https://spaceraccoon.github.io/vulnerability-spoiler-alert Vulnerability alerts for apache/airflow en-us Tue, 01 Sep 2026 14:23:07 GMT https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/601 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/601 Tue, 25 Aug 2026 19:09:08 GMT In multi-team mode, Apache Airflow mounted team-scoped plugin FastAPI apps without any authorization middleware. Any authenticated user could access endpoints intended only for members of a specific team, leading to unauthorized data access and privilege escalation. The patch adds TeamAuthorizationMiddleware to enforce team membership on team-scoped plugin mounts. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/513 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/513 Thu, 20 Aug 2026 15:32:19 GMT When 'core.multi_team' is enabled, calling Variable.set() with a team_name on an existing variable overwrote the variable's team ownership in the upsert ON CONFLICT DO UPDATE clause. This allowed a user from one team to hijack a global variable or a variable owned by another team, causing global or other-team lookups to fail (DoS) and unauthorized modification of variable ownership. The patch removes team_name from the update fields, preserving the existing owner. medium confirmed CVE-2026-68076 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/485 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/485 Wed, 19 Aug 2026 10:03:44 GMT The DELETE endpoints for asset queued events authorized the DAG axis with requires_access_dag(method="GET"), a read-level check, while performing a write operation that cancels a DAG's pending asset-triggered scheduling. A user with only read permission on a DAG but delete permission on the global Assets resource could delete queued events, suppressing that DAG's asset-triggered runs. The patch changes the DAG axis to require edit (PUT), preventing unauthorized writes to DAG scheduling state. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/465 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/465 Tue, 18 Aug 2026 18:01:50 GMT The GET /api/v2/assets/events endpoint returned AssetEvent rows for all Dags without enforcing per-Dag authorization, relying only on the global 'Assets' resource check. A user with read access to only one Dag and global asset read could retrieve event details (source Dag, task, run identifiers, and task-authored 'extra' payloads) from other Dags. The patch adds PermittedAssetEventFilter to scope events to the Dags the caller may read, while keeping events with no source Dag visible. high confirmed CVE-2026-68971 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/464 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/464 Tue, 18 Aug 2026 17:48:18 GMT Before the patch, Azure AD id_tokens were decoded with only signature verification against Microsoft's common multi-tenant key set. The token's issuer and audience were not enforced, so any correctly signed token from any Azure AD tenant could be accepted by the Airflow OAuth login. This allowed an attacker to log in as an arbitrary user or gain admin roles if the token contained forged roles, leading to authentication bypass and potential privilege escalation. The patch pins the iss claim to the configured tenant and the aud claim to the application's client_id, and rejects configurations that do not identify a single tenant. critical verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/433 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/433 Mon, 17 Aug 2026 22:39:00 GMT The example_dms system test DAG created an AWS RDS PostgreSQL instance with PubliclyAccessible=True and a security group allowing inbound TCP 5432 from 0.0.0.0/0, while using hardcoded credentials (username 'username', password 'rds_password'). An attacker could connect to the database over the internet and read or modify data. The patch sets PubliclyAccessible=False, scopes ingress to the VPC CIDR, and optionally uses provided private subnet groups. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/427 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/427 Mon, 17 Aug 2026 21:01:24 GMT Before the patch, team names allowed uppercase letters and double underscores. The secrets backend upper-cases team names to build environment variable names for team-scoped secrets, causing teams whose names differ only by case to resolve to the same namespace and share secrets. An attacker who can create a team can choose a name like 'Data_Eng' to read the Connections and Variables of the existing team 'data_eng'. high confirmed CVE-2026-68076 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/406 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/406 Tue, 11 Aug 2026 11:55:40 GMT The Calendar view endpoint computes planned runs for cron-based timetables by iterating croniter until the year boundary with no upper bound, unlike the generic timetable path which caps at MAX_PLANNED_RUNS. Any authenticated user with Dag read access can create/view a Dag with a high-frequency cron schedule (e.g., a seconds-resolution cron) and trigger minutes of CPU consumption per request just by opening the Calendar tab, allowing them to pin/exhaust an API server worker with minimal effort. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/370 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/370 Wed, 05 Aug 2026 04:33:16 GMT The BaseSerialization.deserialize method used import_string() on an attacker-controlled class name embedded in serialized DAG blobs (AIRFLOW_EXC_SER/BASE_EXC_SER nodes) to reconstruct exception objects. Because import_string will import arbitrary modules and access arbitrary attributes by dotted name, a crafted serialized DAG could cause the deserializer to import and execute code from any importable module (including modules with import-time side effects, or builtins like eval/os.system), leading to code execution or unintended behavior when a malicious/tampered serialized DAG is loaded. The patch restricts resolution to already-loaded classes validated as AirflowException subclasses or a fixed builtin allow-list, preventing import of attacker-named modules/classes. Patch landed 7 days 16 hours 6 minutes before CVE-2026-58076 was published. high confirmed CVE-2026-58076 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/359 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/359 Tue, 04 Aug 2026 14:14:14 GMT Configuration options registered as sensitive (like database connection strings with passwords) were only masked when queried under their base section name. Team-scoped overrides stored in `\[<team>=<section>\]` config sections or `AIRFLOW__<TEAM>___<SECTION>__<KEY>` environment variables bypassed the sensitivity check entirely, exposing secrets like database credentials in clear text via the config API and `as_dict()` output. Patch landed 8 days 5 hours 11 minutes before CVE-2026-65017 was published. medium confirmed CVE-2026-65017