
<li>Apache Airflow from unspecified before 2.4.0</li>
</ul>
-<h3 id="description-180">Description</h3>
+<h3 id="description-185">Description</h3>
<p>In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction.</p>
-<h3 id="references-180">References</h3>
+<h3 id="references-185">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/26337">https://github.com/apache/airflow/pull/26337</a></li>
<li><a href="https://lists.apache.org/thread/z20x8m16fnhxdkoollv53w1ybsts687t">https://lists.apache.org/thread/z20x8m16fnhxdkoollv53w1ybsts687t</a></li>
</ul>
-<h3 id="credits-176">Credits</h3>
+<h3 id="credits-181">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank L3yx of Syclover Security Team for reporting this issue.</li>
</ul>
<h2 id="CVE-2022-40189">Apache Airlfow Pig Provider RCE</h2>
<p>CVE-2022-40189 <a href="https://cve.org/CVERecord?id=CVE-2022-40189">[CVE]</a> <a href="./CVE-2022-40189.cve.json">[CVE json]</a> <a href="./CVE-2022-40189.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-22T09:39:35.331Z</em></p>
-<h3 id="affected-181">Affected</h3>
+<h3 id="affected-186">Affected</h3>
<ul>
<li>Apache Airlfow Pig Provider from unspecified before 4.0.0</li>
<li>Apache Airflow from unspecified before 2.3.0</li>
</ul>
-<h3 id="description-181">Description</h3>
+<h3 id="description-186">Description</h3>
<p>Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Pig Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Pig Provider is installed (Pig Provider 4.0.0 can only be installed for Airflow 2.3.0+) [...]
-<h3 id="references-181">References</h3>
+<h3 id="references-186">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/27644">https://github.com/apache/airflow/pull/27644</a></li>
<li><a href="https://lists.apache.org/thread/yxnfzfw2w9pj5s785k3rlyly4y44sd15">https://lists.apache.org/thread/yxnfzfw2w9pj5s785k3rlyly4y44sd15</a></li>
</ul>
-<h3 id="credits-177">Credits</h3>
+<h3 id="credits-182">Credits</h3>
<ul>
<li>Apache Airflow PMC wants to thank id_No2015429 of 3H Security Team for reporting the issue.</li>
</ul>
<h2 id="CVE-2022-40127">Apache Airflow <2.4.0 has an RCE in a bash example</h2>
<p>CVE-2022-40127 <a href="https://cve.org/CVERecord?id=CVE-2022-40127">[CVE]</a> <a href="./CVE-2022-40127.cve.json">[CVE json]</a> <a href="./CVE-2022-40127.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-14T09:30:08.330Z</em></p>
-<h3 id="affected-182">Affected</h3>
+<h3 id="affected-187">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow before 2.4.0</li>
</ul>
-<h3 id="description-182">Description</h3>
+<h3 id="description-187">Description</h3>
<p>A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.</p>
-<h3 id="references-182">References</h3>
+<h3 id="references-187">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/25960">https://github.com/apache/airflow/pull/25960</a></li>
<li><a href="https://lists.apache.org/thread/cf132hgm6jvzvsbpsozl3plf1r4cwysy">https://lists.apache.org/thread/cf132hgm6jvzvsbpsozl3plf1r4cwysy</a></li>
</ul>
-<h3 id="credits-178">Credits</h3>
+<h3 id="credits-183">Credits</h3>
<ul>
<li>Apache Airflow PMC would like to thank L3yx of Syclover Security Team.</li>
</ul>
<h2 id="CVE-2022-38649">Apache Airflow Pinot provider allowed Command Injection</h2>
<p>CVE-2022-38649 <a href="https://cve.org/CVERecord?id=CVE-2022-38649">[CVE]</a> <a href="./CVE-2022-38649.cve.json">[CVE json]</a> <a href="./CVE-2022-38649.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-22T09:35:10.175Z</em></p>
-<h3 id="affected-183">Affected</h3>
+<h3 id="affected-188">Affected</h3>
<ul>
<li>Apache Airflow Pinot Provider from unspecified before 4.0.0</li>
<li>Apache Airflow from unspecified before 2.3.0</li>
</ul>
-<h3 id="description-183">Description</h3>
+<h3 id="description-188">Description</h3>
<p>Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Apache Airflow Pinot Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Apache Airflow Pinot Provider is installed (Apache Airflow Pinot Pro [...]
-<h3 id="references-183">References</h3>
+<h3 id="references-188">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/27641">https://github.com/apache/airflow/pull/27641</a></li>
<li><a href="https://lists.apache.org/thread/033o1gbc4ly6dpd2xf1o201v56fbl4dz">https://lists.apache.org/thread/033o1gbc4ly6dpd2xf1o201v56fbl4dz</a></li>
</ul>
-<h3 id="credits-179">Credits</h3>
+<h3 id="credits-184">Credits</h3>
<ul>
<li>Apache Airflow PMC wants to thank id_No2015429 of 3H Security Team for reporting the issue.</li>
</ul>
<h2 id="CVE-2022-38362">Docker Provider <3.0 RCE vulnerability in example dag</h2>
<p>CVE-2022-38362 <a href="https://cve.org/CVERecord?id=CVE-2022-38362">[CVE]</a> <a href="./CVE-2022-38362.cve.json">[CVE json]</a> <a href="./CVE-2022-38362.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-08-16T14:05:03.199Z</em></p>
-<h3 id="affected-184">Affected</h3>
+<h3 id="affected-189">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow Docker Provider before 3.0.0</li>
</ul>
-<h3 id="description-184">Description</h3>
+<h3 id="description-189">Description</h3>
<p>Apache Airflow Docker’s Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host.</p>
-<h3 id="references-184">References</h3>
+<h3 id="references-189">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/614p38nf4gbk8xhvnskj9b1sqo2dknkb">https://lists.apache.org/thread/614p38nf4gbk8xhvnskj9b1sqo2dknkb</a></li>
</ul>
-<h3 id="credits-180">Credits</h3>
+<h3 id="credits-185">Credits</h3>
<ul>
<li>Thanks to Kai Zhao of 3H Secruity Team for reporting this</li>
</ul>
<h2 id="CVE-2022-38170">Overly permissive umask for daemons</h2>
<p>CVE-2022-38170 <a href="https://cve.org/CVERecord?id=CVE-2022-38170">[CVE]</a> <a href="./CVE-2022-38170.cve.json">[CVE json]</a> <a href="./CVE-2022-38170.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-09-02T07:07:24.352Z</em></p>
-<h3 id="affected-185">Affected</h3>
+<h3 id="affected-190">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow through 2.3.3</li>
</ul>
-<h3 id="description-185">Description</h3>
+<h3 id="description-190">Description</h3>
<p>In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the <code>--daemon</code> flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver.</p>
-<h3 id="references-185">References</h3>
+<h3 id="references-190">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/zn8mbbb1j2od5nc9zhrvb7rpsrg1vvzv">https://lists.apache.org/thread/zn8mbbb1j2od5nc9zhrvb7rpsrg1vvzv</a></li>
</ul>
-<h3 id="credits-181">Credits</h3>
+<h3 id="credits-186">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank Harry Sintonen for reporting this issue.</li>
</ul>
<h2 id="CVE-2022-38054">Session Fixation</h2>
<p>CVE-2022-38054 <a href="https://cve.org/CVERecord?id=CVE-2022-38054">[CVE]</a> <a href="./CVE-2022-38054.cve.json">[CVE json]</a> <a href="./CVE-2022-38054.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-09-13T08:39:38.357Z</em></p>
-<h3 id="affected-186">Affected</h3>
+<h3 id="affected-191">Affected</h3>
<ul>
<li>Apache Airflow from 2.2.4 before Apache Airflow*</li>
</ul>
-<h3 id="description-186">Description</h3>
+<h3 id="description-191">Description</h3>
<p>In Apache Airflow versions 2.2.4 through 2.3.3, the <code>database</code> webserver session backend was susceptible to session fixation.</p>
-<h3 id="references-186">References</h3>
+<h3 id="references-191">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/rsd3h89xdp16rg0ltovx3m7q3ypkxsbb">https://lists.apache.org/thread/rsd3h89xdp16rg0ltovx3m7q3ypkxsbb</a></li>
</ul>
-<h3 id="credits-182">Credits</h3>
+<h3 id="credits-187">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank Kai Zhao for reporting this issue.</li>
<li>Additoinally we would like to thank Ali Al-Habsi for independently discovering and reporting this issue.</li>
@@ -3662,233 +3761,233 @@
<h2 id="CVE-2022-27949">Apache Airflow prior to 2.3.1 may include sensitive values in rendered template</h2>
<p>CVE-2022-27949 <a href="https://cve.org/CVERecord?id=CVE-2022-27949">[CVE]</a> <a href="./CVE-2022-27949.cve.json">[CVE json]</a> <a href="./CVE-2022-27949.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-15T11:12:08.938Z</em></p>
-<h3 id="affected-187">Affected</h3>
+<h3 id="affected-192">Affected</h3>
<ul>
<li>Apache Airflow from unspecified before 2.3.1</li>
</ul>
-<h3 id="description-187">Description</h3>
+<h3 id="description-192">Description</h3>
<p>A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example when they were depending on past and previous instances of the task failed). This issue affects Apache Airflow prior to 2.3.1.</p>
-<h3 id="references-187">References</h3>
+<h3 id="references-192">References</h3>
<ul>
<li><a href="https://github.com/apache/airflow/pull/22754">https://github.com/apache/airflow/pull/22754</a></li>
<li><a href="https://lists.apache.org/thread/n38oc5obb48600fsvnbopxcs0jpbp65p">https://lists.apache.org/thread/n38oc5obb48600fsvnbopxcs0jpbp65p</a></li>
</ul>
-<h3 id="credits-183">Credits</h3>
+<h3 id="credits-188">Credits</h3>
<ul>
<li>Apache Airflow PMC would like to thank James Srinivasan for reporting it.</li>
</ul>
<h2 id="CVE-2022-24288">Apache Airflow: RCE in example DAGs</h2>
<p>CVE-2022-24288 <a href="https://cve.org/CVERecord?id=CVE-2022-24288">[CVE]</a> <a href="./CVE-2022-24288.cve.json">[CVE json]</a> <a href="./CVE-2022-24288.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-02-25T08:21:43.680Z</em></p>
-<h3 id="affected-188">Affected</h3>
+<h3 id="affected-193">Affected</h3>
<ul>
<li>Apache Airflow from unspecified before 2.2.4</li>
</ul>
-<h3 id="description-188">Description</h3>
+<h3 id="description-193">Description</h3>
<p>In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.</p>
-<h3 id="references-188">References</h3>
+<h3 id="references-193">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/dbw5ozcmr0h0lhs0yjph7xdc64oht23t">https://lists.apache.org/thread/dbw5ozcmr0h0lhs0yjph7xdc64oht23t</a></li>
</ul>
-<h3 id="credits-184">Credits</h3>
+<h3 id="credits-189">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank Kai Zhao of the TToU Security Team for reporting this issue.</li>
</ul>
<h2 id="CVE-2021-45230">Apache Airflow: Creating DagRuns didn’t respect Dag-level permissions in the Webserver</h2>
<p>CVE-2021-45230 <a href="https://cve.org/CVERecord?id=CVE-2021-45230">[CVE]</a> <a href="./CVE-2021-45230.cve.json">[CVE json]</a> <a href="./CVE-2021-45230.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-01-20T09:06:03.334Z</em></p>
-<h3 id="affected-189">Affected</h3>
+<h3 id="affected-194">Affected</h3>
<ul>
<li>Apache Airflow at Apache Airflow 1.10 1.10.0 to 1.10.15</li>
<li>Apache Airflow from Apache Airflow 2 before 2.2.0</li>
</ul>
-<h3 id="description-189">Description</h3>
+<h3 id="description-194">Description</h3>
<p>In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has “can_create” permissions on DAG Runs can create Dag Runs for dags that they don’t have “edit” permissions for.</p>
-<h3 id="references-189">References</h3>
+<h3 id="references-194">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/m778ojn0k595rwco4ht9wjql89mjoxnl">https://lists.apache.org/thread/m778ojn0k595rwco4ht9wjql89mjoxnl</a></li>
</ul>
-<h3 id="credits-185">Credits</h3>
+<h3 id="credits-190">Credits</h3>
<ul>
<li>Apache Airflow PMC would like to thank Franco Cano Erazo for reporting this issue.</li>
</ul>
<h2 id="CVE-2021-45229">Apache Airflow: Reflected XSS via Origin Query Argument in URL</h2>
<p>CVE-2021-45229 <a href="https://cve.org/CVERecord?id=CVE-2021-45229">[CVE]</a> <a href="./CVE-2021-45229.cve.json">[CVE json]</a> <a href="./CVE-2021-45229.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-02-25T08:21:17.026Z</em></p>
-<h3 id="affected-190">Affected</h3>
+<h3 id="affected-195">Affected</h3>
<ul>
<li>Apache Airflow from unspecified before 2.2.4</li>
</ul>
-<h3 id="description-190">Description</h3>
+<h3 id="description-195">Description</h3>
<p>It was discovered that the “Trigger DAG with config” screen was susceptible to XSS attacks via the <code>origin</code> query argument.</p>
<p>This issue affects Apache Airflow versions 2.2.3 and below.</p>
-<h3 id="references-190">References</h3>
+<h3 id="references-195">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/phx76cgtmhwwdy780rvwhobx8qoy4bnk">https://lists.apache.org/thread/phx76cgtmhwwdy780rvwhobx8qoy4bnk</a></li>
</ul>
-<h3 id="credits-186">Credits</h3>
+<h3 id="credits-191">Credits</h3>
<ul>
<li>The Apache Airflow PMC would like to thank both Bogdan Kurinnoy of the Samsung R&D Institute Ukraine (SRK) and Ali Al-Habsi of Accellion for independently discovering and reporting this issue.</li>
</ul>
<h2 id="CVE-2021-38540">Apache Airflow: Variable Import endpoint missed authentication check</h2>
<p>CVE-2021-38540 <a href="https://cve.org/CVERecord?id=CVE-2021-38540">[CVE]</a> <a href="./CVE-2021-38540.cve.json">[CVE json]</a> <a href="./CVE-2021-38540.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2021-09-09T14:59:44.637Z</em></p>
-<h3 id="affected-191">Affected</h3>
+<h3 id="affected-196">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow before 2.1.3</li>
</ul>
-<h3 id="description-191">Description</h3>
+<h3 id="description-196">Description</h3>
<p>The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially
resulting in a denial of service, information disclosure or remote code execution.</p>
<p>This issue affects Apache Airflow >=2.0.0, <2.1.3.</p>
-<h3 id="references-191">References</h3>
+<h3 id="references-196">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/rb34c3dd1a815456355217eef34060789f771b6f77c3a3dec77de2064%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/rb34c3dd1a815456355217eef34060789f771b6f77c3a3dec77de2064%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
-<h3 id="credits-187">Credits</h3>
+<h3 id="credits-192">Credits</h3>
<ul>
<li>Apache Airflow would like to thank Nathan Jones, National Australia Bank’s Offensive Security Team</li>
</ul>
<h2 id="CVE-2021-35936">No Authentication on Logging Server</h2>
<p>CVE-2021-35936 <a href="https://cve.org/CVERecord?id=CVE-2021-35936">[CVE]</a> <a href="./CVE-2021-35936.cve.json">[CVE json]</a> <a href="./CVE-2021-35936.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2021-08-16T07:22:38.757Z</em></p>
-<h3 id="affected-192">Affected</h3>
+<h3 id="affected-197">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow before 2.1.2</li>
</ul>
-<h3 id="description-192">Description</h3>
+<h3 id="description-197">Description</h3>
<p>If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default.
This logging server had no authentication and allows reading log files of DAG jobs.</p>
<p>This issue affects Apache Airflow < 2.1.2.</p>
-<h3 id="references-192">References</h3>
+<h3 id="references-197">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/r53d6bd7b0a66f92ddaf1313282f10fec802e71246606dd30c16536df%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/r53d6bd7b0a66f92ddaf1313282f10fec802e71246606dd30c16536df%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
-<h3 id="credits-188">Credits</h3>
+<h3 id="credits-193">Credits</h3>
<ul>
<li>Apache Airflow would like to thank Dolev Farhi for reporting this issue.</li>
</ul>
<h2 id="CVE-2021-28359">Apache Airflow Reflected XSS via Origin Query Argument in URL</h2>
<p>CVE-2021-28359 <a href="https://cve.org/CVERecord?id=CVE-2021-28359">[CVE]</a> <a href="./CVE-2021-28359.cve.json">[CVE json]</a> <a href="./CVE-2021-28359.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2021-05-02T07:52:16.051Z</em></p>
-<h3 id="affected-193">Affected</h3>
+<h3 id="affected-198">Affected</h3>
<ul>
<li>Apache Airflow at 2.0.0</li>
<li>Apache Airflow at 2.0.1</li>
<li>Apache Airflow from Apache Airflow before 1.10.15</li>
</ul>
-<h3 id="description-193">Description</h3>
+<h3 id="description-198">Description</h3>
<p>The “origin” parameter passed to some of the endpoints like ‘/trigger’ was vulnerable to XSS exploit. This issue affects Apache Airflow versions <1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series.</p>
<p>This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fix the issue completely. Update to Airflow 1.10.15 or 2.0.2.</p>
<p>Please also update your Python version to the latest available PATCH releases of the installed MINOR versions, example update to Python 3.6.13 if you are on Python 3.6. (Those contain the fix for CVE-2021-23336 <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-23336)">https://nvd.nist.gov/vuln/detail/CVE-2021-23336)</a>.</p>
-<h3 id="references-193">References</h3>
+<h3 id="references-198">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
-<h3 id="credits-189">Credits</h3>
+<h3 id="credits-194">Credits</h3>
<ul>
<li>Vasileios Daskalakis</li>
</ul>
<h2 id="CVE-2021-26697">Apache Airflow: Lineage API endpoint for Experimental API missed authentication check</h2>
<p>CVE-2021-26697 <a href="https://cve.org/CVERecord?id=CVE-2021-26697">[CVE]</a> <a href="./CVE-2021-26697.cve.json">[CVE json]</a> <a href="./CVE-2021-26697.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2021-02-17T14:10:43.736Z</em></p>
-<h3 id="affected-194">Affected</h3>
+<h3 id="affected-199">Affected</h3>
<ul>
<li>Apache Airflow at 2.0.0</li>
</ul>
-<h3 id="description-194">Description</h3>
+<h3 id="description-199">Description</h3>
<p>The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint.</p>
<p>This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task.</p>
<p>This issue affects Apache Airflow 2.0.0.</p>
-<h3 id="references-194">References</h3>
+<h3 id="references-199">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/re21fec81baea7a6d73b0b5d31efd07cc02c61f832e297f65bb19b519%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/re21fec81baea7a6d73b0b5d31efd07cc02c61f832e297f65bb19b519%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
-<h3 id="credits-190">Credits</h3>
+<h3 id="credits-195">Credits</h3>
<ul>
<li>Apache Airflow would like to thank Ian Carroll for reporting this issue.</li>
</ul>
<h2 id="CVE-2021-26559">CWE-284 Improper Access Control on Configurations Endpoint for the Stable API</h2>
<p>CVE-2021-26559 <a href="https://cve.org/CVERecord?id=CVE-2021-26559">[CVE]</a> <a href="./CVE-2021-26559.cve.json">[CVE json]</a> <a href="./CVE-2021-26559.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2021-02-17T13:18:02.283Z</em></p>
-<h3 id="affected-195">Affected</h3>
+<h3 id="affected-200">Affected</h3>
<ul>
<li>Apache Airflow at 2.0.0</li>
</ul>
-<h3 id="description-195">Description</h3>
+<h3 id="description-200">Description</h3>
<p>Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when <code>[webserver] expose_config</code> is set to <code>False</code> in <code>airflow.cfg</code>.</p>
<p>This allowed a privilege escalation attack.</p>
<p>This issue affects Apache Airflow 2.0.0.</p>
-<h3 id="references-195">References</h3>
+<h3 id="references-200">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/r3b3787700279ec361308cbefb7c2cce2acb26891a12ce864e4a13c8d%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/r3b3787700279ec361308cbefb7c2cce2acb26891a12ce864e4a13c8d%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
-<h3 id="credits-191">Credits</h3>
+<h3 id="credits-196">Credits</h3>
<ul>
<li>Apache Airflow would like to thank Ian Carroll for reporting this issue.</li>
</ul>
<h2 id="CVE-2020-17526"></h2>
<p>CVE-2020-17526 <a href="https://cve.org/CVERecord?id=CVE-2020-17526">[CVE]</a> <a href="./CVE-2020-17526.cve.json">[CVE json]</a> <a href="./CVE-2020-17526.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2020-12-21T16:43:50.352Z</em></p>
-<h3 id="affected-196">Affected</h3>
+<h3 id="affected-201">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow before 1.10.14</li>
</ul>
-<h3 id="description-196">Description</h3>
+<h3 id="description-201">Description</h3>
<p>Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for <code>[webserver] secret_key</code> config.</p>
-<h3 id="references-196">References</h3>
+<h3 id="references-201">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/rbeeb73a6c741f2f9200d83b9c2220610da314810c4e8c9cf881d47ef%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/rbeeb73a6c741f2f9200d83b9c2220610da314810c4e8c9cf881d47ef%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
-<h3 id="credits-192">Credits</h3>
+<h3 id="credits-197">Credits</h3>
<ul>
<li>Junghan Lee of Deliveryhero Korea Security Team</li>
</ul>
<h2 id="CVE-2020-17515"></h2>
<p>CVE-2020-17515 <a href="https://cve.org/CVERecord?id=CVE-2020-17515">[CVE]</a> <a href="./CVE-2020-17515.cve.json">[CVE json]</a> <a href="./CVE-2020-17515.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2020-12-11T13:35:28.574Z</em></p>
-<h3 id="affected-197">Affected</h3>
+<h3 id="affected-202">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow before 1.10.13</li>
</ul>
-<h3 id="description-197">Description</h3>
+<h3 id="description-202">Description</h3>
<p>The “origin” parameter passed to some of the endpoints like ‘/trigger’ was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13.</p>
<p>This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.</p>
-<h3 id="references-197">References</h3>
+<h3 id="references-202">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/r4656959c8ed06c1f6202d89aa4e67b35ad7bdba5a666caff3fea888e%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/r4656959c8ed06c1f6202d89aa4e67b35ad7bdba5a666caff3fea888e%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
-<h3 id="credits-193">Credits</h3>
+<h3 id="credits-198">Credits</h3>
<ul>
<li>Ali Abdulwahab Ali Al-habsi of Accellion</li>
</ul>
<h2 id="CVE-2020-17513"></h2>
<p>CVE-2020-17513 <a href="https://cve.org/CVERecord?id=CVE-2020-17513">[CVE]</a> <a href="./CVE-2020-17513.cve.json">[CVE json]</a> <a href="./CVE-2020-17513.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2020-12-14T09:36:02.746Z</em></p>
-<h3 id="affected-198">Affected</h3>
+<h3 id="affected-203">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow before 1.10.13</li>
</ul>
-<h3 id="description-198">Description</h3>
+<h3 id="description-203">Description</h3>
<p>In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack.</p>
-<h3 id="references-198">References</h3>
+<h3 id="references-203">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/rb3647269f07cc2775ca6568cbfd4994d862c842a58120d2aba9c658a%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/rb3647269f07cc2775ca6568cbfd4994d862c842a58120d2aba9c658a%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
<h2 id="CVE-2020-17511"></h2>
<p>CVE-2020-17511 <a href="https://cve.org/CVERecord?id=CVE-2020-17511">[CVE]</a> <a href="./CVE-2020-17511.cve.json">[CVE json]</a> <a href="./CVE-2020-17511.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2020-12-14T09:35:45.373Z</em></p>
-<h3 id="affected-199">Affected</h3>
+<h3 id="affected-204">Affected</h3>
<ul>
<li>Apache Airflow from Apache Airflow before 1.10.13</li>
</ul>
-<h3 id="description-199">Description</h3>
+<h3 id="description-204">Description</h3>
<p>In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. Same happened when creating a Connection with a password field.</p>
-<h3 id="references-199">References</h3>
+<h3 id="references-204">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/ree782a29d927b96bf0b39fb92e2f1f09ea3112a985f7a08ce93765ac%40%3Cusers.airflow.apache.org%3E">https://lists.apache.org/thread.html/ree782a29d927b96bf0b39fb92e2f1f09ea3112a985f7a08ce93765ac%40%3Cusers.airflow.apache.org%3E</a></li>
</ul>
-<h3 id="credits-194">Credits</h3>
+<h3 id="credits-199">Credits</h3>
<ul>
<li>Ali Al-Habsi of Accellion</li>
</ul>
diff --git a/projects/dolphinscheduler/CVE-2026-57590.cve.json b/projects/dolphinscheduler/CVE-2026-57590.cve.json
new file mode 100644
index 00000000..ed5ea09e
--- /dev/null
+++ b/projects/dolphinscheduler/CVE-2026-57590.cve.json
@@ -0,0 +1,116 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-863 Incorrect Authorization",
+ "lang": "en",
+ "cweId": "CWE-863",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache DolphinScheduler",
+ "packageURL": "pkg:maven/org.apache.dolphinscheduler/dolphinscheduler-api",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "3.4.3",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group.\n\n\n\nThis issue affects Apache DolphinScheduler: before 3.4.3.\n\n\n\nUsers are recommended to upgrade to version 3.4.3, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group.</p><p>This issue affects Apache DolphinScheduler: before 3.4.3.</p><p>Users are recommended to upgrade to version 3.4.3, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/3ncvptkjw9h6s8mjxlwwo30bxxgol6ry",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Meng Qingwei",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Th\u00e0nh Nguy\u1ec5n",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Yeonoh Park",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "tonghuaroot",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "George Chen",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-57590",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/dolphinscheduler/CVE-2026-57590.osv.json b/projects/dolphinscheduler/CVE-2026-57590.osv.json
new file mode 100644
index 00000000..4f377b74
--- /dev/null
+++ b/projects/dolphinscheduler/CVE-2026-57590.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-57590", "summary": "Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations", "details": "A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group.\n\n\n\nThis issue affects Apache DolphinScheduler: before 3.4.3.\n\n\n\nUsers are re [...]
\ No newline at end of file
diff --git a/projects/dolphinscheduler/CVE-2026-66083.cve.json b/projects/dolphinscheduler/CVE-2026-66083.cve.json
new file mode 100644
index 00000000..1ff83b86
--- /dev/null
+++ b/projects/dolphinscheduler/CVE-2026-66083.cve.json
@@ -0,0 +1,121 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-306 Missing authentication for critical function",
+ "lang": "en",
+ "cweId": "CWE-306",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache DolphinScheduler",
+ "packageURL": "pkg:maven/org.apache.dolphinscheduler/dolphinscheduler-api",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "3.4.3",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata, depending on the fields returned by the endpoint.\n\n\n\nThis issue affects Apache DolphinScheduler: before 3.4.3.\n\n\n\nUsers are recommended to upgrade to version 3.4.3, which f [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>The <code>/datasources/unauth-datasource</code> endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata, depending on the fields returned by the endpoint.</p><p>This issue affects Apache DolphinScheduler: before 3.4.3.</p><p>Users are recommended to upgrade to vers [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/b6brfom0jmy9kdt40qrn6dq0x4v2wxdr",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "n0mi1k",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "meifukun",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Mingsheng Lin",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Th\u00e0nh Nguy\u1ec5n",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Raphael Zanarelli",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "geo-chen",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-66083",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/dolphinscheduler/CVE-2026-66083.osv.json b/projects/dolphinscheduler/CVE-2026-66083.osv.json
new file mode 100644
index 00000000..b3cd7bdf
--- /dev/null
+++ b/projects/dolphinscheduler/CVE-2026-66083.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-66083", "summary": "Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource", "details": "The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata, depending on the fields returned by [...]
\ No newline at end of file
diff --git a/projects/dolphinscheduler/CVE-2026-71897.cve.json b/projects/dolphinscheduler/CVE-2026-71897.cve.json
new file mode 100644
index 00000000..db35b590
--- /dev/null
+++ b/projects/dolphinscheduler/CVE-2026-71897.cve.json
@@ -0,0 +1,101 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Allows unauthorized workflow operations through batch-copy and batch-move endpoints",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-863 Incorrect Authorization",
+ "lang": "en",
+ "cweId": "CWE-863",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache DolphinScheduler",
+ "packageURL": "pkg:maven/org.apache.dolphinscheduler/dolphinscheduler-api",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "3.4.3",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects.\n\n\n\nThis issue affects Apache DolphinScheduler: before 3.4.3.\n\n\n\nUsers are recommended to upgrade to version 3.4.3, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects.</p><p>This issue affects Apache DolphinScheduler: before 3.4.3.</p><p>Users are recommended to upgrade to version 3.4.3, which fixes the issue.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread.html/ksnowtbpd9t4mbtvvq2c9777j42784dv",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "n0mi1k",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "Yeonoh Park",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-71897",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/dolphinscheduler/CVE-2026-71897.osv.json b/projects/dolphinscheduler/CVE-2026-71897.osv.json
new file mode 100644
index 00000000..35fe411d
--- /dev/null
+++ b/projects/dolphinscheduler/CVE-2026-71897.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-71897", "summary": "Allows unauthorized workflow operations through batch-copy and batch-move endpoints", "details": "An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects.\n\n\n\nThis issue affects Apache Do [...]
\ No newline at end of file
diff --git a/projects/dolphinscheduler/CVE-2026-71898.cve.json b/projects/dolphinscheduler/CVE-2026-71898.cve.json
new file mode 100644
index 00000000..fdf5e39c
--- /dev/null
+++ b/projects/dolphinscheduler/CVE-2026-71898.cve.json
@@ -0,0 +1,96 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-863 Incorrect Authorization",
+ "lang": "en",
+ "cweId": "CWE-863",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache DolphinScheduler",
+ "packageURL": "pkg:maven/org.apache.dolphinscheduler/dolphinscheduler-api",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "3.4.3",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/{projectCode}/workflow-instances/{id} endpoint. The endpoint does not enforce the write permission required for this operation, allowing the user to make unauthorized changes to workflow instances.\n\n\n\nThis issue affects Apache DolphinScheduler: before 3.4.3.\n\n\n\nU [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the <code>PUT /projects/{projectCode}/workflow-instances/{id}</code> endpoint. The endpoint does not enforce the write permission required for this operation, allowing the user to make unauthorized changes to workflow instances.</p><p>This issue affects Apache DolphinScheduler: bef [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/lt35p8xc1w7ovgq68g4zz1c8vnk5ow6o",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Dipak Panchal",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-71898",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/dolphinscheduler/CVE-2026-71898.osv.json b/projects/dolphinscheduler/CVE-2026-71898.osv.json
new file mode 100644
index 00000000..a932d7d4
--- /dev/null
+++ b/projects/dolphinscheduler/CVE-2026-71898.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-71898", "summary": "Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions", "details": "An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/{projectCode}/workflow-instances/{id} endpoint. The endpoint does not enforce the write permission re [...]
\ No newline at end of file
diff --git a/projects/dolphinscheduler/CVE-2026-71899.cve.json b/projects/dolphinscheduler/CVE-2026-71899.cve.json
new file mode 100644
index 00000000..81893dfb
--- /dev/null
+++ b/projects/dolphinscheduler/CVE-2026-71899.cve.json
@@ -0,0 +1,101 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-863 Incorrect Authorization",
+ "lang": "en",
+ "cweId": "CWE-863",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache DolphinScheduler",
+ "packageURL": "pkg:maven/org.apache.dolphinscheduler/dolphinscheduler-api",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "3.2.0",
+ "lessThan": "3.4.3",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "A missing authorization vulnerability exists in the `query-dynamic-sub-workflows` API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried.\n\n\n\nAn authenticated user who does not have permission to access a specific project can invoke the API with parameters referencing workflows belonging to that project and retrieve workflow information. This allows users to access workflo [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>A missing authorization vulnerability exists in the <code>`query-dynamic-sub-workflows`</code> API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried.</p><p>An authenticated user who does not have permission to access a specific project can invoke the API with parameters referencing workflows belonging to that project and retrieve workflow information. This allows user [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread.html/qcork1j6q52xsp419vgb5dsstp9mxk09",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "yansong",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "MopMonk AI",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-71899",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/dolphinscheduler/CVE-2026-71899.osv.json b/projects/dolphinscheduler/CVE-2026-71899.osv.json
new file mode 100644
index 00000000..be0b9a94
--- /dev/null
+++ b/projects/dolphinscheduler/CVE-2026-71899.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-71899", "summary": "Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure", "details": "A missing authorization vulnerability exists in the `query-dynamic-sub-workflows` API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried.\n\n\n\nAn authenticated user who does not have permission to access a specific project can in [...]
\ No newline at end of file
diff --git a/projects/dolphinscheduler/CVE-2026-78214.cve.json b/projects/dolphinscheduler/CVE-2026-78214.cve.json
new file mode 100644
index 00000000..275b531e
--- /dev/null
+++ b/projects/dolphinscheduler/CVE-2026-78214.cve.json
@@ -0,0 +1,96 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Actuator Endpoint Authentication Bypass via Percent-Encoded Paths",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-863 Incorrect Authorization",
+ "lang": "en",
+ "cweId": "CWE-863",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache DolphinScheduler",
+ "packageURL": "pkg:maven/org.apache.dolphinscheduler/dolphinscheduler-api",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "3.4.3",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a remote unauthenticated attacker can cause the security check to fail to recognize the request as targeting a protected endpoint.\n\n\n\nAs a result, the attacker may bypass au [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a remote unauthenticated attacker can cause the security check to fail to recognize the request as targeting a protected endpoint.</p><p>As a result, the attacker may byp [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread.html/88g4v2sjd9j2xgn64gnm7k4ocnj4rlob",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Xmirror Security Team",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-78214",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/dolphinscheduler/CVE-2026-78214.osv.json b/projects/dolphinscheduler/CVE-2026-78214.osv.json
new file mode 100644
index 00000000..31ccee0a
--- /dev/null
+++ b/projects/dolphinscheduler/CVE-2026-78214.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-78214", "summary": "Actuator Endpoint Authentication Bypass via Percent-Encoded Paths", "details": "An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a remote unauthenticated attacker can cause the secur [...]
\ No newline at end of file
diff --git a/projects/dolphinscheduler/CVE-2026-81569.cve.json b/projects/dolphinscheduler/CVE-2026-81569.cve.json
new file mode 100644
index 00000000..a0439746
--- /dev/null
+++ b/projects/dolphinscheduler/CVE-2026-81569.cve.json
@@ -0,0 +1,87 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution",
+ "source": {
+ "defect": [
+ "CWE-863 Incorrect Authorization"
+ ],
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache DolphinScheduler",
+ "packageURL": "pkg:maven/org.apache.dolphinscheduler/dolphinscheduler-api",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "3.4.3",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task.\n\n\n\nThe system does not properly verify whether the user has permission to execute the referenced workflow or access its project. As a result, the user can bypass project-level authorization controls and cause work [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task.</p><p>The system does not properly verify whether the user has permission to execute the referenced workflow or access its project. As a result, the user can bypass project-level authorization controls and caus [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread.html/2dlzoz0vd5onovxxmylmgb2lvrsj0ot6",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Meng Qingwei",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-81569",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/dolphinscheduler/CVE-2026-81569.osv.json b/projects/dolphinscheduler/CVE-2026-81569.osv.json
new file mode 100644
index 00000000..f7f4f548
--- /dev/null
+++ b/projects/dolphinscheduler/CVE-2026-81569.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-81569", "summary": "Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution", "details": "An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task.\n\n\n\nThe system does not properly verify whether the user has permission [...]
\ No newline at end of file
diff --git a/projects/dolphinscheduler/CVE-2026-82804.cve.json b/projects/dolphinscheduler/CVE-2026-82804.cve.json
new file mode 100644
index 00000000..79aef01e
--- /dev/null
+++ b/projects/dolphinscheduler/CVE-2026-82804.cve.json
@@ -0,0 +1,96 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Command Injection in the Alert Script Plugin",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')",
+ "lang": "en",
+ "cweId": "CWE-78",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache DolphinScheduler",
+ "packageURL": "pkg:maven/org.apache.dolphinscheduler/dolphinscheduler-api",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "3.4.3",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution.\n\nAn authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitution syntax, such as $(...), and subsequently supplying the resulting path to the Alert Script plugin's /test-send endpoint. When the alert script is executed, the shell inter [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution.<br><br>An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitution syntax, such as $(...), and subsequently supplying the resulting path to the Alert Script plugin's /test-send endpoint. When the alert script is executed, the [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread.html/mwzbs5qdhs7nblfz70jgs0z54qx3phql",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "low"
+ }
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "youyi.mr",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-82804",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/dolphinscheduler/CVE-2026-82804.osv.json b/projects/dolphinscheduler/CVE-2026-82804.osv.json
new file mode 100644
index 00000000..600adc1e
--- /dev/null
+++ b/projects/dolphinscheduler/CVE-2026-82804.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-82804", "summary": "Command Injection in the Alert Script Plugin", "details": "The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution.\n\nAn authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitution syntax, such as $(...), and subsequently supplying the resulting pa [...]
\ No newline at end of file
diff --git a/projects/dolphinscheduler/index.html b/projects/dolphinscheduler/index.html
index 86fdfd50..963a3629 100644
--- a/projects/dolphinscheduler/index.html
+++ b/projects/dolphinscheduler/index.html
@@ -109,37 +109,184 @@
</ul>
<h1 id="advisories">Advisories</h1>
<p class="bg-warning">This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the project security page linked above. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public <a href="/mailinglist">mailinglist</a> or privately on <a href="mailto:security@apache.org">security@apache.org</a></p>
+<h2 id="CVE-2026-82804">Command Injection in the Alert Script Plugin</h2>
+<p>CVE-2026-82804 <a href="https://cve.org/CVERecord?id=CVE-2026-82804">[CVE]</a> <a href="./CVE-2026-82804.cve.json">[CVE json]</a> <a href="./CVE-2026-82804.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-29T13:01:10.479Z</em></p>
+<h3 id="affected">Affected</h3>
+<ul>
+<li>Apache DolphinScheduler before 3.4.3</li>
+</ul>
+<h3 id="description">Description</h3>
+<p>The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution.<br><br>An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitution syntax, such as $(...), and subsequently supplying the resulting path to the Alert Script plugin's /test-send endpoint. When the alert script is executed, the shell interprets the inj [...]
+<h3 id="references">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread.html/mwzbs5qdhs7nblfz70jgs0z54qx3phql">https://lists.apache.org/thread.html/mwzbs5qdhs7nblfz70jgs0z54qx3phql</a></li>
+</ul>
+<h3 id="credits">Credits</h3>
+<ul>
+<li>youyi.mr (finder)</li>
+</ul>
+<h2 id="CVE-2026-81569">Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution</h2>
+<p>CVE-2026-81569 <a href="https://cve.org/CVERecord?id=CVE-2026-81569">[CVE]</a> <a href="./CVE-2026-81569.cve.json">[CVE json]</a> <a href="./CVE-2026-81569.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-29T13:05:15.070Z</em></p>
+<h3 id="affected-1">Affected</h3>
+<ul>
+<li>Apache DolphinScheduler before 3.4.3</li>
+</ul>
+<h3 id="description-1">Description</h3>
+<p>An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task.</p><p>The system does not properly verify whether the user has permission to execute the referenced workflow or access its project. As a result, the user can bypass project-level authorization controls and cause workflows in unauthori [...]
+<h3 id="references-1">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread.html/2dlzoz0vd5onovxxmylmgb2lvrsj0ot6">https://lists.apache.org/thread.html/2dlzoz0vd5onovxxmylmgb2lvrsj0ot6</a></li>
+</ul>
+<h3 id="credits-1">Credits</h3>
+<ul>
+<li>Meng Qingwei (finder)</li>
+</ul>
+<h2 id="CVE-2026-78214">Actuator Endpoint Authentication Bypass via Percent-Encoded Paths</h2>
+<p>CVE-2026-78214 <a href="https://cve.org/CVERecord?id=CVE-2026-78214">[CVE]</a> <a href="./CVE-2026-78214.cve.json">[CVE json]</a> <a href="./CVE-2026-78214.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-29T13:07:19.825Z</em></p>
+<h3 id="affected-2">Affected</h3>
+<ul>
+<li>Apache DolphinScheduler before 3.4.3</li>
+</ul>
+<h3 id="description-2">Description</h3>
+<p>An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a remote unauthenticated attacker can cause the security check to fail to recognize the request as targeting a protected endpoint.</p><p>As a result, the attacker may bypass authentication and a [...]
+<h3 id="references-2">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread.html/88g4v2sjd9j2xgn64gnm7k4ocnj4rlob">https://lists.apache.org/thread.html/88g4v2sjd9j2xgn64gnm7k4ocnj4rlob</a></li>
+</ul>
+<h3 id="credits-2">Credits</h3>
+<ul>
+<li>Xmirror Security Team (finder)</li>
+</ul>
+<h2 id="CVE-2026-71899">Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure</h2>
+<p>CVE-2026-71899 <a href="https://cve.org/CVERecord?id=CVE-2026-71899">[CVE]</a> <a href="./CVE-2026-71899.cve.json">[CVE json]</a> <a href="./CVE-2026-71899.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-29T13:09:23.453Z</em></p>
+<h3 id="affected-3">Affected</h3>
+<ul>
+<li>Apache DolphinScheduler from 3.2.0 before 3.4.3</li>
+</ul>
+<h3 id="description-3">Description</h3>
+<p>A missing authorization vulnerability exists in the <code>`query-dynamic-sub-workflows`</code> API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried.</p><p>An authenticated user who does not have permission to access a specific project can invoke the API with parameters referencing workflows belonging to that project and retrieve workflow information. This allows users to access workflow dat [...]
+<h3 id="references-3">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread.html/qcork1j6q52xsp419vgb5dsstp9mxk09">https://lists.apache.org/thread.html/qcork1j6q52xsp419vgb5dsstp9mxk09</a></li>
+</ul>
+<h3 id="credits-3">Credits</h3>
+<ul>
+<li>yansong (finder)</li>
+<li>MopMonk AI (finder)</li>
+</ul>
+<h2 id="CVE-2026-71898">Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions</h2>
+<p>CVE-2026-71898 <a href="https://cve.org/CVERecord?id=CVE-2026-71898">[CVE]</a> <a href="./CVE-2026-71898.cve.json">[CVE json]</a> <a href="./CVE-2026-71898.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-29T13:11:09.954Z</em></p>
+<h3 id="affected-4">Affected</h3>
+<ul>
+<li>Apache DolphinScheduler before 3.4.3</li>
+</ul>
+<h3 id="description-4">Description</h3>
+<p>An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the <code>PUT /projects/{projectCode}/workflow-instances/{id}</code> endpoint. The endpoint does not enforce the write permission required for this operation, allowing the user to make unauthorized changes to workflow instances.</p><p>This issue affects Apache DolphinScheduler: before 3.4.3.</p><p>Users a [...]
+<h3 id="references-4">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/lt35p8xc1w7ovgq68g4zz1c8vnk5ow6o">https://lists.apache.org/thread/lt35p8xc1w7ovgq68g4zz1c8vnk5ow6o</a></li>
+</ul>
+<h3 id="credits-4">Credits</h3>
+<ul>
+<li>Dipak Panchal (finder)</li>
+</ul>
+<h2 id="CVE-2026-71897">Allows unauthorized workflow operations through batch-copy and batch-move endpoints</h2>
+<p>CVE-2026-71897 <a href="https://cve.org/CVERecord?id=CVE-2026-71897">[CVE]</a> <a href="./CVE-2026-71897.cve.json">[CVE json]</a> <a href="./CVE-2026-71897.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-29T13:14:01.224Z</em></p>
+<h3 id="affected-5">Affected</h3>
+<ul>
+<li>Apache DolphinScheduler before 3.4.3</li>
+</ul>
+<h3 id="description-5">Description</h3>
+<p>An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects.</p><p>This issue affects Apache DolphinScheduler: before 3.4.3.</p><p>Users are recommended to upgrade to version 3.4.3, which fixes the issue.</p>
+<h3 id="references-5">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread.html/ksnowtbpd9t4mbtvvq2c9777j42784dv">https://lists.apache.org/thread.html/ksnowtbpd9t4mbtvvq2c9777j42784dv</a></li>
+</ul>
+<h3 id="credits-5">Credits</h3>
+<ul>
+<li>n0mi1k (finder)</li>
+<li>Yeonoh Park (finder)</li>
+</ul>
+<h2 id="CVE-2026-66083">Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource</h2>
+<p>CVE-2026-66083 <a href="https://cve.org/CVERecord?id=CVE-2026-66083">[CVE]</a> <a href="./CVE-2026-66083.cve.json">[CVE json]</a> <a href="./CVE-2026-66083.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-29T11:46:39.338Z</em></p>
+<h3 id="affected-6">Affected</h3>
+<ul>
+<li>Apache DolphinScheduler before 3.4.3</li>
+</ul>
+<h3 id="description-6">Description</h3>
+<p>The <code>/datasources/unauth-datasource</code> endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata, depending on the fields returned by the endpoint.</p><p>This issue affects Apache DolphinScheduler: before 3.4.3.</p><p>Users are recommended to upgrade to version 3.4.3, which fixes t [...]
+<h3 id="references-6">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/b6brfom0jmy9kdt40qrn6dq0x4v2wxdr">https://lists.apache.org/thread/b6brfom0jmy9kdt40qrn6dq0x4v2wxdr</a></li>
+</ul>
+<h3 id="credits-6">Credits</h3>
+<ul>
+<li>n0mi1k (finder)</li>
+<li>meifukun (finder)</li>
+<li>Mingsheng Lin (finder)</li>
+<li>Thành Nguyễn (finder)</li>
+<li>Raphael Zanarelli (finder)</li>
+<li>geo-chen (finder)</li>
+</ul>
+<h2 id="CVE-2026-57590">Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations</h2>
+<p>CVE-2026-57590 <a href="https://cve.org/CVERecord?id=CVE-2026-57590">[CVE]</a> <a href="./CVE-2026-57590.cve.json">[CVE json]</a> <a href="./CVE-2026-57590.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-24T09:13:44.464Z</em></p>
+<h3 id="affected-7">Affected</h3>
+<ul>
+<li>Apache DolphinScheduler before 3.4.3</li>
+</ul>
+<h3 id="description-7">Description</h3>
+<p>A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group.</p><p>This issue affects Apache DolphinScheduler: before 3.4.3.</p><p>Users are recommended to upgrade to version 3.4.3, which fixes the issue.</p>
+<h3 id="references-7">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/3ncvptkjw9h6s8mjxlwwo30bxxgol6ry">https://lists.apache.org/thread/3ncvptkjw9h6s8mjxlwwo30bxxgol6ry</a></li>
+</ul>
+<h3 id="credits-7">Credits</h3>
+<ul>
+<li>Meng Qingwei (finder)</li>
+<li>Thành Nguyễn (finder)</li>
+<li>Yeonoh Park (finder)</li>
+<li>tonghuaroot (finder)</li>
+<li>George Chen (finder)</li>
+</ul>
<h2 id="CVE-2026-49050">General user can mint admin access tokens via /access-tokens</h2>
<p>CVE-2026-49050 <a href="https://cve.org/CVERecord?id=CVE-2026-49050">[CVE]</a> <a href="./CVE-2026-49050.cve.json">[CVE json]</a> <a href="./CVE-2026-49050.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-25T06:32:16.645Z</em></p>
-<h3 id="affected">Affected</h3>
+<h3 id="affected-8">Affected</h3>
<ul>
<li>Apache DolphinScheduler before 3.4.2</li>
</ul>
-<h3 id="description">Description</h3>
+<h3 id="description-8">Description</h3>
<p>General user can mint admin access tokens via /access-tokens</p><p>This issue affects Apache DolphinScheduler: before 3.4.2.</p><p>Users are recommended to upgrade to version 3.4.2, which fixes the issue.</p>
-<h3 id="references">References</h3>
+<h3 id="references-8">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/0lc4t5k6h6nhd8t4hshgjk6yp3cl8sb0">https://lists.apache.org/thread/0lc4t5k6h6nhd8t4hshgjk6yp3cl8sb0</a></li>
</ul>
-<h3 id="credits">Credits</h3>
+<h3 id="credits-8">Credits</h3>
<ul>
<li>George Chen(<a href="https://github.com/geo-chen">https://github.com/geo-chen</a>) (finder)</li>
</ul>
<h2 id="CVE-2026-47340">An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access.</h2>
<p>CVE-2026-47340 <a href="https://cve.org/CVERecord?id=CVE-2026-47340">[CVE]</a> <a href="./CVE-2026-47340.cve.json">[CVE json]</a> <a href="./CVE-2026-47340.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-17T01:44:26.990Z</em></p>
-<h3 id="affected-1">Affected</h3>
+<h3 id="affected-9">Affected</h3>
<ul>
<li>Apache DolphinScheduler before 3.4.2</li>
</ul>
-<h3 id="description-1">Description</h3>
+<h3 id="description-9">Description</h3>
<p>Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler.</p><p>This issue affects Apache DolphinScheduler: before 3.4.2.</p><p>Users are recommended to upgrade to version 3.4.2, which fixes the issue.</p>
-<h3 id="references-1">References</h3>
+<h3 id="references-9">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/gx6v1wjb6qg3fzksxomysspy2gw54ooc">https://lists.apache.org/thread/gx6v1wjb6qg3fzksxomysspy2gw54ooc</a></li>
</ul>
-<h3 id="credits-1">Credits</h3>
+<h3 id="credits-9">Credits</h3>
<ul>
<li><a href="mailto:thesecguy45@gmail.com">thesecguy45@gmail.com</a> (finder)</li>
<li>udolemi (S2W) (finder)</li>
@@ -147,51 +294,51 @@
<h2 id="CVE-2026-42357">Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.</h2>
<p>CVE-2026-42357 <a href="https://cve.org/CVERecord?id=CVE-2026-42357">[CVE]</a> <a href="./CVE-2026-42357.cve.json">[CVE json]</a> <a href="./CVE-2026-42357.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-17T06:31:34.851Z</em></p>
-<h3 id="affected-2">Affected</h3>
+<h3 id="affected-10">Affected</h3>
<ul>
<li>Apache DolphinScheduler before 3.4.1</li>
</ul>
-<h3 id="description-2">Description</h3>
+<h3 id="description-10">Description</h3>
<p>Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.<br><br>This issue affects Apache DolphinScheduler versions prior to 3.4.2.<br></p><p>Users are recommended to upgrade to version 3.4.2, which fixes this issue.<br></p><br>
-<h3 id="references-2">References</h3>
+<h3 id="references-10">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/74l2rrz32w2chn7vz64313gk7ox5wjtr">https://lists.apache.org/thread/74l2rrz32w2chn7vz64313gk7ox5wjtr</a></li>
</ul>
-<h3 id="credits-2">Credits</h3>
+<h3 id="credits-10">Credits</h3>
<ul>
<li>Yicheng Yu(<a href="https://github.com/FHMTT">https://github.com/FHMTT</a>) (finder)</li>
</ul>
<h2 id="CVE-2026-41280">Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects</h2>
<p>CVE-2026-41280 <a href="https://cve.org/CVERecord?id=CVE-2026-41280">[CVE]</a> <a href="./CVE-2026-41280.cve.json">[CVE json]</a> <a href="./CVE-2026-41280.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-17T06:32:49.794Z</em></p>
-<h3 id="affected-3">Affected</h3>
+<h3 id="affected-11">Affected</h3>
<ul>
<li>Apache DolphinScheduler before 3.4.2</li>
</ul>
-<h3 id="description-3">Description</h3>
+<h3 id="description-11">Description</h3>
<p>Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects<br><br>This issue affects Apache DolphinScheduler versions prior to 3.4.2. </p><p>Users are recommended to upgrade to version 3.4.2, which fixes this issue.<br></p><br>
-<h3 id="references-3">References</h3>
+<h3 id="references-11">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/5bv1njp3lbbbj11y20td5yz1b4nmrtvw">https://lists.apache.org/thread/5bv1njp3lbbbj11y20td5yz1b4nmrtvw</a></li>
</ul>
-<h3 id="credits-3">Credits</h3>
+<h3 id="credits-11">Credits</h3>
<ul>
<li>Yicheng Yu(<a href="https://github.com/FHMTT">https://github.com/FHMTT</a>) (finder)</li>
</ul>
<h2 id="CVE-2026-32967">The <code>/v2</code> experimental interface lacks permission checks</h2>
<p>CVE-2026-32967 <a href="https://cve.org/CVERecord?id=CVE-2026-32967">[CVE]</a> <a href="./CVE-2026-32967.cve.json">[CVE json]</a> <a href="./CVE-2026-32967.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-21T08:22:51.583Z</em></p>
-<h3 id="affected-4">Affected</h3>
+<h3 id="affected-12">Affected</h3>
<ul>
<li>Apache DolphinScheduler before 3.4.2</li>
</ul>
-<h3 id="description-4">Description</h3>
+<h3 id="description-12">Description</h3>
<p>Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler.</p><p>This issue affects Apache DolphinScheduler: before 3.4.2.</p><p>Users are recommended to upgrade to version 3.4.2, which fixes the issue.</p>
-<h3 id="references-4">References</h3>
+<h3 id="references-12">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/5o5jrg1snkmrto96wg015wgbh7hyckzc">https://lists.apache.org/thread/5o5jrg1snkmrto96wg015wgbh7hyckzc</a></li>
</ul>
-<h3 id="credits-4">Credits</h3>
+<h3 id="credits-12">Credits</h3>
<ul>
<li>b0b0haha (<a href="mailto:603571786@qq.com">603571786@qq.com</a>) (finder)</li>
<li>j311yl0v3u (<a href="mailto:2439839508@qq.com">2439839508@qq.com</a>) (finder)</li>
@@ -199,17 +346,17 @@
<h2 id="CVE-2026-32966">DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure</h2>
<p>CVE-2026-32966 <a href="https://cve.org/CVERecord?id=CVE-2026-32966">[CVE]</a> <a href="./CVE-2026-32966.cve.json">[CVE json]</a> <a href="./CVE-2026-32966.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-17T08:48:15.528Z</em></p>
-<h3 id="affected-5">Affected</h3>
+<h3 id="affected-13">Affected</h3>
<ul>
<li>Apache DolphinScheduler before 3.4.2</li>
</ul>
-<h3 id="description-5">Description</h3>
+<h3 id="description-13">Description</h3>
<p>DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler.</p><p>This issue affects Apache DolphinScheduler: before 3.4.2.</p><p>Users are recommended to upgrade to version 3.4.2, which fixes the issue.</p>
-<h3 id="references-5">References</h3>
+<h3 id="references-13">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/4f1fojpj26z9y5nd1ko845gcknpn75g2">https://lists.apache.org/thread/4f1fojpj26z9y5nd1ko845gcknpn75g2</a></li>
</ul>
-<h3 id="credits-5">Credits</h3>
+<h3 id="credits-13">Credits</h3>
<ul>
<li>b0b0haha (<a href="mailto:603571786@qq.com">603571786@qq.com</a>) (finder)</li>
<li>j311yl0v3u (<a href="mailto:2439839508@qq.com">2439839508@qq.com</a>) (finder)</li>
@@ -217,45 +364,45 @@
<h2 id="CVE-2026-23902">Users are able to use tenants that are not defined on the platform during workflow execution.</h2>
<p>CVE-2026-23902 <a href="https://cve.org/CVERecord?id=CVE-2026-23902">[CVE]</a> <a href="./CVE-2026-23902.cve.json">[CVE json]</a> <a href="./CVE-2026-23902.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-24T10:56:16.919Z</em></p>
-<h3 id="affected-6">Affected</h3>
+<h3 id="affected-14">Affected</h3>
<ul>
<li>Apache DolphinScheduler before 3.4.1</li>
</ul>
-<h3 id="description-6">Description</h3>
+<h3 id="description-14">Description</h3>
<p>Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution.<br><br>This issue affects Apache DolphinScheduler versions prior to 3.4.1. </p><p>Users are recommended to upgrade to version 3.4.1, which fixes this issue.<br></p>
-<h3 id="references-6">References</h3>
+<h3 id="references-14">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/hy4ntb2gys8150zfmnxhsd5ph0hoh7s9">https://lists.apache.org/thread/hy4ntb2gys8150zfmnxhsd5ph0hoh7s9</a></li>
</ul>
-<h3 id="credits-6">Credits</h3>
+<h3 id="credits-14">Credits</h3>
<ul>
<li>Jihang Yu (reporter)</li>
</ul>
<h2 id="CVE-2025-62233">Deserialization of untrusted data in RPC</h2>
<p>CVE-2025-62233 <a href="https://cve.org/CVERecord?id=CVE-2025-62233">[CVE]</a> <a href="./CVE-2025-62233.cve.json">[CVE json]</a> <a href="./CVE-2025-62233.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-24T10:54:53.855Z</em></p>
-<h3 id="affected-7">Affected</h3>
+<h3 id="affected-15">Affected</h3>
<ul>
<li>Apache DolphinScheduler from 3.2.0 before 3.3.1</li>
</ul>
-<h3 id="description-7">Description</h3>
+<h3 id="description-15">Description</h3>
<p>Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module.</p><p>This issue affects Apache DolphinScheduler: </p><p>Version >= 3.2.0 and < 3.3.1.</p>Attackers who can access the Master or Worker nodes can compromise the system by creating a StandardRpcRequest, injecting a malicious class type into it, and sending RPC requests to the DolphinScheduler Master/Worker nodes.<br><p>Users are recommended to upgrade to version [3.3.1], which fixes the is [...]
-<h3 id="references-7">References</h3>
+<h3 id="references-15">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/79s80h51r4z5d4l2xs5xy364rmmo1bw0">https://lists.apache.org/thread/79s80h51r4z5d4l2xs5xy364rmmo1bw0</a></li>
</ul>
-<h3 id="credits-7">Credits</h3>
+<h3 id="credits-15">Credits</h3>
<ul>
<li>75Acol, fcgboy, ch0wn, zer0duck (finder)</li>
</ul>
<h2 id="CVE-2025-62188">Users can access sensitive information through the actuator endpoint.</h2>
<p>CVE-2025-62188 <a href="https://cve.org/CVERecord?id=CVE-2025-62188">[CVE]</a> <a href="./CVE-2025-62188.cve.json">[CVE json]</a> <a href="./CVE-2025-62188.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-08T09:09:06.393Z</em></p>
-<h3 id="affected-8">Affected</h3>
+<h3 id="affected-16">Affected</h3>
<ul>
<li>Apache DolphinScheduler from 3.1.0 before 3.2.0</li>
</ul>
-<h3 id="description-8">Description</h3>
+<h3 id="description-16">Description</h3>
<p>An <strong>Exposure of Sensitive Information to an Unauthorized Actor</strong> vulnerability exists in Apache DolphinScheduler.<br>
This vulnerability may allow unauthorized actors to access sensitive information, including database credentials.</p>
<p>This issue affects <strong>Apache DolphinScheduler versions 3.1.*</strong>.</p>
@@ -267,12 +414,12 @@ This vulnerability may allow unauthorized actors to access sensitive information
```<br>management:<br> endpoints:<br> web:<br> exposure:<br> include: health,metrics,prometheus<br>```<br>
<p>This issue has been reported as <strong>CVE-2023-48796</strong>:<br>
<a target="_blank" rel="nofollow" href="https://cveprocess.apache.org/cve5/CVE-2023-48796">https://cveprocess.apache.org/cve5/CVE-2023-48796</a></p><br>
-<h3 id="references-8">References</h3>
+<h3 id="references-16">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/ffrmkcwgr2lcz0f5nnnyswhpn3fytsvo">https://lists.apache.org/thread/ffrmkcwgr2lcz0f5nnnyswhpn3fytsvo</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2023-48796">https://www.cve.org/CVERecord?id=CVE-2023-48796</a></li>
</ul>
-<h3 id="credits-8">Credits</h3>
+<h3 id="credits-16">Credits</h3>
<ul>
<li>w aiyou (finder)</li>
<li>魏大创 (reporter)</li>
@@ -280,71 +427,71 @@ This vulnerability may allow unauthorized actors to access sensitive information
<h2 id="CVE-2024-43202">Remote Code Execution Vulnerability</h2>
<p>CVE-2024-43202 <a href="https://cve.org/CVERecord?id=CVE-2024-43202">[CVE]</a> <a href="./CVE-2024-43202.cve.json">[CVE json]</a> <a href="./CVE-2024-43202.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-08-20T07:29:41.648Z</em></p>
-<h3 id="affected-9">Affected</h3>
+<h3 id="affected-17">Affected</h3>
<ul>
<li>Apache DolphinScheduler from 3.0.0 before 3.2.2</li>
</ul>
-<h3 id="description-9">Description</h3>
+<h3 id="description-17">Description</h3>
<p>Exposure of Remote Code Execution in Apache Dolphinscheduler.<br><br>This issue affects Apache DolphinScheduler: before 3.2.2. <br><br>We recommend users to upgrade Apache DolphinScheduler to version 3.2.2, which fixes the issue.</p>
-<h3 id="references-9">References</h3>
+<h3 id="references-17">References</h3>
<ul>
<li><a href="https://github.com/apache/dolphinscheduler/pull/15758">https://github.com/apache/dolphinscheduler/pull/15758</a></li>
<li><a href="https://lists.apache.org/thread/nlmdp7q7l7o3l27778vxc5px24ncr5r5">https://lists.apache.org/thread/nlmdp7q7l7o3l27778vxc5px24ncr5r5</a></li>
<li><a href="https://lists.apache.org/thread/qbhk9wqyxhrn4z7m4m343wqxpwg926nh">https://lists.apache.org/thread/qbhk9wqyxhrn4z7m4m343wqxpwg926nh</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2023-49109">https://www.cve.org/CVERecord?id=CVE-2023-49109</a></li>
</ul>
-<h3 id="credits-9">Credits</h3>
+<h3 id="credits-17">Credits</h3>
<ul>
<li>an4er (reporter)</li>
</ul>
<h2 id="CVE-2024-43166">CWE-276 Incorrect Default Permissions</h2>
<p>CVE-2024-43166 <a href="https://cve.org/CVERecord?id=CVE-2024-43166">[CVE]</a> <a href="./CVE-2024-43166.cve.json">[CVE json]</a> <a href="./CVE-2024-43166.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-09-18T09:38:13.985Z</em></p>
-<h3 id="affected-10">Affected</h3>
+<h3 id="affected-18">Affected</h3>
<ul>
<li>Apache DolphinScheduler before 3.2.2</li>
</ul>
-<h3 id="description-10">Description</h3>
+<h3 id="description-18">Description</h3>
<p>Incorrect Default Permissions vulnerability in Apache DolphinScheduler.</p><p>This issue affects Apache DolphinScheduler: before 3.2.2.</p><p>Users are recommended to upgrade to version <span style="background-color: rgb(255, 255, 255);">3.3.1</span>, which fixes the issue.</p>
-<h3 id="references-10">References</h3>
+<h3 id="references-18">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/8zd69zkkx55qp365xp4tml1xh9og5lhk">https://lists.apache.org/thread/8zd69zkkx55qp365xp4tml1xh9og5lhk</a></li>
</ul>
-<h3 id="credits-10">Credits</h3>
+<h3 id="credits-18">Credits</h3>
<ul>
<li>L0ne1y (reporter)</li>
</ul>
<h2 id="CVE-2024-43115">Alert Script Attack</h2>
<p>CVE-2024-43115 <a href="https://cve.org/CVERecord?id=CVE-2024-43115">[CVE]</a> <a href="./CVE-2024-43115.cve.json">[CVE json]</a> <a href="./CVE-2024-43115.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-09-03T08:38:26.012Z</em></p>
-<h3 id="affected-11">Affected</h3>
+<h3 id="affected-19">Affected</h3>
<ul>
<li>Apache DolphinScheduler before 3.2.2</li>
</ul>
-<h3 id="description-11">Description</h3>
+<h3 id="description-19">Description</h3>
<div>Improper Input Validation vulnerability in Apache DolphinScheduler. An <span style="background-color: rgb(255, 255, 255);">authenticated user can execute any shell script server by alert script.</span><br></div><p>This issue affects Apache DolphinScheduler: before 3.2.2.</p><p>Users are recommended to upgrade to version <span style="background-color: rgb(255, 255, 255);">3.3.1</span>, which fixes the issue.</p><br>
-<h3 id="references-11">References</h3>
+<h3 id="references-19">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/qm36nrsv1vrr2j4o5q2wo75h3686hrnj">https://lists.apache.org/thread/qm36nrsv1vrr2j4o5q2wo75h3686hrnj</a></li>
</ul>
-<h3 id="credits-11">Credits</h3>
+<h3 id="credits-19">Credits</h3>
<ul>
<li>L0ne1y (reporter)</li>
</ul>
<h2 id="CVE-2024-30188">Resource File Read And Write Vulnerability</h2>
<p>CVE-2024-30188 <a href="https://cve.org/CVERecord?id=CVE-2024-30188">[CVE]</a> <a href="./CVE-2024-30188.cve.json">[CVE json]</a> <a href="./CVE-2024-30188.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-08-09T12:45:43.623Z</em></p>
-<h3 id="affected-12">Affected</h3>
+<h3 id="affected-20">Affected</h3>
<ul>
<li>Apache DolphinScheduler from 3.1.0 before 3.2.2</li>
</ul>
-<h3 id="description-12">Description</h3>
+<h3 id="description-20">Description</h3>
<p>File read and write vulnerability in Apache DolphinScheduler , authenticated users can illegally access additional resource files.<br><p>This issue affects Apache DolphinScheduler: from 3.1.0 before 3.2.2.</p><p>Users are recommended to upgrade to version 3.2.2, which fixes the issue.</p></p>
-<h3 id="references-12">References</h3>
+<h3 id="references-20">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/tbrt42mnr42bq6scxwt6bjr3s2pwyd07">https://lists.apache.org/thread/tbrt42mnr42bq6scxwt6bjr3s2pwyd07</a></li>
</ul>
-<h3 id="credits-12">Credits</h3>
+<h3 id="credits-20">Credits</h3>
<ul>
<li>L0ne1y (reporter)</li>
<li>drun1baby (reporter)</li>
@@ -354,17 +501,17 @@ This vulnerability may allow unauthorized actors to access sensitive information
<h2 id="CVE-2024-29831">RCE by arbitrary js execution</h2>
<p>CVE-2024-29831 <a href="https://cve.org/CVERecord?id=CVE-2024-29831">[CVE]</a> <a href="./CVE-2024-29831.cve.json">[CVE json]</a> <a href="./CVE-2024-29831.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-08-09T14:21:46.981Z</em></p>
-<h3 id="affected-13">Affected</h3>
+<h3 id="affected-21">Affected</h3>
<ul>
<li>Apache DolphinScheduler through 3.2.1</li>
</ul>
-<h3 id="description-13">Description</h3>
+<h3 id="description-21">Description</h3>
<p>Improper Input Validation vulnerability in Apache DolphinScheduler. An <span style="background-color: rgb(255, 255, 255);">authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2.<br></span></p>
-<h3 id="references-13">References</h3>
+<h3 id="references-21">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/x1ch0x5om3srtbnp7rtsvdszho3mdrq0">https://lists.apache.org/thread/x1ch0x5om3srtbnp7rtsvdszho3mdrq0</a></li>
</ul>
-<h3 id="credits-13">Credits</h3>
+<h3 id="credits-21">Credits</h3>
<ul>
<li>yerest (reporter)</li>
<li>L0ne1y (reporter)</li>
@@ -373,20 +520,20 @@ This vulnerability may allow unauthorized actors to access sensitive information
<h2 id="CVE-2024-23320">Arbitrary js execution as root for authenticated users</h2>
<p>CVE-2024-23320 <a href="https://cve.org/CVERecord?id=CVE-2024-23320">[CVE]</a> <a href="./CVE-2024-23320.cve.json">[CVE json]</a> <a href="./CVE-2024-23320.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-02-23T16:36:40.046Z</em></p>
-<h3 id="affected-14">Affected</h3>
+<h3 id="affected-22">Affected</h3>
<ul>
<li>Apache DolphinScheduler before 3.2.1</li>
</ul>
-<h3 id="description-14">Description</h3>
+<h3 id="description-22">Description</h3>
<p>Improper Input Validation vulnerability in Apache DolphinScheduler. An <span style="background-color: rgb(255, 255, 255);">authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.<br></span><br><br>This issue is a legacy of CVE-2023-49299. We didn’t fix it completely in CVE-2023-49299, and we added one more patch to fix it.<p><br></p><p>This issue affects Apache DolphinScheduler: until 3.2.1.</p><p><br></p><p>Users are recommended to upgrade t [...]
-<h3 id="references-14">References</h3>
+<h3 id="references-22">References</h3>
<ul>
<li><a href="https://github.com/apache/dolphinscheduler/pull/15487">https://github.com/apache/dolphinscheduler/pull/15487</a></li>
<li><a href="https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokm">https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokm</a></li>
<li><a href="https://lists.apache.org/thread/25qhfvlksozzp6j9y8ozznvjdjp3lxqq">https://lists.apache.org/thread/25qhfvlksozzp6j9y8ozznvjdjp3lxqq</a></li>
<li><a href="https://lists.apache.org/thread/p7rwzdgrztdfps8x1bwx646f1mn0x6cp">https://lists.apache.org/thread/p7rwzdgrztdfps8x1bwx646f1mn0x6cp</a></li>
</ul>
-<h3 id="credits-14">Credits</h3>
+<h3 id="credits-22">Credits</h3>
<ul>
<li>xuesong.zhou (finder)</li>
<li>Nbxiglk (finder)</li>
@@ -395,19 +542,19 @@ This vulnerability may allow unauthorized actors to access sensitive information
<h2 id="CVE-2023-51770">Arbitrary File Read Vulnerability</h2>
<p>CVE-2023-51770 <a href="https://cve.org/CVERecord?id=CVE-2023-51770">[CVE]</a> <a href="./CVE-2023-51770.cve.json">[CVE json]</a> <a href="./CVE-2023-51770.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-02-20T06:00:50.765Z</em></p>
-<h3 id="affected-15">Affected</h3>
+<h3 id="affected-23">Affected</h3>
<ul>
<li>Apache DolphinScheduler from 1.2.0 before 3.2.1</li>
</ul>
-<h3 id="description-15">Description</h3>
+<h3 id="description-23">Description</h3>
<p>Arbitrary File Read Vulnerability in Apache Dolphinscheduler.<br><br>This issue affects Apache DolphinScheduler: before 3.2.1. <br><br>We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.</p>
-<h3 id="references-15">References</h3>
+<h3 id="references-23">References</h3>
<ul>
<li><a href="https://github.com/apache/dolphinscheduler/pull/15433">https://github.com/apache/dolphinscheduler/pull/15433</a></li>
<li><a href="https://lists.apache.org/thread/4t8bdjqnfhldh73gy9p0whlgvnnbtn7g">https://lists.apache.org/thread/4t8bdjqnfhldh73gy9p0whlgvnnbtn7g</a></li>
<li><a href="https://lists.apache.org/thread/gpks573kn00ofxn7n9gkg6o47d03p5rw">https://lists.apache.org/thread/gpks573kn00ofxn7n9gkg6o47d03p5rw</a></li>
</ul>
-<h3 id="credits-15">Credits</h3>
+<h3 id="credits-23">Credits</h3>
<ul>
<li>zhiwei (finder)</li>
<li>rg (finder)</li>
@@ -415,20 +562,20 @@ This vulnerability may allow unauthorized actors to access sensitive information
<h2 id="CVE-2023-50270">Session do not expire after password change</h2>
<p>CVE-2023-50270 <a href="https://cve.org/CVERecord?id=CVE-2023-50270">[CVE]</a> <a href="./CVE-2023-50270.cve.json">[CVE json]</a> <a href="./CVE-2023-50270.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-02-23T10:17:33.021Z</em></p>
-<h3 id="affected-16">Affected</h3>
+<h3 id="affected-24">Affected</h3>
<ul>
<li>Apache DolphinScheduler from 1.3.8 through 3.2.0</li>
</ul>
-<h3 id="description-16">Description</h3>
+<h3 id="description-24">Description</h3>
<p>Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.<br><br>Users are recommended to upgrade to version 3.2.1, which fixes this issue.</p>
-<h3 id="references-16">References</h3>
+<h3 id="references-24">References</h3>
<ul>
<li><a href="https://github.com/apache/dolphinscheduler/pull/15219">https://github.com/apache/dolphinscheduler/pull/15219</a></li>
<li><a href="https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r">https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r</a></li>
<li><a href="https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6">https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6</a></li>
<li><a href="https://www.openwall.com/lists/oss-security/2024/02/20/3">https://www.openwall.com/lists/oss-security/2024/02/20/3</a></li>
</ul>
-<h3 id="credits-16">Credits</h3>
+<h3 id="credits-24">Credits</h3>
<ul>
<li>lujiefsi (finder)</li>
<li>Qing Xu (finder)</li>
@@ -436,49 +583,49 @@ This vulnerability may allow unauthorized actors to access sensitive information
<h2 id="CVE-2023-49620">Authenticated users could delete UDFs in resource center they were not authorized for</h2>
<p>CVE-2023-49620 <a href="https://cve.org/CVERecord?id=CVE-2023-49620">[CVE]</a> <a href="./CVE-2023-49620.cve.json">[CVE json]</a> <a href="./CVE-2023-49620.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-11-30T08:16:57.761Z</em></p>
-<h3 id="affected-17">Affected</h3>
+<h3 id="affected-25">Affected</h3>
<ul>
<li>Apache DolphinScheduler from 2.0.0 before 3.1.0</li>
</ul>
-<h3 id="description-17">Description</h3>
+<h3 id="description-25">Description</h3>
<p>Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability</p>
-<h3 id="references-17">References</h3>
+<h3 id="references-25">References</h3>
<ul>
<li><a href="https://github.com/apache/dolphinscheduler/pull/10307">https://github.com/apache/dolphinscheduler/pull/10307</a></li>
<li><a href="https://lists.apache.org/thread/zm4t1ykj4cro1c8183q7y32z0yzfz8yj">https://lists.apache.org/thread/zm4t1ykj4cro1c8183q7y32z0yzfz8yj</a></li>
</ul>
-<h3 id="credits-17">Credits</h3>
+<h3 id="credits-25">Credits</h3>
<ul>
<li>Yuanheng Lab of zhongfu (finder)</li>
</ul>
<h2 id="CVE-2023-49299">Arbitrary js execute as root for authenticated users</h2>
<p>CVE-2023-49299 <a href="https://cve.org/CVERecord?id=CVE-2023-49299">[CVE]</a> <a href="./CVE-2023-49299.cve.json">[CVE json]</a> <a href="./CVE-2023-49299.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-12-30T16:30:14.065Z</em></p>
-<h3 id="affected-18">Affected</h3>
+<h3 id="affected-26">Affected</h3>
<ul>
<li>Apache DolphinScheduler before 3.1.9</li>
</ul>
-<h3 id="description-18">Description</h3>
+<h3 id="description-26">Description</h3>
<p>Improper Input Validation vulnerability in Apache DolphinScheduler. An <span style="background-color: rgb(255, 255, 255);">authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.</span><p>This issue affects Apache DolphinScheduler: until 3.1.9.</p><p>Users are recommended to upgrade to version 3.1.9, which fixes the issue.</p></p>
-<h3 id="references-18">References</h3>
+<h3 id="references-26">References</h3>
<ul>
<li><a href="https://github.com/apache/dolphinscheduler/pull/15228">https://github.com/apache/dolphinscheduler/pull/15228</a></li>
<li><a href="https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokm">https://lists.apache.org/thread/tnf99qoc6tlnwrny4t1zk6mfszgdsokm</a></li>
</ul>
-<h3 id="credits-18">Credits</h3>
+<h3 id="credits-26">Credits</h3>
<ul>
<li>Eluen Siebene (finder)</li>
</ul>
<h2 id="CVE-2023-49250">Insecure TLS TrustManager used in HttpUtil</h2>
<p>CVE-2023-49250 <a href="https://cve.org/CVERecord?id=CVE-2023-49250">[CVE]</a> <a href="./CVE-2023-49250.cve.json">[CVE json]</a> <a href="./CVE-2023-49250.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-02-20T05:59:07.770Z</em></p>
-<h3 id="affected-19">Affected</h3>
+<h3 id="affected-27">Affected</h3>
<ul>
<li>Apache DolphinScheduler through 3.2.0</li>
</ul>
-<h3 id="description-19">Description</h3>
+<h3 id="description-27">Description</h3>
<p><span style="background-color: rgb(255, 255, 255);">Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server.</span><br></p><p>This issue affects Apache DolphinScheduler: before 3.2.0.</p><p>Users are recommended to upgrade to version 3.2.1, which fixes the issue.</p><br>
-<h3 id="references-19">References</h3>
+<h3 id="references-27">References</h3>
<ul>
<li><a href="https://github.com/apache/dolphinscheduler/pull/15288">https://github.com/apache/dolphinscheduler/pull/15288</a></li>
<li><a href="https://lists.apache.org/thread/wgs2jvhbmq8xnd6rmg0ymz73nyj7b3qn">https://lists.apache.org/thread/wgs2jvhbmq8xnd6rmg0ymz73nyj7b3qn</a></li>
@@ -486,196 +633,196 @@ This vulnerability may allow unauthorized actors to access sensitive information
<h2 id="CVE-2023-49109">Remote Code Execution in Apache Dolphinscheduler</h2>
<p>CVE-2023-49109 <a href="https://cve.org/CVERecord?id=CVE-2023-49109">[CVE]</a> <a href="./CVE-2023-49109.cve.json">[CVE json]</a> <a href="./CVE-2023-49109.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-02-20T06:02:40.133Z</em></p>
-<h3 id="affected-20">Affected</h3>
+<h3 id="affected-28">Affected</h3>
<ul>
<li>Apache DolphinScheduler from 3.0.0 before 3.2.1</li>
</ul>
-<h3 id="description-20">Description</h3>
+<h3 id="description-28">Description</h3>
<p>Exposure of Remote Code Execution in Apache Dolphinscheduler.<br><br>This issue affects Apache DolphinScheduler: before 3.2.1. <br><br>We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.</p>
-<h3 id="references-20">References</h3>
+<h3 id="references-28">References</h3>
<ul>
<li><a href="https://github.com/apache/dolphinscheduler/pull/14991">https://github.com/apache/dolphinscheduler/pull/14991</a></li>
<li><a href="https://lists.apache.org/thread/6kgsl93vtqlbdk6otttl0d8wmlspk0m5">https://lists.apache.org/thread/6kgsl93vtqlbdk6otttl0d8wmlspk0m5</a></li>
<li><a href="https://lists.apache.org/thread/5b6yq2gov0fsy9x5dkvo8ws4rr45vkn8">https://lists.apache.org/thread/5b6yq2gov0fsy9x5dkvo8ws4rr45vkn8</a></li>
</ul>
-<h3 id="credits-19">Credits</h3>
+<h3 id="credits-27">Credits</h3>
<ul>
<li>Y4tacker and 4ra1n from Y4secTeam (finder)</li>
</ul>
<h2 id="CVE-2023-49068">Information Leakage Vulnerability</h2>
<p>CVE-2023-49068 <a href="https://cve.org/CVERecord?id=CVE-2023-49068">[CVE]</a> <a href="./CVE-2023-49068.cve.json">[CVE json]</a> <a href="./CVE-2023-49068.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-11-27T09:49:38.223Z</em></p>
-<h3 id="affected-21">Affected</h3>
+<h3 id="affected-29">Affected</h3>
<ul>
<li>Apache DolphinScheduler before 3.2.1</li>
</ul>
-<h3 id="description-21">Description</h3>
+<h3 id="description-29">Description</h3>
<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.<p>This issue affects Apache DolphinScheduler: before 3.2.1.<br></p><p>Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not yet been released. In the mean time, we recommend you make sure the logs are only available to trusted operators.<br></p></p>
-<h3 id="references-21">References</h3>
+<h3 id="references-29">References</h3>
<ul>
<li><a href="https://github.com/apache/dolphinscheduler/pull/15192">https://github.com/apache/dolphinscheduler/pull/15192</a></li>
<li><a href="https://lists.apache.org/thread/jn6kr6mjdgtfgpxoq9j8q4pkfsq8zmpq">https://lists.apache.org/thread/jn6kr6mjdgtfgpxoq9j8q4pkfsq8zmpq</a></li>
</ul>
-<h3 id="credits-20">Credits</h3>
+<h3 id="credits-28">Credits</h3>
<ul>
<li>Y4tacker and 4ra1n from Y4secTeam (finder)</li>
</ul>
<h2 id="CVE-2023-48796">Sensitive information disclosure</h2>
<p>CVE-2023-48796 <a href="https://cve.org/CVERecord?id=CVE-2023-48796">[CVE]</a> <a href="./CVE-2023-48796.cve.json">[CVE json]</a> <a href="./CVE-2023-48796.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-11-28T05:01:20.066Z</em></p>
-<h3 id="affected-22">Affected</h3>
+<h3 id="affected-30">Affected</h3>
<ul>
<li>Apache DolphinScheduler before < 3.0.2 and 3.1.0 < 3.2.0.</li>
</ul>
-<h3 id="description-22">Description</h3>
+<h3 id="description-30">Description</h3>
<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.<br><br>The information exposed to unauthorized actors may include sensitive data such as database credentials.<br><br>Users who can’t upgrade to the fixed version can also set environment variable <code>MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus</code> to workaround this, or add the following section in the <code>application.yaml</code> file<br><br><br><c [...]
-<h3 id="references-22">References</h3>
+<h3 id="references-30">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/ffrmkcwgr2lcz0f5nnnyswhpn3fytsvo">https://lists.apache.org/thread/ffrmkcwgr2lcz0f5nnnyswhpn3fytsvo</a></li>
</ul>
-<h3 id="credits-21">Credits</h3>
+<h3 id="credits-29">Credits</h3>
<ul>
<li>whobushibaby (finder)</li>
</ul>
<h2 id="CVE-2023-25601">Apache DolphinScheduler 3.0.0 to 3.1.1 python gateway has improper authentication</h2>
<p>CVE-2023-25601 <a href="https://cve.org/CVERecord?id=CVE-2023-25601">[CVE]</a> <a href="./CVE-2023-25601.cve.json">[CVE json]</a> <a href="./CVE-2023-25601.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-04-20T15:06:54.846Z</em></p>
-<h3 id="affected-23">Affected</h3>
+<h3 id="affected-31">Affected</h3>
<ul>
<li>Apache DolphinScheduler from 3.0.0 before 3.1.2</li>
</ul>
-<h3 id="description-23">Description</h3>
+<h3 id="description-31">Description</h3>
<p>On version 3.0.0 through 3.1.1, Apache DolphinScheduler’s python gateway suffered from improper authentication: an attacker could use a socket bytes attack without authentication. This issue has been fixed from version 3.1.2 onwards. For users who use version 3.0.0 to 3.1.1, you can turn off the python-gateway function by changing the value <code>python-gateway.enabled=false</code> in configuration file <code>application.yaml</code>. If you are using the python gateway, please u [...]
-<h3 id="references-23">References</h3>
+<h3 id="references-31">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/25g77jqczp3t8cz56hk1p65q7m6c64rf">https://lists.apache.org/thread/25g77jqczp3t8cz56hk1p65q7m6c64rf</a></li>
</ul>
<h2 id="CVE-2022-45875">Remote command execution Vulnerability in script alert plugin</h2>
<p>CVE-2022-45875 <a href="https://cve.org/CVERecord?id=CVE-2022-45875">[CVE]</a> <a href="./CVE-2022-45875.cve.json">[CVE json]</a> <a href="./CVE-2022-45875.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-11-22T08:37:58.550Z</em></p>
-<h3 id="affected-24">Affected</h3>
+<h3 id="affected-32">Affected</h3>
<ul>
<li>Apache DolphinScheduler from 3.0 through 3.0.1</li>
<li>Apache DolphinScheduler from 3.1 through 3.1.0</li>
</ul>
-<h3 id="description-24">Description</h3>
+<h3 id="description-32">Description</h3>
<p>Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions.<br><span style="background-color: rgb(255, 255, 255);">This attack can be performed only by authenticated users which can login to DS.</span><br><br></p>
-<h3 id="references-24">References</h3>
+<h3 id="references-32">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/r0wqzkjsoq17j6ww381kmpx3jjp9hb6r">https://lists.apache.org/thread/r0wqzkjsoq17j6ww381kmpx3jjp9hb6r</a></li>
</ul>
-<h3 id="credits-22">Credits</h3>
+<h3 id="credits-30">Credits</h3>
<ul>
<li>4ra1n of Chaitin Tech (finder)</li>
</ul>
<h2 id="CVE-2022-45462">Apache DolphinScheduler prior to 2.0.5 have command execution vulnerability</h2>
<p>CVE-2022-45462 <a href="https://cve.org/CVERecord?id=CVE-2022-45462">[CVE]</a> <a href="./CVE-2022-45462.cve.json">[CVE json]</a> <a href="./CVE-2022-45462.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-23T02:24:20.816Z</em></p>
-<h3 id="affected-25">Affected</h3>
+<h3 id="affected-33">Affected</h3>
<ul>
<li>Apache DolphinScheduler from unspecified through 2.0.5</li>
</ul>
-<h3 id="description-25">Description</h3>
+<h3 id="description-33">Description</h3>
<p>Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher</p>
-<h3 id="references-25">References</h3>
+<h3 id="references-33">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/2f126y32bf1v3mvxkdgt2jr5j3l1t01w">https://lists.apache.org/thread/2f126y32bf1v3mvxkdgt2jr5j3l1t01w</a></li>
</ul>
-<h3 id="credits-23">Credits</h3>
+<h3 id="credits-31">Credits</h3>
<ul>
<li>This issue was discovered by Jigang Dong of M1QLin Security Team</li>
</ul>
<h2 id="CVE-2022-34662">Apache DolphinScheduler prior to 3.0.0 allows path traversal</h2>
<p>CVE-2022-34662 <a href="https://cve.org/CVERecord?id=CVE-2022-34662">[CVE]</a> <a href="./CVE-2022-34662.cve.json">[CVE json]</a> <a href="./CVE-2022-34662.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-01T15:28:47.599Z</em></p>
-<h3 id="affected-26">Affected</h3>
+<h3 id="affected-34">Affected</h3>
<ul>
<li>Apache DolphinScheduler from Apache DolphinScheduler through 3.0.0-beta-1</li>
</ul>
-<h3 id="description-26">Description</h3>
+<h3 id="description-34">Description</h3>
<p>When users add resources to the resource center with a relation path will cause path traversal issues and only for logged-in users. You could upgrade to version 3.0.0 or higher</p>
-<h3 id="references-26">References</h3>
+<h3 id="references-34">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/pbdzqf9ntxyvs4cr0x2dgk9zlf43btz8">https://lists.apache.org/thread/pbdzqf9ntxyvs4cr0x2dgk9zlf43btz8</a></li>
</ul>
-<h3 id="credits-24">Credits</h3>
+<h3 id="credits-32">Credits</h3>
<ul>
<li>This issue was discovered by Jigang Dong of M1QLin Security Team</li>
</ul>
<h2 id="CVE-2022-26885">Apache DolphinScheduler config file read by task risk</h2>
<p>CVE-2022-26885 <a href="https://cve.org/CVERecord?id=CVE-2022-26885">[CVE]</a> <a href="./CVE-2022-26885.cve.json">[CVE json]</a> <a href="./CVE-2022-26885.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-24T11:55:57.562Z</em></p>
-<h3 id="affected-27">Affected</h3>
+<h3 id="affected-35">Affected</h3>
<ul>
<li>Apache DolphinScheduler from Apache DolphinScheduler before 2.0.6</li>
</ul>
-<h3 id="description-27">Description</h3>
+<h3 id="description-35">Description</h3>
<p>When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher.</p>
-<h3 id="references-27">References</h3>
+<h3 id="references-35">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/z7084r9cs2r26cszkkgjqpb5bhnxqssp">https://lists.apache.org/thread/z7084r9cs2r26cszkkgjqpb5bhnxqssp</a></li>
</ul>
<h2 id="CVE-2022-26884">Apache DolphinScheduler exposes files without authentication</h2>
<p>CVE-2022-26884 <a href="https://cve.org/CVERecord?id=CVE-2022-26884">[CVE]</a> <a href="./CVE-2022-26884.cve.json">[CVE json]</a> <a href="./CVE-2022-26884.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-10-28T01:44:55.028Z</em></p>
-<h3 id="affected-28">Affected</h3>
+<h3 id="affected-36">Affected</h3>
<ul>
<li>Apache DolphinScheduler from Apache DolphinScheduler before 2.0.6</li>
</ul>
-<h3 id="description-28">Description</h3>
+<h3 id="description-36">Description</h3>
<p>Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.</p>
-<h3 id="references-28">References</h3>
+<h3 id="references-36">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/xfdst5y4hnrm2ntmc5jzrgmw2htyyb9c">https://lists.apache.org/thread/xfdst5y4hnrm2ntmc5jzrgmw2htyyb9c</a></li>
</ul>
<h2 id="CVE-2022-25598">Apache DolphinScheduler user registration is vulnerable to ReDoS attacks</h2>
<p>CVE-2022-25598 <a href="https://cve.org/CVERecord?id=CVE-2022-25598">[CVE]</a> <a href="./CVE-2022-25598.cve.json">[CVE json]</a> <a href="./CVE-2022-25598.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-11-01T03:18:38.664Z</em></p>
-<h3 id="affected-29">Affected</h3>
+<h3 id="affected-37">Affected</h3>
<ul>
<li>Apache DolphinScheduler from Apache DolphinScheduler before 2.0.5</li>
</ul>
-<h3 id="description-29">Description</h3>
+<h3 id="description-37">Description</h3>
<p>Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.Uncontrolled Resource Consumption vulnerability in <strong>COMPONENT</strong> of Apache DolphinScheduler allows an attacker to <strong>IMPACT</strong>. This issue affects Apache DolphinScheduler Apache DolphinScheduler versions prior to 2.0.5.</p>
-<h3 id="references-29">References</h3>
+<h3 id="references-37">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/hwnw7xr969sg5nv84wz75nfr2c76fl93">https://lists.apache.org/thread/hwnw7xr969sg5nv84wz75nfr2c76fl93</a></li>
</ul>
-<h3 id="credits-25">Credits</h3>
+<h3 id="credits-33">Credits</h3>
<ul>
<li>This issue was discovered by Zheng Wang of HIT</li>
</ul>
<h2 id="CVE-2021-27644">DolphinScheduler mysql jdbc connector parameters deserialize remote code execution</h2>
<p>CVE-2021-27644 <a href="https://cve.org/CVERecord?id=CVE-2021-27644">[CVE]</a> <a href="./CVE-2021-27644.cve.json">[CVE json]</a> <a href="./CVE-2021-27644.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2021-11-01T09:12:08.670Z</em></p>
-<h3 id="affected-30">Affected</h3>
+<h3 id="affected-38">Affected</h3>
<ul>
<li>Apache DolphinScheduler from Apache DolphinScheduler before 1.3.6</li>
</ul>
-<h3 id="description-30">Description</h3>
+<h3 id="description-38">Description</h3>
<p>In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with internal login account password)</p>
-<h3 id="references-30">References</h3>
+<h3 id="references-38">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread.html/r35d6acf021486a390a7ea09e6650c2fe19e72522bd484791d606a6e6%40%3Cdev.dolphinscheduler.apache.org%3E">https://lists.apache.org/thread.html/r35d6acf021486a390a7ea09e6650c2fe19e72522bd484791d606a6e6%40%3Cdev.dolphinscheduler.apache.org%3E</a></li>
</ul>
-<h3 id="credits-26">Credits</h3>
+<h3 id="credits-34">Credits</h3>
<ul>
<li>This issue was discovered by Jinchen Sheng of Ant FG Security Lab</li>
</ul>
<h2 id="CVE-2020-13922">Apache DolphinScheduler (incubating) Permission vulnerability</h2>
<p>CVE-2020-13922 <a href="https://cve.org/CVERecord?id=CVE-2020-13922">[CVE]</a> <a href="./CVE-2020-13922.cve.json">[CVE json]</a> <a href="./CVE-2020-13922.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2021-01-11T09:18:42.255Z</em></p>
-<h3 id="affected-31">Affected</h3>
+<h3 id="affected-39">Affected</h3>
<ul>
<li>Apache DolphinScheduler from Apache DolphinScheduler before 1.3.2</li>
</ul>
-<h3 id="description-31">Description</h3>
+<h3 id="description-39">Description</h3>
<p>Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.</p>
-<h3 id="references-31">References</h3>
+<h3 id="references-39">References</h3>
<ul>
<li><a href="https://www.mail-archive.com/announce%40apache.org/msg06076.html">https://www.mail-archive.com/announce%40apache.org/msg06076.html</a></li>
</ul>
-<h3 id="credits-27">Credits</h3>
+<h3 id="credits-35">Credits</h3>
<ul>
<li>This issue was discovered by xuxiang of DtDream security</li>
</ul>
diff --git a/projects/doris/CVE-2026-31377.cve.json b/projects/doris/CVE-2026-31377.cve.json
new file mode 100644
index 00000000..482382ef
--- /dev/null
+++ b/projects/doris/CVE-2026-31377.cve.json
@@ -0,0 +1,183 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Improper Authentication Allows Unauthorized Access to FE Meta Service",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-287: Improper Authentication",
+ "lang": "en",
+ "cweId": "CWE-287",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Doris",
+ "modules": [
+ "Frontend (FE) meta service"
+ ],
+ "programFiles": [
+ "fe/fe-core/src/main/java/org/apache/doris/httpv2/meta/MetaService.java"
+ ],
+ "versions": [
+ {
+ "status": "affected",
+ "version": "2.0.0",
+ "lessThan": "4.0.8",
+ "versionType": "semver"
+ },
+ {
+ "status": "affected",
+ "version": "4.1.0",
+ "lessThan": "4.1.4",
+ "versionType": "semver"
+ },
+ {
+ "status": "unaffected",
+ "version": "0",
+ "lessThan": "2.0.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "unaffected",
+ "version": "4.0.8",
+ "lessThan": "4.1.0",
+ "versionType": "semver"
+ },
+ {
+ "status": "unaffected",
+ "version": "4.1.4",
+ "lessThan": "*",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unknown"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata service endpoints.\n\n\n\nThe affected endpoints relied on client-supplied node information for authentication without providing sufficient authentication of the requesting party. Under certain network configurations, a remote attacker may be able to bypass the intended access control and access internal FE metad [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata service endpoints.<br><br><p><span>The affected endpoints relied on client-supplied node information for authentication without providing sufficient authentication of the requesting party. Under certain network configurations, a remote attacker may be able to bypass the intended access control and access inte [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/rf4ocqmzxvnwnxpsooj2lkzjl68b1m9q",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ },
+ {
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ],
+ "format": "CVSS",
+ "cvssV3_1": {
+ "version": "3.1",
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "privilegesRequired": "NONE",
+ "userInteraction": "NONE",
+ "scope": "UNCHANGED",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "NONE",
+ "availabilityImpact": "NONE",
+ "baseSeverity": "HIGH",
+ "baseScore": 7.5,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+ }
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Mapta / BugBunny_ai",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "Calvin Kirs, Security Researcher at SelectDB",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "Vlary (Huntree Security Team)",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "Vladimir Tokarev (g1nd1l4)",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "lalalala5678",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "4ra2n (A code security AI agent)",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "Fakile Emmanuel",
+ "type": "reporter"
+ },
+ {
+ "lang": "en",
+ "value": "Fried Chicken",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-31377",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/doris/CVE-2026-96443.cve.json b/projects/doris/CVE-2026-96443.cve.json
new file mode 100644
index 00000000..399c40da
--- /dev/null
+++ b/projects/doris/CVE-2026-96443.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "JDBC driver URL validation bypass leads to remote code execution",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-829 Inclusion of functionality from untrusted control sphere",
+ "lang": "en",
+ "cweId": "CWE-829",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Doris",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "2.0.5",
+ "lessThanOrEqual": "4.1.3",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p>Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE.</p>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/vv9o8sxpt8kkd7nznhovn9qjojn2wyv9",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "zhaoyudi (nebula LAB)",
+ "type": "finder"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-96443",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/doris/CVE-2026-96443.osv.json b/projects/doris/CVE-2026-96443.osv.json
new file mode 100644
index 00000000..6011dea8
--- /dev/null
+++ b/projects/doris/CVE-2026-96443.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-96443", "summary": "JDBC driver URL validation bypass leads to remote code execution", "details": "Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "2.0.5"}, {"last_affected": "2.0.5"}]}]}], "references": [{"type": "WEB", "url": "https://lists.apache.org/thread/vv9o8sxpt8kkd7nznhovn9qjojn2wyv9"}]}
\ No newline at end of file
diff --git a/projects/doris/index.html b/projects/doris/index.html
index eb144b84..606f3c84 100644
--- a/projects/doris/index.html
+++ b/projects/doris/index.html
@@ -109,207 +109,252 @@
</ul>
<h1 id="advisories">Advisories</h1>
<p class="bg-warning">This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the project security page linked above. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public <a href="/mailinglist">mailinglist</a> or privately on <a href="mailto:security@apache.org">security@apache.org</a></p>
+<h2 id="CVE-2026-96443">JDBC driver URL validation bypass leads to remote code execution</h2>
+<p>CVE-2026-96443 <a href="https://cve.org/CVERecord?id=CVE-2026-96443">[CVE]</a> <a href="./CVE-2026-96443.cve.json">[CVE json]</a> <a href="./CVE-2026-96443.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-23T09:35:29.168Z</em></p>
+<h3 id="affected">Affected</h3>
+<ul>
+<li>Apache Doris from 2.0.5 through 4.1.3</li>
+</ul>
+<h3 id="description">Description</h3>
+<p>Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE.</p>
+<h3 id="references">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/vv9o8sxpt8kkd7nznhovn9qjojn2wyv9">https://lists.apache.org/thread/vv9o8sxpt8kkd7nznhovn9qjojn2wyv9</a></li>
+</ul>
+<h3 id="credits">Credits</h3>
+<ul>
+<li>zhaoyudi (nebula LAB) (finder)</li>
+</ul>
<h2 id="CVE-2026-72524">Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables</h2>
<p>CVE-2026-72524 <a href="https://cve.org/CVERecord?id=CVE-2026-72524">[CVE]</a> <a href="./CVE-2026-72524.cve.json">[CVE json]</a> <a href="./CVE-2026-72524.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-14T09:58:11.532Z</em></p>
-<h3 id="affected">Affected</h3>
+<h3 id="affected-1">Affected</h3>
<ul>
<li>Apache Doris from 3.1.0 through 3.1.*</li>
<li>Apache Doris from 4.0.0 through 4.0.7</li>
<li>Apache Doris from 4.1.0 through 4.1.3</li>
</ul>
-<h3 id="description">Description</h3>
+<h3 id="description-1">Description</h3>
<p>Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to.</p><p>This issue affects Apache Doris: from 3.1.0 through 3.1.*, from 4.0.0 through 4.0.7, and from 4.1.0 through 4.1.3.</p><p>Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.</p>
-<h3 id="references">References</h3>
+<h3 id="references-1">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/sxlno9bngg3gk59rxqq7yfqm7bfyj3ph">https://lists.apache.org/thread/sxlno9bngg3gk59rxqq7yfqm7bfyj3ph</a></li>
</ul>
-<h3 id="credits">Credits</h3>
+<h3 id="credits-1">Credits</h3>
<ul>
<li>Calvin Kirs, Security Researcher at SelectDB (finder)</li>
</ul>
<h2 id="CVE-2026-68570">Authorization bypass leading to unauthorized data access</h2>
<p>CVE-2026-68570 <a href="https://cve.org/CVERecord?id=CVE-2026-68570">[CVE]</a> <a href="./CVE-2026-68570.cve.json">[CVE json]</a> <a href="./CVE-2026-68570.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-09-14T10:00:12.763Z</em></p>
-<h3 id="affected-1">Affected</h3>
+<h3 id="affected-2">Affected</h3>
<ul>
<li>Apache Doris from 2.0.0 through 2.1.*</li>
<li>Apache Doris from 3.0.0 through 3.0.*</li>
<li>Apache Doris from 4.0.0 before 4.0.8</li>
<li>Apache Doris from 4.1.0 before 4.1.4</li>
</ul>
-<h3 id="description-1">Description</h3>
+<h3 id="description-2">Description</h3>
<p>Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read, resulting in unauthorized disclosure of information.</p><p>This issue affects Apache Doris: from 2.0.0 through 2.1.*, from 3.0.0 through 3.0.*, from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.4.</p><p>Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.</p>
-<h3 id="references-1">References</h3>
+<h3 id="references-2">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/rp2gr6d7rb4y8slxh3fojmhb1rl5ms03">https://lists.apache.org/thread/rp2gr6d7rb4y8slxh3fojmhb1rl5ms03</a></li>
</ul>
-<h3 id="credits-1">Credits</h3>
+<h3 id="credits-2">Credits</h3>
<ul>
<li>Calvin Kirs, Security Researcher at SelectDB (finder)</li>
</ul>
<h2 id="CVE-2026-58319">Improper Authentication in Frontend HTTP API</h2>
<p>CVE-2026-58319 <a href="https://cve.org/CVERecord?id=CVE-2026-58319">[CVE]</a> <a href="./CVE-2026-58319.cve.json">[CVE json]</a> <a href="./CVE-2026-58319.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-07-14T09:36:25.369Z</em></p>
-<h3 id="affected-2">Affected</h3>
+<h3 id="affected-3">Affected</h3>
<ul>
<li>Apache Doris from 2.1.0 before 3.1.0</li>
</ul>
-<h3 id="description-2">Description</h3>
+<h3 id="description-3">Description</h3>
<p>Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster integrity and availability and leading to cluster instability or denial of service. <br><br>This issue affects Apache Doris versions prior to 3.1.0. Users are advised to upgrade to Apache Doris 3.1.0 or later.</p>
-<h3 id="references-2">References</h3>
+<h3 id="references-3">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/cob5mxkyr1k81o8v91hox2hld6zh25b4">https://lists.apache.org/thread/cob5mxkyr1k81o8v91hox2hld6zh25b4</a></li>
</ul>
-<h3 id="credits-2">Credits</h3>
+<h3 id="credits-3">Credits</h3>
<ul>
<li>Calvin Kirs, Security Researcher at SelectDB (finder)</li>
</ul>
+<h2 id="CVE-2026-31377">Improper Authentication Allows Unauthorized Access to FE Meta Service</h2>
+<p>CVE-2026-31377 <a href="https://cve.org/CVERecord?id=CVE-2026-31377">[CVE]</a> <a href="./CVE-2026-31377.cve.json">[CVE json]</a></p>
+<p><em>Last updated: 2026-09-23T09:04:37.058Z</em></p>
+<h3 id="affected-4">Affected</h3>
+<ul>
+<li>Apache Doris from 2.0.0 before 4.0.8</li>
+<li>Apache Doris from 4.1.0 before 4.1.4</li>
+<li>Apache Doris before 2.0.0 unaffected</li>
+<li>Apache Doris from 4.0.8 before 4.1.0 unaffected</li>
+<li>Apache Doris from 4.1.4 before * unaffected</li>
+</ul>
+<h3 id="description-4">Description</h3>
+<p>An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata service endpoints.<br><br><p><span>The affected endpoints relied on client-supplied node information for authentication without providing sufficient authentication of the requesting party. Under certain network configurations, a remote attacker may be able to bypass the intended access control and access internal FE metadata inte [...]
+<h3 id="references-4">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/rf4ocqmzxvnwnxpsooj2lkzjl68b1m9q">https://lists.apache.org/thread/rf4ocqmzxvnwnxpsooj2lkzjl68b1m9q</a></li>
+</ul>
+<h3 id="credits-4">Credits</h3>
+<ul>
+<li>Mapta / BugBunny_ai (reporter)</li>
+<li>Calvin Kirs, Security Researcher at SelectDB (reporter)</li>
+<li>Vlary (Huntree Security Team) (reporter)</li>
+<li>Vladimir Tokarev (g1nd1l4) (reporter)</li>
+<li>lalalala5678 (reporter)</li>
+<li>4ra2n (A code security AI agent) (reporter)</li>
+<li>Fakile Emmanuel (reporter)</li>
+<li>Fried Chicken (reporter)</li>
+</ul>
<h2 id="CVE-2025-66336">SQL injection leading the authentication bypass</h2>
<p>CVE-2025-66336 <a href="https://cve.org/CVERecord?id=CVE-2025-66336">[CVE]</a> <a href="./CVE-2025-66336.cve.json">[CVE json]</a> <a href="./CVE-2025-66336.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-06-22T06:55:16.362Z</em></p>
-<h3 id="affected-3">Affected</h3>
+<h3 id="affected-5">Affected</h3>
<ul>
<li>Apache Doris MCP Server from 0.1.0 before 0.6.1</li>
</ul>
-<h3 id="description-3">Description</h3>
+<h3 id="description-5">Description</h3>
<p>Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller’s authorization context. This may allow an authenticated attacker, or an anonymous attacker if authentication is disabled, to bypass SQL security validation and access metadata outside the intended database scope.<br><br>Affected users are recommended to upgrade to [...]
-<h3 id="references-3">References</h3>
+<h3 id="references-5">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/4l4v3m7ofwrgp4s4s98pjb5l03fcrzo2">https://lists.apache.org/thread/4l4v3m7ofwrgp4s4s98pjb5l03fcrzo2</a></li>
</ul>
-<h3 id="credits-3">Credits</h3>
+<h3 id="credits-5">Credits</h3>
<ul>
<li>cherno.x. (reporter)</li>
</ul>
<h2 id="CVE-2025-66335">MCP SQL inject</h2>
<p>CVE-2025-66335 <a href="https://cve.org/CVERecord?id=CVE-2025-66335">[CVE]</a> <a href="./CVE-2025-66335.cve.json">[CVE json]</a> <a href="./CVE-2025-66335.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-04-17T09:41:43.983Z</em></p>
-<h3 id="affected-4">Affected</h3>
+<h3 id="affected-6">Affected</h3>
<ul>
<li>Apache Doris MCP Server from 0.1.0 before 0.6.1</li>
</ul>
-<h3 id="description-4">Description</h3>
+<h3 id="description-6">Description</h3>
<div>Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unintended SQL statements and bypass of intended query validation and access restrictions through the MCP query execution interface. Version 0.6.1 and later are not affected.
</div><br>
-<h3 id="references-4">References</h3>
+<h3 id="references-6">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/odp0fyyst8kxm7hhm9z4d1snh1y4hjpy">https://lists.apache.org/thread/odp0fyyst8kxm7hhm9z4d1snh1y4hjpy</a></li>
</ul>
-<h3 id="credits-4">Credits</h3>
+<h3 id="credits-6">Credits</h3>
<ul>
<li>Tomer Peled, Senior Security Researcher at Akamai (reporter)</li>
</ul>
<h2 id="CVE-2025-58337">Improper Access Control results in bypassing a “read-only” mode for doris-mcp-server MCP Server</h2>
<p>CVE-2025-58337 <a href="https://cve.org/CVERecord?id=CVE-2025-58337">[CVE]</a> <a href="./CVE-2025-58337.cve.json">[CVE json]</a> <a href="./CVE-2025-58337.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-11-05T09:26:34.887Z</em></p>
-<h3 id="affected-5">Affected</h3>
+<h3 id="affected-7">Affected</h3>
<ul>
<li>Apache Doris-MCP-Server from 0.1.0 before 0.6.0</li>
</ul>
-<h3 id="description-5">Description</h3>
+<h3 id="description-7">Description</h3>
<p>An attacker with a valid read-only account can bypass Doris MCP Server’s read-only mode due to improper access control, allowing modifications that should have been prevented by read-only restrictions.<br></p><p>Impact:<br>
Bypasses read-only mode; attackers with read-only access may perform unauthorized modifications.</p>
<p></p><p>Recommended action for operators: Upgrade to version 0.6.0 as soon as possible (this release contains the fix).</p><p></p>
<p></p><br>
-<h3 id="references-5">References</h3>
+<h3 id="references-7">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/6tswlphj0pqn9zf25594r3c1vzvfj40h">https://lists.apache.org/thread/6tswlphj0pqn9zf25594r3c1vzvfj40h</a></li>
</ul>
-<h3 id="credits-5">Credits</h3>
+<h3 id="credits-7">Credits</h3>
<ul>
<li>Liran Tal, (<a href="mailto:liran@lirantal.com">liran@lirantal.com</a>) (finder)</li>
</ul>
<h2 id="CVE-2024-48019">allows admin users to read arbitrary files through the REST API</h2>
<p>CVE-2024-48019 <a href="https://cve.org/CVERecord?id=CVE-2024-48019">[CVE]</a> <a href="./CVE-2024-48019.cve.json">[CVE json]</a> <a href="./CVE-2024-48019.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2025-02-04T18:19:49.957Z</em></p>
-<h3 id="affected-6">Affected</h3>
+<h3 id="affected-8">Affected</h3>
<ul>
<li>Apache Doris from 2.1.0 before 2.1.8</li>
<li>Apache Doris from 3.0.0 before 3.0.3</li>
</ul>
-<h3 id="description-6">Description</h3>
+<h3 id="description-8">Description</h3>
<p>Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Files or Directories Accessible to External Parties vulnerability in Apache Doris.<br></p><p><span style="background-color: rgb(255, 255, 255);">Application administrators can read arbitrary
files from the server filesystem through path traversal.</span><br></p><p>Users are recommended to upgrade to version 2.1.8, 3.0.3 or later, which fixes the issue.</p>
-<h3 id="references-6">References</h3>
+<h3 id="references-8">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/p70klgmyrgknhn0t195261wvwv5jw6hr">https://lists.apache.org/thread/p70klgmyrgknhn0t195261wvwv5jw6hr</a></li>
</ul>
-<h3 id="credits-6">Credits</h3>
+<h3 id="credits-8">Credits</h3>
<ul>
<li>Man Yue Mo of the GitHub Security Lab team (finder)</li>
</ul>
<h2 id="CVE-2024-27438">Downloading arbitrary remote jar files resulting in remote command execution</h2>
<p>CVE-2024-27438 <a href="https://cve.org/CVERecord?id=CVE-2024-27438">[CVE]</a> <a href="./CVE-2024-27438.cve.json">[CVE json]</a> <a href="./CVE-2024-27438.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-03-21T09:39:20.599Z</em></p>
-<h3 id="affected-7">Affected</h3>
+<h3 id="affected-9">Affected</h3>
<ul>
<li>Apache Doris from 1.2.0 through 2.0.4</li>
</ul>
-<h3 id="description-7">Description</h3>
+<h3 id="description-9">Description</h3>
<p>Download of Code Without Integrity Check vulnerability in Apache Doris.<br>The jdbc driver files used for JDBC catalog is not checked and may resulting in remote command execution.<br>Once the attacker is authorized to create a JDBC catalog, he/she can use arbitrary driver jar file with unchecked code snippet. This code snippet will be run when catalog is initializing without any check.<br><p>This issue affects Apache Doris: from 1.2.0 through 2.0.4.</p><p>Users are recommended to upg [...]
-<h3 id="references-7">References</h3>
+<h3 id="references-9">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/h95h82b0svlnwcg6c2xq4b08j6gwgczh">https://lists.apache.org/thread/h95h82b0svlnwcg6c2xq4b08j6gwgczh</a></li>
</ul>
<h2 id="CVE-2024-26307">Possible race condition</h2>
<p>CVE-2024-26307 <a href="https://cve.org/CVERecord?id=CVE-2024-26307">[CVE]</a> <a href="./CVE-2024-26307.cve.json">[CVE json]</a> <a href="./CVE-2024-26307.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-03-21T09:38:16.580Z</em></p>
-<h3 id="affected-8">Affected</h3>
+<h3 id="affected-10">Affected</h3>
<ul>
<li>Apache Doris before 1.2.8</li>
<li>Apache Doris before 2.0.4</li>
</ul>
-<h3 id="description-8">Description</h3>
+<h3 id="description-10">Description</h3>
<p>Possible race condition vulnerability in Apache Doris.<br>Some of code using <code>chmod()</code> method. This method <span style="background-color: rgb(255, 255, 255);">run the risk of someone renaming the file out from under user and chmodding the wrong file.<br>This could theoretically happen, but the impact would be minimal.</span><br><p>This issue affects Apache Doris: before 1.2.8, before 2.0.4.</p><p>Users are recommended to upgrade to version 2.0.4, which fixes the issue.</p></p>
-<h3 id="references-8">References</h3>
+<h3 id="references-10">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/5shhw8x8m271hd2wfwzqzwgf36pmc4pl">https://lists.apache.org/thread/5shhw8x8m271hd2wfwzqzwgf36pmc4pl</a></li>
</ul>
<h2 id="CVE-2023-41314">Missing API authentication allowed DoS</h2>
<p>CVE-2023-41314 <a href="https://cve.org/CVERecord?id=CVE-2023-41314">[CVE]</a> <a href="./CVE-2023-41314.cve.json">[CVE json]</a> <a href="./CVE-2023-41314.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2023-12-18T08:27:49.193Z</em></p>
-<h3 id="affected-9">Affected</h3>
+<h3 id="affected-11">Affected</h3>
<ul>
<li>Apache Doris from 1.2.0 through 2.0.3</li>
</ul>
-<h3 id="description-9">Description</h3>
+<h3 id="description-11">Description</h3>
<p>The api /api/snapshot and /api/get_log_file would allow unauthenticated access.<br>It could allow a DoS attack or get arbitrary files from FE node.<br>Please upgrade to 2.0.3 to fix these issues.</p>
-<h3 id="references-9">References</h3>
+<h3 id="references-11">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/tgvpvz3yw7zgodl1sb3sv3jbbz8t5zb4">https://lists.apache.org/thread/tgvpvz3yw7zgodl1sb3sv3jbbz8t5zb4</a></li>
</ul>
<h2 id="CVE-2023-41313">Timing Attack weakness</h2>
<p>CVE-2023-41313 <a href="https://cve.org/CVERecord?id=CVE-2023-41313">[CVE]</a> <a href="./CVE-2023-41313.cve.json">[CVE json]</a> <a href="./CVE-2023-41313.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-03-12T10:16:14.512Z</em></p>
-<h3 id="affected-10">Affected</h3>
+<h3 id="affected-12">Affected</h3>
<ul>
<li>Apache Doris before 1.2.8</li>
</ul>
-<h3 id="description-10">Description</h3>
+<h3 id="description-12">Description</h3>
<p><span style="background-color: rgb(255, 255, 255);">The authentication method in Apache Doris versions before 2.0.0 was vulnerable to timing attacks.</span><br><span style="background-color: rgb(255, 255, 255);">Users are recommended to upgrade to version 2.0.0 + or 1.2.8, which fixes this issue.</span><br><p></p></p>
-<h3 id="references-10">References</h3>
+<h3 id="references-12">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/jqczy3vxzs6q6rz9o0626j5nks9fnv95">https://lists.apache.org/thread/jqczy3vxzs6q6rz9o0626j5nks9fnv95</a></li>
</ul>
-<h3 id="credits-7">Credits</h3>
+<h3 id="credits-9">Credits</h3>
<ul>
<li>Andrea Cosentino from Apache Software Foundation (reporter)</li>
</ul>
<h2 id="CVE-2022-23942">Apache Doris hardcoded cryptography initialization</h2>
<p>CVE-2022-23942 <a href="https://cve.org/CVERecord?id=CVE-2022-23942">[CVE]</a> <a href="./CVE-2022-23942.cve.json">[CVE json]</a> <a href="./CVE-2022-23942.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-04-26T14:49:46.143Z</em></p>
-<h3 id="affected-11">Affected</h3>
+<h3 id="affected-13">Affected</h3>
<ul>
<li>Apache Doris(Incubating) at 0.15.0</li>
</ul>
-<h3 id="description-11">Description</h3>
+<h3 id="description-13">Description</h3>
<p>Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure.</p>
-<h3 id="references-11">References</h3>
+<h3 id="references-13">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/com2dyzp3bn2rdrotry90q2zzord4tvt">https://lists.apache.org/thread/com2dyzp3bn2rdrotry90q2zzord4tvt</a></li>
</ul>
-<h3 id="credits-8">Credits</h3>
+<h3 id="credits-10">Credits</h3>
<ul>
<li>We would like to thanks to Dwi Siswanto<a href="mailto:me@dw1.io">me@dw1.io</a> for the report of this issue</li>
</ul>
diff --git a/projects/karaf/CVE-2026-90979.cve.json b/projects/karaf/CVE-2026-90979.cve.json
new file mode 100644
index 00000000..332b5899
--- /dev/null
+++ b/projects/karaf/CVE-2026-90979.cve.json
@@ -0,0 +1,100 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "LDAP filter injection in JAAS LDAP login modules",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-90 Improper neutralization of special elements used in an LDAP query ('LDAP injection')",
+ "lang": "en",
+ "cweId": "CWE-90",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "defect": [
+ "https://github.com/apache/karaf/pull/2880"
+ ],
+ "advisory": "https://karaf.apache.org/security/cve-2026-90979.txt",
+ "discovery": "EXTERNAL"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Karaf",
+ "packageName": "org.apache.karaf.jaas.modules.ldap",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "4.4.12",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "LDAPCache\u00a0and\u00a0LDAPBackingEngine\u00a0build LDAP search filters for user lookup and role lookup by textually substituting the placeholders\u00a0%u,\u00a0%dn, and\u00a0%fqdn\u00a0(drawn from the login name, the resolved user DN, and its fully qualified namespace form) into administrator-configured filter templates (userFilter,\u00a0roleFilter). Before the fix, the only sanitization applied to the substituted value was double backslashed:\n\nfilter = filter.rep [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<p><span>LDAPCache</span> and <code>LDAPBackingEngine</code> build LDAP search filters for user lookup and role lookup by textually substituting the placeholders <code>%u</code>, <code>%dn</code>, and <code>%fqdn</code> (drawn from the login name, the resolved user DN, and its fully qualified namespace form) into administrator-configured filter templates (<code>userFilter</code>, <code>roleFilter</code>). Before the fix, the [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://karaf.apache.org/security/cve-2026-90979.txt",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Gjoko Krstic <gj...@zeroscience.mk>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-90979",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/karaf/CVE-2026-90979.osv.json b/projects/karaf/CVE-2026-90979.osv.json
new file mode 100644
index 00000000..164e0bf3
--- /dev/null
+++ b/projects/karaf/CVE-2026-90979.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-90979", "summary": "LDAP filter injection in JAAS LDAP login modules", "details": "LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn (drawn from the login name, the resolved user DN, and its fully qualified namespace form) into administrator-configured filter templates (userFilter, roleFilter). Before the fix, the only sanitization applied to t [...]
\ No newline at end of file
diff --git a/projects/karaf/CVE-2026-91006.cve.json b/projects/karaf/CVE-2026-91006.cve.json
new file mode 100644
index 00000000..464b91ec
--- /dev/null
+++ b/projects/karaf/CVE-2026-91006.cve.json
@@ -0,0 +1,100 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')",
+ "lang": "en",
+ "cweId": "CWE-78",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "defect": [
+ "https://github.com/apache/karaf/pull/2878"
+ ],
+ "advisory": "https://karaf.apache.org/security/cve-2026-91006.txt",
+ "discovery": "EXTERNAL"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Karaf",
+ "packageName": "org.apache.karaf:org.apache.karaf.instance.core",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "4.4.12",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through\u00a0/bin/sh\u00a0(Unix) or\u00a0cscript\u00a0(Windows). The caller-supplied\u00a0javaOpts\u00a0value is spliced into that string unquoted. A javaOpts value containing shell metacharacters (;,\u00a0|,\u00a0`,\u00a0$(...)) is interpreted by the shell instead of being passed to the JVM as an option, g [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Karaf's instance-management service (<code>InstanceServiceImpl</code>) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through <code>/bin/sh </code>(Unix) or <code>cscript</code> (Windows). The caller-supplied <code>javaOpts</code> value is spliced into that string unquoted. A javaOpts value containing shell metacharacters (<code>;</code>, <code>|</code>, <code>`</cod [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/olzy0yjw82b20w59vonfjr1x7v5yzocr",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "n0mi1k <no...@gmail.com>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-91006",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/karaf/CVE-2026-91006.osv.json b/projects/karaf/CVE-2026-91006.osv.json
new file mode 100644
index 00000000..16e85d10
--- /dev/null
+++ b/projects/karaf/CVE-2026-91006.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-91006", "summary": "OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)", "details": "Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh (Unix) or cscript (Windows). The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value containing shell metacharacters (;, |, [...]
\ No newline at end of file
diff --git a/projects/karaf/CVE-2026-91012.cve.json b/projects/karaf/CVE-2026-91012.cve.json
new file mode 100644
index 00000000..4773558f
--- /dev/null
+++ b/projects/karaf/CVE-2026-91012.cve.json
@@ -0,0 +1,84 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation",
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Karaf",
+ "packageName": "org.apache.karaf.config.core.impl",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "4.4.12",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties),\nwhich backs the \"config\" MBean and the config:* shell commands, derives the file\nit writes a configuration to from caller-supplied input without checking that\nthe result stays inside\u00a0${karaf.etc}:\n\n * if the submitted property map contains a\u00a0felix.fileinstall.filename\u00a0entry, that value is turned directly into a\u00a0File\u00a0(getCfgFileFromProperty), so it can poin [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<div><span>org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties)</span>,\nwhich backs the \"config\" MBean and the config:* shell commands, derives the file\nit writes a configuration to from caller-supplied input without checking that\nthe result stays inside <code>${karaf.etc}</code>:</div><div><ul><li>if the submitted property map contains a <code>felix.fileinstall.filename</code> entry, that value is turned directly into [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/op8trtz1qxkdwj2rjozhd9yt2yd6nhw4",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "n0mi1k <no...@gmail.com>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-91012",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/karaf/CVE-2026-91012.osv.json b/projects/karaf/CVE-2026-91012.osv.json
new file mode 100644
index 00000000..c8ed79cf
--- /dev/null
+++ b/projects/karaf/CVE-2026-91012.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-91012", "summary": "Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation", "details": "org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties),\nwhich backs the \"config\" MBean and the config:* shell commands, derives the file\nit writes a configuration to from caller-supplied input without checking that\nthe result stays inside ${karaf.etc}:\n\n * if the submitted property map contains a felix [...]
\ No newline at end of file
diff --git a/projects/karaf/CVE-2026-91048.cve.json b/projects/karaf/CVE-2026-91048.cve.json
new file mode 100644
index 00000000..e746ac19
--- /dev/null
+++ b/projects/karaf/CVE-2026-91048.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-862",
+ "lang": "en",
+ "cweId": "CWE-862",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Karaf",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "4.4.12",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "The\u00a0jdbc\u00a0shell command scope shipped no\u00a0org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no matching ACL rule as allowed, so any authenticated shell session (including one holding only the\u00a0viewer\u00a0role) could run every\u00a0jdbc:*\u00a0command.\u00a0jdbc:ds-create\u00a0stores a fully attacker-controlled JDBC URL into a\u00a0pax-jdbc-config\u00a0factory\u00a0Configuration\u00a0with no [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "The <code>jdbc</code> shell command scope shipped no <code>org.apache.karaf.command.acl.jdbc.cfg</code>. Karaf's command guard (<code>SecuredSessionFactoryImpl</code>) treats a command with no matching ACL rule as <b>allowed</b>, so any authenticated shell session (including one holding only the <code>viewer</code> role) could run every <code>jdbc:*</code> command. <code>jdbc:ds-create</code> stores a fully attacker-con [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/ph3867mxh2tft75w0o1hpn10f5mbmw32",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "MopMonk-AI <mo...@tophant.com>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-91048",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/karaf/CVE-2026-91048.osv.json b/projects/karaf/CVE-2026-91048.osv.json
new file mode 100644
index 00000000..f991522f
--- /dev/null
+++ b/projects/karaf/CVE-2026-91048.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-91048", "summary": "Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create", "details": "The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no matching ACL rule as allowed, so any authenticated shell session (including one holding only the viewer role) could run every jdbc:* [...]
\ No newline at end of file
diff --git a/projects/karaf/CVE-2026-91085.cve.json b/projects/karaf/CVE-2026-91085.cve.json
new file mode 100644
index 00000000..4d502680
--- /dev/null
+++ b/projects/karaf/CVE-2026-91085.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "config:install missing ACL entry allows privilege escalation to admin",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-862",
+ "lang": "en",
+ "cweId": "CWE-862",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Karaf",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "4.4.12",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.<scope>.cfg).\u00a0SecuredSessionFactoryImpl.checkSecurity()\u00a0resolves the roles required for an invocation and, when no ACL rule matches the command, fails open:\u00a0ACLConfigurationParser.Specificity.NO_MATCH\u00a0sets\u00a0passCheck = true. The safety valve for this,\u00a0karaf.secured.command.compulsory.roles, ships commented out in\u00 [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (<code>etc/org.apache.karaf.command.acl.<scope>.cfg</code>). <code>SecuredSessionFactoryImpl.checkSecurity()</code> resolves the roles required for an invocation and, when no ACL rule matches the command, <b>fails open</b>: <code>ACLConfigurationParser.Specificity.NO_MATCH</code> sets <code>passCheck = true</code>. The safety valve for this,&nb [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://karaf.apache.org/security/cve-2026-91085.txt",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Rin Ray <ri...@gmail.com>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-91085",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/karaf/CVE-2026-91085.osv.json b/projects/karaf/CVE-2026-91085.osv.json
new file mode 100644
index 00000000..ac149187
--- /dev/null
+++ b/projects/karaf/CVE-2026-91085.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-91085", "summary": "config:install missing ACL entry allows privilege escalation to admin", "details": "Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.<scope>.cfg). SecuredSessionFactoryImpl.checkSecurity() resolves the roles required for an invocation and, when no ACL rule matches the command, fails open: ACLConfigurationParser.Specificity.NO_MATCH sets passCheck = t [...]
\ No newline at end of file
diff --git a/projects/karaf/CVE-2026-92142.cve.json b/projects/karaf/CVE-2026-92142.cve.json
new file mode 100644
index 00000000..5032aeea
--- /dev/null
+++ b/projects/karaf/CVE-2026-92142.cve.json
@@ -0,0 +1,95 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Authorization bypass in JMX MBean lifecycle operations",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-862",
+ "lang": "en",
+ "cweId": "CWE-862",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Karaf",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "4.4.12",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Karaf exposes a JMX MBeanServer guarded by\u00a0KarafMBeanServerGuard, which enforces role-based access control (RBAC) on MBean operations invoked over the remote JMX connector (RMI registry/server, enabled by default on ports 1099 and 44444). The guard is implemented as a java.lang.reflect.Proxy\u00a0around the MBeanServer, and only forwards a fixed list of operation names to the RBAC check, defined in\u00a0MBeanInvocationHandler#guarded:\n\n\n\u00a0 private f [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Karaf exposes a JMX MBeanServer guarded by <code>KarafMBeanServerGuard</code>, which enforces role-based access control (RBAC) on MBean operations invoked over the remote JMX connector (RMI registry/server, enabled by default on ports 1099 and 44444). The guard is implemented as a j<code>ava.lang.reflect.Proxy</code> around the MBeanServer, and only forwards a fixed list of operation names to the RBAC check, defined in <code>MBeanInvocationHa [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://karaf.apache.org/security/cve-2026-92142.txt",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "MopMonk-AI <mo...@tophant.com>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-92142",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/karaf/CVE-2026-92142.osv.json b/projects/karaf/CVE-2026-92142.osv.json
new file mode 100644
index 00000000..75a14091
--- /dev/null
+++ b/projects/karaf/CVE-2026-92142.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-92142", "summary": "Authorization bypass in JMX MBean lifecycle operations", "details": "Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC) on MBean operations invoked over the remote JMX connector (RMI registry/server, enabled by default on ports 1099 and 44444). The guard is implemented as a java.lang.reflect.Proxy around the MBeanServer, and only forwards a fixed list of o [...]
\ No newline at end of file
diff --git a/projects/karaf/index.html b/projects/karaf/index.html
index fae526ba..d400706c 100644
--- a/projects/karaf/index.html
+++ b/projects/karaf/index.html
@@ -122,67 +122,172 @@
<ul>
<li>Baoquan Cui & Yucheng Qiu (reporter)</li>
</ul>
+<h2 id="CVE-2026-92142">Authorization bypass in JMX MBean lifecycle operations</h2>
+<p>CVE-2026-92142 <a href="https://cve.org/CVERecord?id=CVE-2026-92142">[CVE]</a> <a href="./CVE-2026-92142.cve.json">[CVE json]</a> <a href="./CVE-2026-92142.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-29T08:40:06.994Z</em></p>
+<h3 id="affected-1">Affected</h3>
+<ul>
+<li>Apache Karaf before 4.4.12</li>
+</ul>
+<h3 id="description-1">Description</h3>
+<p>Apache Karaf exposes a JMX MBeanServer guarded by <code>KarafMBeanServerGuard</code>, which enforces role-based access control (RBAC) on MBean operations invoked over the remote JMX connector (RMI registry/server, enabled by default on ports 1099 and 44444). The guard is implemented as a j<code>ava.lang.reflect.Proxy</code> around the MBeanServer, and only forwards a fixed list of operation names to the RBAC check, defined in <code>MBeanInvocationHandler#guarded</code>:<div><br></div> [...]
+<h3 id="references-1">References</h3>
+<ul>
+<li><a href="https://karaf.apache.org/security/cve-2026-92142.txt">https://karaf.apache.org/security/cve-2026-92142.txt</a></li>
+</ul>
+<h3 id="credits-1">Credits</h3>
+<ul>
+<li>MopMonk-AI <a href="mailto:mopmonk-ai@tophant.com">mopmonk-ai@tophant.com</a> (reporter)</li>
+</ul>
+<h2 id="CVE-2026-91085">config:install missing ACL entry allows privilege escalation to admin</h2>
+<p>CVE-2026-91085 <a href="https://cve.org/CVERecord?id=CVE-2026-91085">[CVE]</a> <a href="./CVE-2026-91085.cve.json">[CVE json]</a> <a href="./CVE-2026-91085.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-29T08:39:32.106Z</em></p>
+<h3 id="affected-2">Affected</h3>
+<ul>
+<li>Apache Karaf before 4.4.12</li>
+</ul>
+<h3 id="description-2">Description</h3>
+<p>Apache Karaf’s shell/SSH command security is enforced by per-scope ACL configuration files (<code>etc/org.apache.karaf.command.acl.<scope>.cfg</code>). <code>SecuredSessionFactoryImpl.checkSecurity()</code> resolves the roles required for an invocation and, when no ACL rule matches the command, <b>fails open</b>: <code>ACLConfigurationParser.Specificity.NO_MATCH</code> sets <code>passCheck = true</code>. The safety valve for this, <code>karaf.secured.command.compulsory.rol [...]
+<h3 id="references-2">References</h3>
+<ul>
+<li><a href="https://karaf.apache.org/security/cve-2026-91085.txt">https://karaf.apache.org/security/cve-2026-91085.txt</a></li>
+</ul>
+<h3 id="credits-2">Credits</h3>
+<ul>
+<li>Rin Ray <a href="mailto:rindilray@gmail.com">rindilray@gmail.com</a> (reporter)</li>
+</ul>
+<h2 id="CVE-2026-91048">Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create</h2>
+<p>CVE-2026-91048 <a href="https://cve.org/CVERecord?id=CVE-2026-91048">[CVE]</a> <a href="./CVE-2026-91048.cve.json">[CVE json]</a> <a href="./CVE-2026-91048.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-29T08:34:45.991Z</em></p>
+<h3 id="affected-3">Affected</h3>
+<ul>
+<li>Apache Karaf before 4.4.12</li>
+</ul>
+<h3 id="description-3">Description</h3>
+<p>The <code>jdbc</code> shell command scope shipped no <code>org.apache.karaf.command.acl.jdbc.cfg</code>. Karaf’s command guard (<code>SecuredSessionFactoryImpl</code>) treats a command with no matching ACL rule as <b>allowed</b>, so any authenticated shell session (including one holding only the <code>viewer</code> role) could run every <code>jdbc:<em></code> command. <code>jdbc:ds-create</code> stores a fully attacker-controlled JDBC URL into a <code>pax-jdbc-config</code> fact [...]
+<h3 id="references-3">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/ph3867mxh2tft75w0o1hpn10f5mbmw32">https://lists.apache.org/thread/ph3867mxh2tft75w0o1hpn10f5mbmw32</a></li>
+</ul>
+<h3 id="credits-3">Credits</h3>
+<ul>
+<li>MopMonk-AI <a href="mailto:mopmonk-ai@tophant.com">mopmonk-ai@tophant.com</a> (reporter)</li>
+</ul>
+<h2 id="CVE-2026-91012">Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation</h2>
+<p>CVE-2026-91012 <a href="https://cve.org/CVERecord?id=CVE-2026-91012">[CVE]</a> <a href="./CVE-2026-91012.cve.json">[CVE json]</a> <a href="./CVE-2026-91012.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-29T08:34:10.036Z</em></p>
+<h3 id="affected-4">Affected</h3>
+<ul>
+<li>Apache Karaf before 4.4.12</li>
+</ul>
+<h3 id="description-4">Description</h3>
+<div><span>org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties)</span>,
+which backs the "config" MBean and the config:* shell commands, derives the file
+it writes a configuration to from caller-supplied input without checking that
+the result stays inside <code>${karaf.etc}</code>:</div><div><ul><li>if the submitted property map contains a <code>felix.fileinstall.filename</code> entry, that value is turned directly into a <code>File</code> (<code>getCfgFileFromProperty</code>), so it can point to any absolute path the Karaf process can write to;</li><li>otherwise the configuration PID is concatenated verbatim into the target file name (<code>generateConfigFilename(): new File(karaf.etc, pid [...]
+<h3 id="references-4">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/op8trtz1qxkdwj2rjozhd9yt2yd6nhw4">https://lists.apache.org/thread/op8trtz1qxkdwj2rjozhd9yt2yd6nhw4</a></li>
+</ul>
+<h3 id="credits-4">Credits</h3>
+<ul>
+<li>n0mi1k <a href="mailto:nomilksec@gmail.com">nomilksec@gmail.com</a> (reporter)</li>
+</ul>
+<h2 id="CVE-2026-91006">OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)</h2>
+<p>CVE-2026-91006 <a href="https://cve.org/CVERecord?id=CVE-2026-91006">[CVE]</a> <a href="./CVE-2026-91006.cve.json">[CVE json]</a> <a href="./CVE-2026-91006.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-28T10:44:31.268Z</em></p>
+<h3 id="affected-5">Affected</h3>
+<ul>
+<li>Apache Karaf before 4.4.12</li>
+</ul>
+<h3 id="description-5">Description</h3>
+<p>Apache Karaf’s instance-management service (<code>InstanceServiceImpl</code>) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through <code>/bin/sh </code>(Unix) or <code>cscript</code> (Windows). The caller-supplied <code>javaOpts</code> value is spliced into that string unquoted. A javaOpts value containing shell metacharacters (<code>;</code>, <code>|</code>, <code>`</code>, <code>$(…)</code>) is interpreted by the she [...]
+<h3 id="references-5">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/olzy0yjw82b20w59vonfjr1x7v5yzocr">https://lists.apache.org/thread/olzy0yjw82b20w59vonfjr1x7v5yzocr</a></li>
+</ul>
+<h3 id="credits-5">Credits</h3>
+<ul>
+<li>n0mi1k <a href="mailto:nomilksec@gmail.com">nomilksec@gmail.com</a> (reporter)</li>
+</ul>
+<h2 id="CVE-2026-90979">LDAP filter injection in JAAS LDAP login modules</h2>
+<p>CVE-2026-90979 <a href="https://cve.org/CVERecord?id=CVE-2026-90979">[CVE]</a> <a href="./CVE-2026-90979.cve.json">[CVE json]</a> <a href="./CVE-2026-90979.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-28T09:34:23.941Z</em></p>
+<h3 id="affected-6">Affected</h3>
+<ul>
+<li>Apache Karaf before 4.4.12</li>
+</ul>
+<h3 id="description-6">Description</h3>
+<p><span>LDAPCache</span> and <code>LDAPBackingEngine</code> build LDAP search filters for user lookup and role lookup by textually substituting the placeholders <code>%u</code>, <code>%dn</code>, and <code>%fqdn</code> (drawn from the login name, the resolved user DN, and its fully qualified namespace form) into administrator-configured filter templates (<code>userFilter</code>, <code>roleFilter</code>). Before the fix, the only sanitization appli [...]
+<h3 id="references-6">References</h3>
+<ul>
+<li><a href="https://karaf.apache.org/security/cve-2026-90979.txt">https://karaf.apache.org/security/cve-2026-90979.txt</a></li>
+</ul>
+<h3 id="credits-6">Credits</h3>
+<ul>
+<li>Gjoko Krstic <a href="mailto:gjoko@zeroscience.mk">gjoko@zeroscience.mk</a> (reporter)</li>
+</ul>
<h2 id="CVE-2026-24656">Decanter log-socket collector has deserialization vulnerability</h2>
<p>CVE-2026-24656 <a href="https://cve.org/CVERecord?id=CVE-2026-24656">[CVE]</a> <a href="./CVE-2026-24656.cve.json">[CVE json]</a></p>
<p><em>Last updated: 2026-01-26T09:41:22.803Z</em></p>
-<h3 id="affected-1">Affected</h3>
+<h3 id="affected-7">Affected</h3>
<ul>
<li>Apache Karaf before 2.12.0</li>
<li>Apache Karaf at 2.12.0 unaffected</li>
</ul>
-<h3 id="description-1">Description</h3>
+<h3 id="description-7">Description</h3>
<p>Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter.</p><br>The Decanter log socket collector exposes the port 4560, without authentication. If the collector exposes allowed classes property, this configuration can be bypassed.<br>It means that the log socket collector is vulnerable to deserialization of untrusted data, eventually causing DoS.<br><br><br>NB: Decanter log socket collector is not installed by default. Users who have not installed Decanter log socket [...]
-<h3 id="references-1">References</h3>
+<h3 id="references-7">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/dc5wmdn6hyc992olntkl75kk04ndzx34">https://lists.apache.org/thread/dc5wmdn6hyc992olntkl75kk04ndzx34</a></li>
</ul>
-<h3 id="credits-1">Credits</h3>
+<h3 id="credits-7">Credits</h3>
<ul>
<li>r00t4dm (finder)</li>
</ul>
<h2 id="CVE-2024-34365">Cave SSRF and arbitrary file access</h2>
<p>CVE-2024-34365 <a href="https://cve.org/CVERecord?id=CVE-2024-34365">[CVE]</a> <a href="./CVE-2024-34365.cve.json">[CVE json]</a> <a href="./CVE-2024-34365.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2024-05-09T06:49:03.305Z</em></p>
-<h3 id="affected-2">Affected</h3>
+<h3 id="affected-8">Affected</h3>
<ul>
<li>Apache Karaf Cave through *</li>
</ul>
-<h3 id="description-2">Description</h3>
+<h3 id="description-8">Description</h3>
<p>** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Karaf Cave.<p>This issue affects all versions of Apache Karaf Cave.</p>As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.<p>NOTE: This vulnerability only affects products that are no longer supported by the maintainer.</p></p>
-<h3 id="references-2">References</h3>
+<h3 id="references-8">References</h3>
<ul>
<li><a href="https://karaf.apache.org/security/cve-2024-34365.txt">https://karaf.apache.org/security/cve-2024-34365.txt</a></li>
</ul>
-<h3 id="credits-2">Credits</h3>
+<h3 id="credits-8">Credits</h3>
<ul>
<li>cigar (finder)</li>
</ul>
<h2 id="CVE-2022-40145">JDBC JAAS LDAP injection</h2>
<p>CVE-2022-40145 <a href="https://cve.org/CVERecord?id=CVE-2022-40145">[CVE]</a> <a href="./CVE-2022-40145.cve.json">[CVE json]</a> <a href="./CVE-2022-40145.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-12-21T15:53:26.357Z</em></p>
-<h3 id="affected-3">Affected</h3>
+<h3 id="affected-9">Affected</h3>
<ul>
<li>Apache Karaf from 4.4.0 before 4.4.2</li>
<li>Apache Karaf before 4.3.8</li>
</ul>
-<h3 id="description-3">Description</h3>
+<h3 id="description-9">Description</h3>
<p><span style="background-color: rgb(255, 255, 255);">This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL.<br><br>The function jaas.modules.src.main.java.por</span><span style="background-color: rgb(255, 255, 255);">g.apache.karaf.jass.modules.</span><span style="background-color: rgb(255, 255, 255);">jdbc.JDBCUtils#doCreateDatasou</span><span style="background-color: rgb(255, 255, 255);">rce</span><br><sp [...]
-<h3 id="references-3">References</h3>
+<h3 id="references-9">References</h3>
<ul>
<li><a href="https://karaf.apache.org/security/cve-2022-40145.txt">https://karaf.apache.org/security/cve-2022-40145.txt</a></li>
</ul>
-<h3 id="credits-3">Credits</h3>
+<h3 id="credits-9">Credits</h3>
<ul>
<li>Xun Bai <a href="mailto:bbbbear68@gmail.com">bbbbear68@gmail.com</a> (reporter)</li>
</ul>
<h2 id="CVE-2022-22932">Path traversal flaws</h2>
<p>CVE-2022-22932 <a href="https://cve.org/CVERecord?id=CVE-2022-22932">[CVE]</a> <a href="./CVE-2022-22932.cve.json">[CVE json]</a> <a href="./CVE-2022-22932.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-01-25T14:53:17.546Z</em></p>
-<h3 id="affected-4">Affected</h3>
+<h3 id="affected-10">Affected</h3>
<ul>
<li>Apache Karaf from Apache Karaf before 4.2.15</li>
</ul>
-<h3 id="description-4">Description</h3>
+<h3 id="description-10">Description</h3>
<p>Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial
path traversal which allows to break out of expected folder.</p>
<p>The risk is low as obr:* commands are not very used and the entry is set by user.</p>
@@ -192,22 +297,22 @@ path traversal which allows to break out of expected folder.</p>
<p>Mitigation: Apache Karaf users should upgrade to 4.2.15 or 4.3.6
or later as soon as possible, or use correct path.</p>
<p>JIRA Tickets: <a href="https://issues.apache.org/jira/browse/KARAF-7326">https://issues.apache.org/jira/browse/KARAF-7326</a></p>
-<h3 id="references-4">References</h3>
+<h3 id="references-10">References</h3>
<ul>
<li><a href="https://karaf.apache.org/security/cve-2022-22932.txt">https://karaf.apache.org/security/cve-2022-22932.txt</a></li>
</ul>
-<h3 id="credits-4">Credits</h3>
+<h3 id="credits-10">Credits</h3>
<ul>
<li>This issue was discovered and reported by GHSL team member Jaroslav Lobacevski</li>
</ul>
<h2 id="CVE-2021-41766">Insecure Java Deserialization in Apache Karaf</h2>
<p>CVE-2021-41766 <a href="https://cve.org/CVERecord?id=CVE-2021-41766">[CVE]</a> <a href="./CVE-2021-41766.cve.json">[CVE json]</a> <a href="./CVE-2021-41766.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2022-01-25T14:39:43.793Z</em></p>
-<h3 id="affected-5">Affected</h3>
+<h3 id="affected-11">Affected</h3>
<ul>
<li>Apache Karaf from Apache Karaf before 4.3.6</li>
</ul>
-<h3 id="description-5">Description</h3>
+<h3 id="description-11">Description</h3>
<p>Apache Karaf allows monitoring of applications and the Java runtime by
using the Java Management Extensions (JMX).
JMX is a Java RMI based technology that relies on Java serialized
@@ -222,11 +327,11 @@ Generally speaking, deserialization of untrusted data does always
represent a high security risk and should be prevented.</p>
<p>The risk is low as, by default, Karaf uses a limited set of classes in the JMX server class path.
It depends of system scoped classes (e.g. jar in the lib folder).</p>
-<h3 id="references-5">References</h3>
+<h3 id="references-11">References</h3>
<ul>
<li><a href="https://karaf.apache.org/security/cve-2021-41766.txt">https://karaf.apache.org/security/cve-2021-41766.txt</a></li>
</ul>
-<h3 id="credits-5">Credits</h3>
+<h3 id="credits-11">Credits</h3>
<ul>
<li>This issue was reported by Daniel Heyne, Konstantin Samuel and Tobias Neitzel.</li>
</ul>
diff --git a/projects/polaris/CVE-2026-97395.cve.json b/projects/polaris/CVE-2026-97395.cve.json
new file mode 100644
index 00000000..38df3e6d
--- /dev/null
+++ b/projects/polaris/CVE-2026-97395.cve.json
@@ -0,0 +1,83 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials",
+ "source": {
+ "discovery": "INTERNAL"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Polaris",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThan": "1.8.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata.\n\n\nIn versions < 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use those settings to construct its (server-side) FileIO client. If the catalog storage configuration does not override the endpoint, Polaris can send storage requests to a hos [...]
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata.<div><br></div><div>In versions < 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use those settings to construct its (server-side) FileIO client. If the catalog storage configuration does not override the endpoint, Polaris can send stor [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread.html/nrk339vtlkpsjw3mg4mqw52j0167wyph",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "vignesh a <im...@gmail.com>",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-97395",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/polaris/CVE-2026-97395.osv.json b/projects/polaris/CVE-2026-97395.osv.json
new file mode 100644
index 00000000..9b8412f2
--- /dev/null
+++ b/projects/polaris/CVE-2026-97395.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-97395", "summary": "Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials", "details": "Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata.\n\n\nIn versions < 1.8.0, when Polaris performs server-side Iceberg operations, [...]
\ No newline at end of file
diff --git a/projects/polaris/index.html b/projects/polaris/index.html
index a680b6dc..e9d2a684 100644
--- a/projects/polaris/index.html
+++ b/projects/polaris/index.html
@@ -110,31 +110,48 @@
</ul>
<h1 id="advisories">Advisories</h1>
<p class="bg-warning">This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the project security pages linked above. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public <a href="/mailinglist">mailinglist</a> or privately on <a href="mailto:security@apache.org">security@apache.org</a></p>
+<h2 id="CVE-2026-97395">Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials</h2>
+<p>CVE-2026-97395 <a href="https://cve.org/CVERecord?id=CVE-2026-97395">[CVE]</a> <a href="./CVE-2026-97395.cve.json">[CVE json]</a> <a href="./CVE-2026-97395.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-29T13:57:28.261Z</em></p>
+<h3 id="affected">Affected</h3>
+<ul>
+<li>Apache Polaris before 1.8.0</li>
+</ul>
+<h3 id="description">Description</h3>
+<p>Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata.<div><br></div><div>In versions < 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use those settings to construct its (server-side) FileIO client. If the catalog storage configuration does not override the endpoint, Polaris can send storage requests to a hos [...]
+<h3 id="references">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread.html/nrk339vtlkpsjw3mg4mqw52j0167wyph">https://lists.apache.org/thread.html/nrk339vtlkpsjw3mg4mqw52j0167wyph</a></li>
+</ul>
+<h3 id="credits">Credits</h3>
+<ul>
+<li>vignesh a <a href="mailto:imavignesh27@gmail.com">imavignesh27@gmail.com</a> (reporter)</li>
+</ul>
<h2 id="CVE-2026-64640">register endpoint reads attacker-controlled storage location before allowed-locations validation</h2>
<p>CVE-2026-64640 <a href="https://cve.org/CVERecord?id=CVE-2026-64640">[CVE]</a> <a href="./CVE-2026-64640.cve.json">[CVE json]</a> <a href="./CVE-2026-64640.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-06T09:08:05.017Z</em></p>
-<h3 id="affected">Affected</h3>
+<h3 id="affected-1">Affected</h3>
<ul>
<li>Apache Polaris through 1.6.0</li>
</ul>
-<h3 id="description">Description</h3>
+<h3 id="description-1">Description</h3>
<p>Apache Polaris did not consistently validate storage locations supplied during table and view registration.<br><br><div>An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog’s storage credentials to read a caller-selected Iceberg metadata file before verifying that the file was within the catalog’s allowed storage locations.</div><div>If the catalog’s und [...]
-<h3 id="references">References</h3>
+<h3 id="references-1">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/scd8p9wy8b9j3om5wohbotpfycnmmjl4">https://lists.apache.org/thread/scd8p9wy8b9j3om5wohbotpfycnmmjl4</a></li>
</ul>
-<h3 id="credits">Credits</h3>
+<h3 id="credits-1">Credits</h3>
<ul>
<li>Andrea Cosentino (finder)</li>
</ul>
<h2 id="CVE-2026-42812">write.metadata.path changes could bypass location validation and broaden delegated storage access</h2>
<p>CVE-2026-42812 <a href="https://cve.org/CVERecord?id=CVE-2026-42812">[CVE]</a> <a href="./CVE-2026-42812.cve.json">[CVE json]</a> <a href="./CVE-2026-42812.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-04T16:28:09.922Z</em></p>
-<h3 id="affected-1">Affected</h3>
+<h3 id="affected-2">Affected</h3>
<ul>
<li>Apache Polaris before 1.4.1</li>
</ul>
-<h3 id="description-1">Description</h3>
+<h3 id="description-2">Description</h3>
<p><span style="background-color: rgb(255, 255, 255);">In Apache Iceberg, the table’s metadata files are control files: they tell readers
which data files belong to the table and which table version to read.
<br><br>
@@ -194,18 +211,18 @@ reduce the persisted / credential-vending variant, but it does not prevent
the
underlying defect: Polaris still skips the intended pre-write location check
when only <code>write.metadata.path</code> changes.</span><br></p>
-<h3 id="references-1">References</h3>
+<h3 id="references-2">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/wxd2wj3p0smvrk84msv317wg5tp3jtw9">https://lists.apache.org/thread/wxd2wj3p0smvrk84msv317wg5tp3jtw9</a></li>
</ul>
<h2 id="CVE-2026-42811">could broaden vended GCS credentials through unescaped identifier content in access-boundary CEL conditions</h2>
<p>CVE-2026-42811 <a href="https://cve.org/CVERecord?id=CVE-2026-42811">[CVE]</a> <a href="./CVE-2026-42811.cve.json">[CVE json]</a> <a href="./CVE-2026-42811.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-04T16:26:53.369Z</em></p>
-<h3 id="affected-2">Affected</h3>
+<h3 id="affected-3">Affected</h3>
<ul>
<li>Apache Polaris before 1.4.1</li>
</ul>
-<h3 id="description-2">Description</h3>
+<h3 id="description-3">Description</h3>
<p><span style="background-color: rgb(255, 255, 255);">In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials
that
only work for one table’s files, but a crafted namespace or table name can
@@ -252,18 +269,18 @@ effectively bucket-wide within the configured bucket.
privileges for setup. A separate least-privilege Polaris RBAC variant
has not yet been tested on GCS. However, the storage-credential
broadening behavior itself has been confirmed on GCS.</span></span><br></p>
-<h3 id="references-2">References</h3>
+<h3 id="references-3">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/hovn5hmkj9wj7v9cd8sn67svg03klgvg">https://lists.apache.org/thread/hovn5hmkj9wj7v9cd8sn67svg03klgvg</a></li>
</ul>
<h2 id="CVE-2026-42810">could broaden vended S3 credentials through wildcard-bearing namespace or table names</h2>
<p>CVE-2026-42810 <a href="https://cve.org/CVERecord?id=CVE-2026-42810">[CVE]</a> <a href="./CVE-2026-42810.cve.json">[CVE json]</a> <a href="./CVE-2026-42810.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-04T16:48:47.000Z</em></p>
-<h3 id="affected-3">Affected</h3>
+<h3 id="affected-4">Affected</h3>
<ul>
<li>Apache Polaris before 1.4.1</li>
</ul>
-<h3 id="description-3">Description</h3>
+<h3 id="description-4">Description</h3>
<p><span style="background-color: rgb(255, 255, 255);">Apache Polaris accepts literal <code>*</code> characters in namespace and table names. When it
later builds temporary S3 access policies for delegated table access, those
same characters appear to be reused unescaped in S3 IAM resource patterns
@@ -309,18 +326,18 @@ problem. The confirmed write-capable variant means the issue is not limited
to
disclosure.</span><br></li>
</ul>
-<h3 id="references-3">References</h3>
+<h3 id="references-4">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/gg3qq9sqg4hdjmprqy46p40xmln61dm9">https://lists.apache.org/thread/gg3qq9sqg4hdjmprqy46p40xmln61dm9</a></li>
</ul>
<h2 id="CVE-2026-42809">staged table creation could vend storage credentials for unvalidated locations</h2>
<p>CVE-2026-42809 <a href="https://cve.org/CVERecord?id=CVE-2026-42809">[CVE]</a> <a href="./CVE-2026-42809.cve.json">[CVE json]</a> <a href="./CVE-2026-42809.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-05-04T16:36:14.167Z</em></p>
-<h3 id="affected-4">Affected</h3>
+<h3 id="affected-5">Affected</h3>
<ul>
<li>Apache Polaris before 1.4.1</li>
</ul>
-<h3 id="description-4">Description</h3>
+<h3 id="description-5">Description</h3>
<p><span style="background-color: rgb(255, 255, 255);">Apache Polaris can issue broad temporary (“vended”) storage credentials during
staged
table creation before the effective table location has been validated or
@@ -344,7 +361,7 @@ credential vending. Those fields are secondary to the main custom-<code>location
exploit, but they are still attacker-influenced location inputs that should
be
validated before any credentials are issued.</span><br></p>
-<h3 id="references-4">References</h3>
+<h3 id="references-5">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/8tfsr8y7pgq6rdcvjx95hkcr47td671r">https://lists.apache.org/thread/8tfsr8y7pgq6rdcvjx95hkcr47td671r</a></li>
</ul>
diff --git a/projects/qpid/CVE-2026-92550.cve.json b/projects/qpid/CVE-2026-92550.cve.json
new file mode 100644
index 00000000..319916b1
--- /dev/null
+++ b/projects/qpid/CVE-2026-92550.cve.json
@@ -0,0 +1,103 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoder",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-789 Memory allocation with excessive size value",
+ "lang": "en",
+ "cweId": "CWE-789",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Qpid Broker-J",
+ "collectionURL": "https://repo.maven.apache.org/maven2",
+ "packageName": "org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol",
+ "packageURL": "pkg:maven/org.apache.qpid/qpid-broker-plugins-amqp-0-8-protocol",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThanOrEqual": "10.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade to version 10.1.1, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<div>A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.</div><div>This issue affects Apache Qpid Broker-J: through 10.1.0.</div><div>Users are recommended to upgrade to version 10.1.1, which fixes the issue.</div>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/56w1kxz9h23q364ffyvj7cssdhnld5dq",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Khaled Suliman of AISLE Research",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "n0mi1k",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-92550",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/qpid/CVE-2026-92550.osv.json b/projects/qpid/CVE-2026-92550.osv.json
new file mode 100644
index 00000000..4dd42f0e
--- /dev/null
+++ b/projects/qpid/CVE-2026-92550.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-92550", "summary": "Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoder", "details": "A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade to version 10.1.1, which fixes the issue.", "affected": [{"ranges": [...]
\ No newline at end of file
diff --git a/projects/qpid/CVE-2026-92560.cve.json b/projects/qpid/CVE-2026-92560.cve.json
new file mode 100644
index 00000000..bf951bd7
--- /dev/null
+++ b/projects/qpid/CVE-2026-92560.cve.json
@@ -0,0 +1,98 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoder",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-770 Allocation of resources without limits or throttling",
+ "lang": "en",
+ "cweId": "CWE-770",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Qpid Broker-J",
+ "collectionURL": "https://repo.maven.apache.org/maven2",
+ "packageName": "org.apache.qpid:qpid-broker-plugins-amqp-0-10-protocol",
+ "packageURL": "pkg:maven/org.apache.qpid/qpid-broker-plugins-amqp-0-10-protocol",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThanOrEqual": "10.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade to version 10.1.1, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<div>A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.</div><div>This issue affects Apache Qpid Broker-J: through 10.1.0.</div><div>Users are recommended to upgrade to version 10.1.1, which fixes the issue.</div>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/dcsjw242n1bxdog29hwlg43r5611dtb7",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "n0mi1k",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-92560",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/qpid/CVE-2026-92560.osv.json b/projects/qpid/CVE-2026-92560.osv.json
new file mode 100644
index 00000000..ad0fa935
--- /dev/null
+++ b/projects/qpid/CVE-2026-92560.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-92560", "summary": "Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoder", "details": "A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade to version 10.1.1, which fixes the issue.", "affected": [{"ranges": [{"type" [...]
\ No newline at end of file
diff --git a/projects/qpid/CVE-2026-92564.cve.json b/projects/qpid/CVE-2026-92564.cve.json
new file mode 100644
index 00000000..0d82f9cb
--- /dev/null
+++ b/projects/qpid/CVE-2026-92564.cve.json
@@ -0,0 +1,97 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-674 Uncontrolled Recursion",
+ "lang": "en",
+ "cweId": "CWE-674",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Qpid Broker-J",
+ "collectionURL": "https://repo.maven.apache.org/maven2",
+ "packageName": "org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThanOrEqual": "10.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade to version 10.1.1, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<div>A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.</div><div>This issue affects Apache Qpid Broker-J: through 10.1.0.</div><div>Users are recommended to upgrade to version 10.1.1, which fixes the issue.</div>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/hw4jkngtkzf0dxdj9mv3z2p71mkpjvx4",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "n0mi1k",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-92564",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/qpid/CVE-2026-92564.osv.json b/projects/qpid/CVE-2026-92564.osv.json
new file mode 100644
index 00000000..082136a5
--- /dev/null
+++ b/projects/qpid/CVE-2026-92564.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-92564", "summary": "Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing", "details": "A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade to version 10.1.1, which fixes the issue.", "affected": [{"ranges": [{"typ [...]
\ No newline at end of file
diff --git a/projects/qpid/CVE-2026-92573.cve.json b/projects/qpid/CVE-2026-92573.cve.json
new file mode 100644
index 00000000..79cacd8b
--- /dev/null
+++ b/projects/qpid/CVE-2026-92573.cve.json
@@ -0,0 +1,103 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON rendering",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-409 Improper handling of highly compressed data (data amplification)",
+ "lang": "en",
+ "cweId": "CWE-409",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Qpid Broker-J",
+ "collectionURL": "https://repo.maven.apache.org/maven2",
+ "packageName": "org.apache.qpid:qpid-broker-core",
+ "packageURL": "pkg:maven/org.apache.qpid/qpid-broker-core",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThanOrEqual": "10.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP management JSON rendering allows authenticated message producers to exhaust memory and disrupt broker availability via processing without a decompressed-output limit.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade to version 10.1.1, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<div>Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP management JSON rendering allows authenticated message producers to exhaust memory and disrupt broker availability via processing without a decompressed-output limit.</div><div>This issue affects Apache Qpid Broker-J: through 10.1.0.</div><div>Users are recommended to upgrade to version 10.1.1, which fixe [...]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/461lhqt1r4g1mq3oyrcscphxzlhxlv1y",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Khaled Suliman of AISLE Research",
+ "type": "finder"
+ },
+ {
+ "lang": "en",
+ "value": "n0mi1k",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-92573",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/qpid/CVE-2026-92573.osv.json b/projects/qpid/CVE-2026-92573.osv.json
new file mode 100644
index 00000000..7bc12ccf
--- /dev/null
+++ b/projects/qpid/CVE-2026-92573.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-92573", "summary": "Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON rendering", "details": "Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP management JSON rendering allows authenticated message producers to exhaust memory and disrupt broker availability via processing wit [...]
\ No newline at end of file
diff --git a/projects/qpid/CVE-2026-92608.cve.json b/projects/qpid/CVE-2026-92608.cve.json
new file mode 100644
index 00000000..5474c890
--- /dev/null
+++ b/projects/qpid/CVE-2026-92608.cve.json
@@ -0,0 +1,97 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-248 Uncaught exception",
+ "lang": "en",
+ "cweId": "CWE-248",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Qpid Broker-J",
+ "collectionURL": "https://repo.maven.apache.org/maven2",
+ "packageName": "org.apache.qpid:qpid-broker-plugins-amqp-msg-conv-0-10-to-1-0",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThanOrEqual": "10.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQP 0-10 consumers via message properties that the target encoder does not handle correctly.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade to version 10.1.1, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<div>Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQP 0-10 consumers via message properties that the target encoder does not handle correctly.</div><div>This issue affects Apache Qpid Broker-J: through 10.1.0.</div><div>Users are recommended to upgrade to version 10.1.1, which fixes the issue.</div>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/rklst4cz1g0nkpzkpho7kjmy4gnx1ppc",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "moderate"
+ }
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "n0mi1k",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-92608",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/qpid/CVE-2026-92608.osv.json b/projects/qpid/CVE-2026-92608.osv.json
new file mode 100644
index 00000000..c703fd2d
--- /dev/null
+++ b/projects/qpid/CVE-2026-92608.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-92608", "summary": "Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10", "details": "Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQP 0-10 consumers via message properties that the target encoder does not handle correctly.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade t [...]
\ No newline at end of file
diff --git a/projects/qpid/CVE-2026-92609.cve.json b/projects/qpid/CVE-2026-92609.cve.json
new file mode 100644
index 00000000..412a7802
--- /dev/null
+++ b/projects/qpid/CVE-2026-92609.cve.json
@@ -0,0 +1,97 @@
+{
+ "containers": {
+ "cna": {
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "title": "Missing HTTP-session renewal after successful authentication",
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "description": "CWE-384 Session fixation",
+ "lang": "en",
+ "cweId": "CWE-384",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "affected": [
+ {
+ "vendor": "Apache Software Foundation",
+ "product": "Apache Qpid Broker-J",
+ "collectionURL": "https://repo.maven.apache.org/maven2",
+ "packageName": "org.apache.qpid:qpid-broker-plugins-management-http",
+ "versions": [
+ {
+ "status": "affected",
+ "version": "0",
+ "lessThanOrEqual": "10.1.0",
+ "versionType": "semver"
+ }
+ ],
+ "defaultStatus": "unaffected"
+ }
+ ],
+ "descriptions": [
+ {
+ "value": "Session fixation in HTTP management authentication allows remote\u00a0attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade to version 10.1.1, which fixes the issue.",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "<div>Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication.</div><div>This issue affects Apache Qpid Broker-J: through 10.1.0.</div><div>Users are recommended to upgrade to version 10.1.1, which fixes the issue.</div>"
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "url": "https://lists.apache.org/thread/93w83oro48cqokb24k8tkogyvtlqhqw6",
+ "tags": [
+ "vendor-advisory"
+ ]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "type": "Textual description of severity",
+ "content": {
+ "text": "important"
+ }
+ },
+ "scenarios": [
+ {
+ "lang": "en",
+ "value": "GENERAL"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Abhishek Kushwaha",
+ "type": "reporter"
+ }
+ ],
+ "x_generator": {
+ "engine": "Vulnogram 1.0.3"
+ }
+ }
+ },
+ "cveMetadata": {
+ "cveId": "CVE-2026-92609",
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
\ No newline at end of file
diff --git a/projects/qpid/CVE-2026-92609.osv.json b/projects/qpid/CVE-2026-92609.osv.json
new file mode 100644
index 00000000..e6b81d3b
--- /dev/null
+++ b/projects/qpid/CVE-2026-92609.osv.json
@@ -0,0 +1 @@
+{"schema_version": "1.6.1", "id": "CVE-2026-92609", "summary": "Missing HTTP-session renewal after successful authentication", "details": "Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade to version 10.1.1, which fixes the iss [...]
\ No newline at end of file
diff --git a/projects/qpid/index.html b/projects/qpid/index.html
index 4375b5c7..ea1e66d8 100644
--- a/projects/qpid/index.html
+++ b/projects/qpid/index.html
@@ -105,150 +105,254 @@
<p>Do you want disclose a potential security issue for Apache Qpid? Send your report to the <a href="mailto:security@apache.org?subject=Qpid">Apache Security Team</a>.</p>
<h1 id="advisories">Advisories</h1>
<p class="bg-warning">This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public <a href="/mailinglist">mailinglist</a> or privately on <a href="mailto:security@apache.org">security@apache.org</a></p>
+<h2 id="CVE-2026-92609">Missing HTTP-session renewal after successful authentication</h2>
+<p>CVE-2026-92609 <a href="https://cve.org/CVERecord?id=CVE-2026-92609">[CVE]</a> <a href="./CVE-2026-92609.cve.json">[CVE json]</a> <a href="./CVE-2026-92609.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-25T07:44:08.860Z</em></p>
+<h3 id="affected">Affected</h3>
+<ul>
+<li>Apache Qpid Broker-J through 10.1.0</li>
+</ul>
+<h3 id="description">Description</h3>
+<div>Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication.</div><div>This issue affects Apache Qpid Broker-J: through 10.1.0.</div><div>Users are recommended to upgrade to version 10.1.1, which fixes the issue.</div>
+<h3 id="references">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/93w83oro48cqokb24k8tkogyvtlqhqw6">https://lists.apache.org/thread/93w83oro48cqokb24k8tkogyvtlqhqw6</a></li>
+</ul>
+<h3 id="credits">Credits</h3>
+<ul>
+<li>Abhishek Kushwaha (reporter)</li>
+</ul>
+<h2 id="CVE-2026-92608">Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10</h2>
+<p>CVE-2026-92608 <a href="https://cve.org/CVERecord?id=CVE-2026-92608">[CVE]</a> <a href="./CVE-2026-92608.cve.json">[CVE json]</a> <a href="./CVE-2026-92608.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-25T07:44:25.207Z</em></p>
+<h3 id="affected-1">Affected</h3>
+<ul>
+<li>Apache Qpid Broker-J through 10.1.0</li>
+</ul>
+<h3 id="description-1">Description</h3>
+<div>Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQP 0-10 consumers via message properties that the target encoder does not handle correctly.</div><div>This issue affects Apache Qpid Broker-J: through 10.1.0.</div><div>Users are recommended to upgrade to version 10.1.1, which fixes the issue.</div>
+<h3 id="references-1">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/rklst4cz1g0nkpzkpho7kjmy4gnx1ppc">https://lists.apache.org/thread/rklst4cz1g0nkpzkpho7kjmy4gnx1ppc</a></li>
+</ul>
+<h3 id="credits-1">Credits</h3>
+<ul>
+<li>n0mi1k (reporter)</li>
+</ul>
+<h2 id="CVE-2026-92573">Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON rendering</h2>
+<p>CVE-2026-92573 <a href="https://cve.org/CVERecord?id=CVE-2026-92573">[CVE]</a> <a href="./CVE-2026-92573.cve.json">[CVE json]</a> <a href="./CVE-2026-92573.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-25T08:11:10.361Z</em></p>
+<h3 id="affected-2">Affected</h3>
+<ul>
+<li>Apache Qpid Broker-J through 10.1.0</li>
+</ul>
+<h3 id="description-2">Description</h3>
+<div>Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP management JSON rendering allows authenticated message producers to exhaust memory and disrupt broker availability via processing without a decompressed-output limit.</div><div>This issue affects Apache Qpid Broker-J: through 10.1.0.</div><div>Users are recommended to upgrade to version 10.1.1, which fixes the issue.</div>
+<h3 id="references-2">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/461lhqt1r4g1mq3oyrcscphxzlhxlv1y">https://lists.apache.org/thread/461lhqt1r4g1mq3oyrcscphxzlhxlv1y</a></li>
+</ul>
+<h3 id="credits-2">Credits</h3>
+<ul>
+<li>Khaled Suliman of AISLE Research (finder)</li>
+<li>n0mi1k (reporter)</li>
+</ul>
+<h2 id="CVE-2026-92564">Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing</h2>
+<p>CVE-2026-92564 <a href="https://cve.org/CVERecord?id=CVE-2026-92564">[CVE]</a> <a href="./CVE-2026-92564.cve.json">[CVE json]</a> <a href="./CVE-2026-92564.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-25T07:59:28.765Z</em></p>
+<h3 id="affected-3">Affected</h3>
+<ul>
+<li>Apache Qpid Broker-J through 10.1.0</li>
+</ul>
+<h3 id="description-3">Description</h3>
+<div>A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.</div><div>This issue affects Apache Qpid Broker-J: through 10.1.0.</div><div>Users are recommended to upgrade to version 10.1.1, which fixes the issue.</div>
+<h3 id="references-3">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/hw4jkngtkzf0dxdj9mv3z2p71mkpjvx4">https://lists.apache.org/thread/hw4jkngtkzf0dxdj9mv3z2p71mkpjvx4</a></li>
+</ul>
+<h3 id="credits-3">Credits</h3>
+<ul>
+<li>n0mi1k (reporter)</li>
+</ul>
+<h2 id="CVE-2026-92560">Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoder</h2>
+<p>CVE-2026-92560 <a href="https://cve.org/CVERecord?id=CVE-2026-92560">[CVE]</a> <a href="./CVE-2026-92560.cve.json">[CVE json]</a> <a href="./CVE-2026-92560.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-25T08:16:59.991Z</em></p>
+<h3 id="affected-4">Affected</h3>
+<ul>
+<li>Apache Qpid Broker-J through 10.1.0</li>
+</ul>
+<h3 id="description-4">Description</h3>
+<div>A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.</div><div>This issue affects Apache Qpid Broker-J: through 10.1.0.</div><div>Users are recommended to upgrade to version 10.1.1, which fixes the issue.</div>
+<h3 id="references-4">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/dcsjw242n1bxdog29hwlg43r5611dtb7">https://lists.apache.org/thread/dcsjw242n1bxdog29hwlg43r5611dtb7</a></li>
+</ul>
+<h3 id="credits-4">Credits</h3>
+<ul>
+<li>n0mi1k (reporter)</li>
+</ul>
+<h2 id="CVE-2026-92550">Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoder</h2>
+<p>CVE-2026-92550 <a href="https://cve.org/CVERecord?id=CVE-2026-92550">[CVE]</a> <a href="./CVE-2026-92550.cve.json">[CVE json]</a> <a href="./CVE-2026-92550.osv.json">[OSV json]</a></p>
+<p><em>Last updated: 2026-09-25T08:17:37.786Z</em></p>
+<h3 id="affected-5">Affected</h3>
+<ul>
+<li>Apache Qpid Broker-J through 10.1.0</li>
+</ul>
+<h3 id="description-5">Description</h3>
+<div>A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.</div><div>This issue affects Apache Qpid Broker-J: through 10.1.0.</div><div>Users are recommended to upgrade to version 10.1.1, which fixes the issue.</div>
+<h3 id="references-5">References</h3>
+<ul>
+<li><a href="https://lists.apache.org/thread/56w1kxz9h23q364ffyvj7cssdhnld5dq">https://lists.apache.org/thread/56w1kxz9h23q364ffyvj7cssdhnld5dq</a></li>
+</ul>
+<h3 id="credits-5">Credits</h3>
+<ul>
+<li>Khaled Suliman of AISLE Research (finder)</li>
+<li>n0mi1k (reporter)</li>
+</ul>
<h2 id="CVE-2026-68080">Unbounded echo flow responses can lead to denial of service</h2>
<p>CVE-2026-68080 <a href="https://cve.org/CVERecord?id=CVE-2026-68080">[CVE]</a> <a href="./CVE-2026-68080.cve.json">[CVE json]</a> <a href="./CVE-2026-68080.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-05T05:51:18.656Z</em></p>
-<h3 id="affected">Affected</h3>
+<h3 id="affected-6">Affected</h3>
<ul>
<li>Apache Qpid Broker-J through 10.0.1</li>
</ul>
-<h3 id="description">Description</h3>
+<h3 id="description-6">Description</h3>
<div>It was not possible to govern the rate at which the broker would respond to an echo flow, enabling an authenticated attacker to cause excessive resource usage and potential denial of service.</div><div>This issue affects Apache Qpid Broker-J: through 10.0.1.</div><div>Users are recommended to upgrade to version 10.1.0, which fixes the issue.</div>
-<h3 id="references">References</h3>
+<h3 id="references-6">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/tcnrv5nhmnsrzz92o4owxgycro6llt57">https://lists.apache.org/thread/tcnrv5nhmnsrzz92o4owxgycro6llt57</a></li>
</ul>
<h2 id="CVE-2026-68078">Unable to govern the maximum number of transfer frames per incoming delivery</h2>
<p>CVE-2026-68078 <a href="https://cve.org/CVERecord?id=CVE-2026-68078">[CVE]</a> <a href="./CVE-2026-68078.cve.json">[CVE json]</a> <a href="./CVE-2026-68078.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-05T05:43:32.321Z</em></p>
-<h3 id="affected-1">Affected</h3>
+<h3 id="affected-7">Affected</h3>
<ul>
<li>Apache Qpid Broker-J through 10.0.1</li>
</ul>
-<h3 id="description-1">Description</h3>
+<h3 id="description-7">Description</h3>
<div>It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service.</div><div>This issue affects Apache Qpid Broker-J: through 10.0.1.</div><div>Users are recommended to upgrade to version 10.1.0, which fixes the issue.</div>
-<h3 id="references-1">References</h3>
+<h3 id="references-7">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/m8gs6pfp1fmbgwcjr8zsgn95hfh15f8o">https://lists.apache.org/thread/m8gs6pfp1fmbgwcjr8zsgn95hfh15f8o</a></li>
</ul>
<h2 id="CVE-2026-68077">Unbounded disposition range handling can lead to denial of service</h2>
<p>CVE-2026-68077 <a href="https://cve.org/CVERecord?id=CVE-2026-68077">[CVE]</a> <a href="./CVE-2026-68077.cve.json">[CVE json]</a> <a href="./CVE-2026-68077.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-05T05:41:03.741Z</em></p>
-<h3 id="affected-2">Affected</h3>
+<h3 id="affected-8">Affected</h3>
<ul>
<li>Apache Qpid Broker-J through 10.0.1</li>
</ul>
-<h3 id="description-2">Description</h3>
+<h3 id="description-8">Description</h3>
<div>An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service.</div><div>This issue affects Apache Qpid Broker-J: through 10.0.1.</div><div>Users are recommended to upgrade to version 10.1.0, which fixes the issue.</div>
-<h3 id="references-2">References</h3>
+<h3 id="references-8">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/gzc78gdrlw2711v8jzgmsto8bqvg28y8">https://lists.apache.org/thread/gzc78gdrlw2711v8jzgmsto8bqvg28y8</a></li>
</ul>
<h2 id="CVE-2026-68075">Incoming session flow control window can be exceeded</h2>
<p>CVE-2026-68075 <a href="https://cve.org/CVERecord?id=CVE-2026-68075">[CVE]</a> <a href="./CVE-2026-68075.cve.json">[CVE json]</a> <a href="./CVE-2026-68075.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-05T05:35:58.182Z</em></p>
-<h3 id="affected-3">Affected</h3>
+<h3 id="affected-9">Affected</h3>
<ul>
<li>Apache Qpid Broker-J through 10.0.1</li>
</ul>
-<h3 id="description-3">Description</h3>
+<h3 id="description-9">Description</h3>
<div>An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.</div><div>This issue affects Apache Qpid Broker-J: through 10.0.1.</div><div>Users are recommended to upgrade to version 10.1.0, which fixes the issue.</div>
-<h3 id="references-3">References</h3>
+<h3 id="references-9">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/lht725jgkowmyyjl039roffg6pyvbxz0">https://lists.apache.org/thread/lht725jgkowmyyjl039roffg6pyvbxz0</a></li>
</ul>
<h2 id="CVE-2026-68074">Unbounded symbol value caching can lead to pre-authentication resource exhaustion</h2>
<p>CVE-2026-68074 <a href="https://cve.org/CVERecord?id=CVE-2026-68074">[CVE]</a> <a href="./CVE-2026-68074.cve.json">[CVE json]</a> <a href="./CVE-2026-68074.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-05T05:19:51.744Z</em></p>
-<h3 id="affected-4">Affected</h3>
+<h3 id="affected-10">Affected</h3>
<ul>
<li>Apache Qpid Broker-J through 10.0.1</li>
</ul>
-<h3 id="description-4">Description</h3>
+<h3 id="description-10">Description</h3>
<div>A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service.</div><div>This issue affects Apache Qpid Broker-J: through 10.0.1.</div><div>Users are recommended to upgrade to version 10.1.0, which fixes the issue.</div>
-<h3 id="references-4">References</h3>
+<h3 id="references-10">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/9t1pvl36z69ssww6449od5g0tszqnhjs">https://lists.apache.org/thread/9t1pvl36z69ssww6449od5g0tszqnhjs</a></li>
</ul>
<h2 id="CVE-2026-68073">Unbounded type nesting can lead to pre-authentication stack overflow</h2>
<p>CVE-2026-68073 <a href="https://cve.org/CVERecord?id=CVE-2026-68073">[CVE]</a> <a href="./CVE-2026-68073.cve.json">[CVE json]</a> <a href="./CVE-2026-68073.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-05T05:32:20.617Z</em></p>
-<h3 id="affected-5">Affected</h3>
+<h3 id="affected-11">Affected</h3>
<ul>
<li>Apache Qpid Broker-J through 10.0.1</li>
</ul>
-<h3 id="description-5">Description</h3>
+<h3 id="description-11">Description</h3>
<div>A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.</div><div>This issue affects Apache Qpid Broker-J: through 10.0.1.</div><div>Users are recommended to upgrade to version 10.1.0, which fixes the issue.</div>
-<h3 id="references-5">References</h3>
+<h3 id="references-11">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/djz1gnrk882vzjo8rykyf9bnywqbvwwr">https://lists.apache.org/thread/djz1gnrk882vzjo8rykyf9bnywqbvwwr</a></li>
</ul>
<h2 id="CVE-2026-68060">Type size/count handling can lead to excessive allocation pre-authentication</h2>
<p>CVE-2026-68060 <a href="https://cve.org/CVERecord?id=CVE-2026-68060">[CVE]</a> <a href="./CVE-2026-68060.cve.json">[CVE json]</a> <a href="./CVE-2026-68060.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-05T05:26:23.306Z</em></p>
-<h3 id="affected-6">Affected</h3>
+<h3 id="affected-12">Affected</h3>
<ul>
<li>Apache Qpid Broker-J through 10.0.1</li>
</ul>
-<h3 id="description-6">Description</h3>
+<h3 id="description-12">Description</h3>
<div>A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.</div><div>This issue affects Apache Qpid Broker-J: through 10.0.1.</div><div>Users are recommended to upgrade to version 10.1.0, which fixes the issue.</div>
-<h3 id="references-6">References</h3>
+<h3 id="references-12">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/0slvl8h25w3z4opnh08yyn8l3chko5c9">https://lists.apache.org/thread/0slvl8h25w3z4opnh08yyn8l3chko5c9</a></li>
</ul>
<h2 id="CVE-2026-67592">Unable to govern the maximum number of transfer frames per incoming delivery</h2>
<p>CVE-2026-67592 <a href="https://cve.org/CVERecord?id=CVE-2026-67592">[CVE]</a> <a href="./CVE-2026-67592.cve.json">[CVE json]</a> <a href="./CVE-2026-67592.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-05T05:44:14.457Z</em></p>
-<h3 id="affected-7">Affected</h3>
+<h3 id="affected-13">Affected</h3>
<ul>
<li>Apache Qpid ProtonJ2 through 1.1.0</li>
</ul>
-<h3 id="description-7">Description</h3>
+<h3 id="description-13">Description</h3>
<div>It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service.</div><div>This issue affects Apache Qpid ProtonJ2: through 1.1.0.</div><div>Users are recommended to upgrade to version 1.2.0, which fixes the issue</div>
-<h3 id="references-7">References</h3>
+<h3 id="references-13">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/b4pv9hfdk7ox78pss77sb4nzwjrvqhhz">https://lists.apache.org/thread/b4pv9hfdk7ox78pss77sb4nzwjrvqhhz</a></li>
</ul>
<h2 id="CVE-2026-67591">Incoming session flow control window can be exceeded</h2>
<p>CVE-2026-67591 <a href="https://cve.org/CVERecord?id=CVE-2026-67591">[CVE]</a> <a href="./CVE-2026-67591.cve.json">[CVE json]</a> <a href="./CVE-2026-67591.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-05T05:38:21.990Z</em></p>
-<h3 id="affected-8">Affected</h3>
+<h3 id="affected-14">Affected</h3>
<ul>
<li>Apache Qpid ProtonJ2 through 1.1.0</li>
</ul>
-<h3 id="description-8">Description</h3>
+<h3 id="description-14">Description</h3>
<div>An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.</div><div>This issue affects Apache Qpid ProtonJ2: through 1.1.0.</div><div>Users are recommended to upgrade to version 1.2.0, which fixes the issue.</div>
-<h3 id="references-8">References</h3>
+<h3 id="references-14">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/rwmggh2bkm6qotxpdfcplht3jgw5n036">https://lists.apache.org/thread/rwmggh2bkm6qotxpdfcplht3jgw5n036</a></li>
</ul>
<h2 id="CVE-2026-67590">Unbounded type nesting can lead to pre-authentication stackoverflow</h2>
<p>CVE-2026-67590 <a href="https://cve.org/CVERecord?id=CVE-2026-67590">[CVE]</a> <a href="./CVE-2026-67590.cve.json">[CVE json]</a> <a href="./CVE-2026-67590.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-05T05:33:34.406Z</em></p>
-<h3 id="affected-9">Affected</h3>
+<h3 id="affected-15">Affected</h3>
<ul>
<li>Apache Qpid ProtonJ2 through 1.1.0</li>
</ul>
-<h3 id="description-9">Description</h3>
+<h3 id="description-15">Description</h3>
<div>A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.</div><div>This issue affects Apache Qpid ProtonJ2: through 1.1.0.</div><div>Users are recommended to upgrade to version 1.2.0, which fixes the issue.</div>
-<h3 id="references-9">References</h3>
+<h3 id="references-15">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/kmov6k7f3moqy01m1s370fl61vgos3ly">https://lists.apache.org/thread/kmov6k7f3moqy01m1s370fl61vgos3ly</a></li>
</ul>
<h2 id="CVE-2026-67589">Type size/count handling can lead to excessive allocation pre-authentication</h2>
<p>CVE-2026-67589 <a href="https://cve.org/CVERecord?id=CVE-2026-67589">[CVE]</a> <a href="./CVE-2026-67589.cve.json">[CVE json]</a> <a href="./CVE-2026-67589.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-05T05:28:10.043Z</em></p>
-<h3 id="affected-10">Affected</h3>
+<h3 id="affected-16">Affected</h3>
<ul>
<li>Apache Qpid ProtonJ2 through 1.1.0</li>
</ul>
-<h3 id="description-10">Description</h3>
+<h3 id="description-16">Description</h3>
<div>A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.</div><div>This issue affects Apache Qpid ProtonJ2: through 1.1.0.</div><div>Users are recommended to upgrade to version 1.2.0, which fixes the issue.</div>
-<h3 id="references-10">References</h3>
+<h3 id="references-16">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/bs24x4778dh72xtfs299cy8krvdlo47q">https://lists.apache.org/thread/bs24x4778dh72xtfs299cy8krvdlo47q</a></li>
</ul>
-<h3 id="credits">Credits</h3>
+<h3 id="credits-6">Credits</h3>
<ul>
<li>Apache Qpid security team (finder)</li>
<li><a href="mailto:xxy010605@gmail.com">xxy010605@gmail.com</a> (reporter)</li>
@@ -256,169 +360,169 @@
<h2 id="CVE-2026-67588">Unbounded symbol value caching can lead to pre-authentication resource exhaustion</h2>
<p>CVE-2026-67588 <a href="https://cve.org/CVERecord?id=CVE-2026-67588">[CVE]</a> <a href="./CVE-2026-67588.cve.json">[CVE json]</a> <a href="./CVE-2026-67588.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-05T05:21:39.842Z</em></p>
-<h3 id="affected-11">Affected</h3>
+<h3 id="affected-17">Affected</h3>
<ul>
<li>Apache Qpid ProtonJ2 through 1.1.0</li>
</ul>
-<h3 id="description-11">Description</h3>
+<h3 id="description-17">Description</h3>
<div>A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service.</div><div>This issue affects Apache Qpid ProtonJ2: through 1.1.0.</div><div>Users are recommended to upgrade to version 1.2.0, which fixes the issue.</div>
-<h3 id="references-11">References</h3>
+<h3 id="references-17">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/vk4j02dzggfdrdkwvzmqo4jro2tgj0jt">https://lists.apache.org/thread/vk4j02dzggfdrdkwvzmqo4jro2tgj0jt</a></li>
</ul>
<h2 id="CVE-2026-67555">Unable to govern the maximum number of transfer frames per incoming delivery</h2>
<p>CVE-2026-67555 <a href="https://cve.org/CVERecord?id=CVE-2026-67555">[CVE]</a> <a href="./CVE-2026-67555.cve.json">[CVE json]</a> <a href="./CVE-2026-67555.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-05T05:43:53.150Z</em></p>
-<h3 id="affected-12">Affected</h3>
+<h3 id="affected-18">Affected</h3>
<ul>
<li>Apache Qpid Proton Dotnet through 1.0.0</li>
</ul>
-<h3 id="description-12">Description</h3>
+<h3 id="description-18">Description</h3>
<div>It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service</div><div>This issue affects Apache Qpid Proton-Dotnet: through 1.0.0.</div><div>Users are recommended to upgrade to version 1.1.0, which fixes the issue.</div>
-<h3 id="references-12">References</h3>
+<h3 id="references-18">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/dwrb02dp714lvlfxdj4o5bc9h3z54sw3">https://lists.apache.org/thread/dwrb02dp714lvlfxdj4o5bc9h3z54sw3</a></li>
</ul>
<h2 id="CVE-2026-67554">Unbounded disposition range handling can lead to denial of service</h2>
<p>CVE-2026-67554 <a href="https://cve.org/CVERecord?id=CVE-2026-67554">[CVE]</a> <a href="./CVE-2026-67554.cve.json">[CVE json]</a> <a href="./CVE-2026-67554.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-05T05:41:21.799Z</em></p>
-<h3 id="affected-13">Affected</h3>
+<h3 id="affected-19">Affected</h3>
<ul>
<li>Apache Qpid Proton Dotnet through 1.0.0</li>
</ul>
-<h3 id="description-13">Description</h3>
+<h3 id="description-19">Description</h3>
<div>An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service.</div><div>This issue affects Apache Qpid Proton-Dotnet: through 1.0.0.</div><div>Users are recommended to upgrade to version 1.1.0, which fixes the issue.</div>
-<h3 id="references-13">References</h3>
+<h3 id="references-19">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/5ndlowz29464ytj98gz9z9ljhwnmb2hm">https://lists.apache.org/thread/5ndlowz29464ytj98gz9z9ljhwnmb2hm</a></li>
</ul>
<h2 id="CVE-2026-67553">Incoming session flow control window can be exceeded</h2>
<p>CVE-2026-67553 <a href="https://cve.org/CVERecord?id=CVE-2026-67553">[CVE]</a> <a href="./CVE-2026-67553.cve.json">[CVE json]</a> <a href="./CVE-2026-67553.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-05T05:37:23.826Z</em></p>
-<h3 id="affected-14">Affected</h3>
+<h3 id="affected-20">Affected</h3>
<ul>
<li>Apache Qpid Proton Dotnet through 1.0.0</li>
</ul>
-<h3 id="description-14">Description</h3>
+<h3 id="description-20">Description</h3>
<div>An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.</div><div>This issue affects Apache Qpid Proton-Dotnet: through 1.0.0.</div><div>Users are recommended to upgrade to version 1.1.0, which fixes the issue.</div>
-<h3 id="references-14">References</h3>
+<h3 id="references-20">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/hvsncmcbgjrn85crs909nf4y3dqqrywo">https://lists.apache.org/thread/hvsncmcbgjrn85crs909nf4y3dqqrywo</a></li>
</ul>
<h2 id="CVE-2026-67552">Unbounded type nesting can lead to pre-authentication stackoverflow</h2>
<p>CVE-2026-67552 <a href="https://cve.org/CVERecord?id=CVE-2026-67552">[CVE]</a> <a href="./CVE-2026-67552.cve.json">[CVE json]</a> <a href="./CVE-2026-67552.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-05T05:32:53.769Z</em></p>
-<h3 id="affected-15">Affected</h3>
+<h3 id="affected-21">Affected</h3>
<ul>
<li>Apache Qpid Proton Dotnet through 1.0.0</li>
</ul>
-<h3 id="description-15">Description</h3>
+<h3 id="description-21">Description</h3>
<div>A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.</div><div>This issue affects Apache Qpid Proton-Dotnet through 1.0.0.</div><div>Users are recommended to upgrade to version 1.1.0, which fixes the issue</div>
-<h3 id="references-15">References</h3>
+<h3 id="references-21">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/4dyg0gycrv55ox4oywqght61b053g8xj">https://lists.apache.org/thread/4dyg0gycrv55ox4oywqght61b053g8xj</a></li>
</ul>
<h2 id="CVE-2026-67551">Type size/count handling can lead to excessive allocation pre-authentication</h2>
<p>CVE-2026-67551 <a href="https://cve.org/CVERecord?id=CVE-2026-67551">[CVE]</a> <a href="./CVE-2026-67551.cve.json">[CVE json]</a> <a href="./CVE-2026-67551.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-05T05:27:20.446Z</em></p>
-<h3 id="affected-16">Affected</h3>
+<h3 id="affected-22">Affected</h3>
<ul>
<li>Apache Qpid Proton Dotnet through 1.0.0</li>
</ul>
-<h3 id="description-16">Description</h3>
+<h3 id="description-22">Description</h3>
<div> pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.</div><div>This issue affects Apache Qpid Proton-Dotnet: through 1.0.0.</div><div>Users are recommended to upgrade to version 1.1.0, which fixes the issue.</div>
-<h3 id="references-16">References</h3>
+<h3 id="references-22">References</h3>
<ul>
<li><a href="https://lists.apache.org/thread/o566fhkrr3gg0lyzt24xwvz9w94oo6ro">https://lists.apache.org/thread/o566fhkrr3gg0lyzt24xwvz9w94oo6ro</a></li>
</ul>
<h2 id="CVE-2026-67465">Unbounded symbol value caching can lead to pre-authentication resource exhaustion</h2>
<p>CVE-2026-67465 <a href="https://cve.org/CVERecord?id=CVE-2026-67465">[CVE]</a> <a href="./CVE-2026-67465.cve.json">[CVE json]</a> <a href="./CVE-2026-67465.osv.json">[OSV json]</a></p>
<p><em>Last updated: 2026-08-05T05:21:00.415Z</em></p>
... 8945 lines suppressed ...