SB20260824160 - Multiple vulnerabilities in Apache Airflow

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260824160

SB20260824160 - Multiple vulnerabilities in Apache Airflow

Published: August 24, 2026

Security Bulletin ID SB20260824160
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 12
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 25% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 12 vulnerabilities.


1) Code Injection (CVE-ID: CVE-2026-58076)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper control of code generation in BaseSerialization.deserialize when deserializing exception nodes from a serialized Dag blob. A remote user can place a crafted value in executor_config to execute arbitrary code.

The code may run in the scheduler during normal Dag deserialization and in the API server when an authenticated read of the Dag occurs.


2) Information disclosure (CVE-ID: CVE-2026-59244)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper handling of secret masking in the Rendered Templates UI when rendering templates that reference `var.json` Variable values stored as dictionaries. A remote user can view a task's Rendered Templates page to disclose sensitive information.

Only JSON Variable values with dictionary content referenced through `var.json` are exposed in cleartext.


3) Deserialization of Untrusted Data (CVE-ID: CVE-2026-59242)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to instantiate arbitrary airflow.* classes on the API server.

The vulnerability exists due to deserialization of untrusted data in the XCom deserialize endpoint when reading an XCom entry with deserialize=true. A remote user can write an XCom value and then read it back to instantiate arbitrary airflow.* classes on the API server.

Exploitation requires XCom write-and-read access through the API.


4) Information disclosure (CVE-ID: CVE-2026-54183)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper handling of recursion-depth limits in the secrets masker in the Variables UI when rendering deeply nested variable values stored inside a list, tuple, or set. A remote user can view a variable in the UI to disclose sensitive information.

The exposure is limited to values displayed in the UI and does not bypass existing access controls.


5) Deserialization of Untrusted Data (CVE-ID: CVE-2026-67260)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to unsafe deserialization in the scheduler awaiting_input task-state sweep when deserializing task instance next_kwargs. A remote user can control that value through the task execution API to execute arbitrary code.

The issue can also terminate the scheduler job. The vulnerable code path runs unconditionally every 15 seconds and is reached by human-in-the-loop tasks in the awaiting_input state.


6) Deserialization of Untrusted Data (CVE-ID: CVE-2026-67587)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to unsafe deserialization in the Task SDK `Callback` object reconstruction path when deserializing serialized callback data during the scheduler's awaiting_input timeout sweep. A remote user can control a task instance's `next_kwargs` through the task execution API to execute arbitrary code.

No non-default configuration is required, and the vulnerable code path is reached unconditionally by the scheduler sweep.


7) Information disclosure (CVE-ID: CVE-2026-65017)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the Config API when handling configuration-read requests in multi-team deployments. A remote user can read a team-scoped Celery broker URL with embedded credentials in cleartext to disclose sensitive information.

The issue occurs when multi-team mode is enabled and the Config API is exposed, and the affected user has configuration-read access without prior access to the secret.


8) Incorrect authorization (CVE-ID: CVE-2026-68968)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass authorization and modify backfills belonging to other dags.

The vulnerability exists due to improper access control in the Backfill API when handling a crafted backfill id path segment that is interpreted inconsistently during authorization and route processing. A remote user can send a specially crafted request to bypass authorization and modify backfills belonging to other dags.

No non-default configuration is required, and sequential backfill ids make target discovery trivial.


9) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-68969)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper handling of sensitive information in the bulk Variable and Connection audit logging logic when processing bulk update requests to the variables and connections API endpoints. A remote user can submit a bulk request and read the resulting audit log entries to disclose sensitive information.

The issue affects secret values in Variable entries and Connection extra contents, including secrets submitted through the UI import action that uses the bulk variables endpoint.


10) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-68970)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper masking of sensitive data in Task SDK Variable handling when rendering task logs or the Rendered Templates UI for Variables whose JSON value is a top-level list. A remote user can read a task log or rendered template that references such a Variable to disclose sensitive information.

No special configuration is required, and only top-level list-shaped JSON Variable values are exposed unmasked.


11) Improper Authorization (CVE-ID: CVE-2026-68971)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to trigger dag runs for another team and disclose another team's XCom values.

The vulnerability exists due to improper access control in the asset materialization endpoint and the XCom result check on wait_dag_run_until_finished when handling requests for team-scoped dags. A remote user can send crafted requests with their own dag_run_id and conf to trigger dag runs for another team and disclose another team's XCom values.

Only deployments running multi-team mode with a team-aware auth manager are vulnerable. Deployments using the FAB auth manager are unaffected.


12) Improper access control (CVE-ID: CVE-2026-68076)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause the application to authenticate outward using another team's connection credentials.

The vulnerability exists due to improper access control in the connections test API and environment-variable secrets backend when handling a connection test request in multi-team mode. A remote user can send a specially crafted request referencing another team's encoded connection identifier to cause the application to authenticate outward using another team's connection credentials.

Exploitation requires multi-team mode enabled, connection testing enabled, team-scoped secrets provisioned as environment variables in the API-server process, and knowledge of the encoded identifier. The endpoint uses the credentials rather than returning them.


Remediation

Install update from vendor's website.

References