SB20260825102 - Multiple vulnerabilities in Apache Airflow
Published: August 25, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 11 vulnerabilities.
1) Improper access control (CVE-ID: CVE-2026-34538)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the DagRun wait endpoint when handling requests for DagRun wait results. A remote user can retrieve XCom result values to disclose sensitive information.
The issue affects users with DAG Run read permissions, such as the Viewer role, who should not be able to access XCom as a separate protected resource.
2) Insufficient Session Expiration (CVE-ID: CVE-2025-57735)
CWE-ID: CWE-613 - Insufficient Session Expiration
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to reuse a previously issued JWT token after logout.
The vulnerability exists due to improper session expiration in the logout functionality when handling logout requests. A remote user can use an intercepted token after the associated user logs out to reuse a previously issued JWT token after logout.
Exploitation requires interception of a valid JWT token before logout.
3) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2025-66236)
CWE-ID: CWE-532 - Information Exposure Through Log Files
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper handling of sensitive information in DAG run logs UI when displaying task logs. A remote user can view logged secrets from the Airflow configuration file to disclose sensitive information.
4) Deserialization of Untrusted Data (CVE-ID: CVE-2026-33858)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code in the webserver context.
The vulnerability exists due to unsafe deserialization in the XCom API when processing crafted XCom payloads containing legacy serialization keys. A remote user can craft a malicious XCom payload to execute arbitrary code in the webserver context.
The issue affects Dag Authors who normally should not be able to execute code in the webserver context.
5) Deserialization of Untrusted Data (CVE-ID: CVE-2025-54550)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on the worker.
The vulnerability exists due to unsafe deserialization in the example_xcom DAG example when reading a value from XCom. A remote user can modify XCom values to execute arbitrary code on the worker.
Exploitation requires access to modify XComs through the UI.
6) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-31987)
CWE-ID: CWE-532 - Information Exposure Through Log Files
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to impersonate Dag Authors.
The vulnerability exists due to exposure of sensitive information in task logs when logging JWT tokens used by tasks. A remote user can read exposed tokens from logs to impersonate Dag Authors.
Only UI users with access to the affected logs can exploit this issue.
7) Information Exposure Through an Error Message (CVE-ID: CVE-2026-30912)
CWE-ID: CWE-209 - Information Exposure Through an Error Message
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper error handling in the API when handling SQL errors. A remote attacker can trigger a constraint error to disclose sensitive information.
The issue occurs even when stack trace exposure is disabled through the relevant API setting.
8) Information disclosure (CVE-ID: CVE-2026-32690)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper redaction in variable secret masking when retrieving variables saved as JSON dictionaries with nested secret fields. A remote user can retrieve a specially crafted variable value to disclose sensitive information.
Only variables storing sensitive values in JSON form with nested fields are affected.
9) Command injection (CVE-ID: CVE-2026-30898)
CWE-ID: CWE-77 - Command injection
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute code on a worker.
The vulnerability exists due to command injection in the BashOperator example DAG code when passing user-supplied dag_run.conf values. A remote user can supply crafted input to escalate privileges and execute code on a worker.
The issue stems from unsafe documentation example code that may be copied into user-defined DAGs.
10) Improper access control (CVE-ID: CVE-2026-32228)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to trigger dags they had no access to.
The vulnerability exists due to improper access control in the UI/API asset materialization functionality when processing asset materialization requests. A remote user can trigger dags they are not authorized to access to trigger dags they had no access to.
11) Deserialization of Untrusted Data (CVE-ID: CVE-2026-25917)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code in the webserver context.
The vulnerability exists due to unsafe deserialization and class instantiation in the API extra-links handling for XCom payloads when processing a crafted XCom payload. A remote user can craft a malicious XCom payload to execute arbitrary code in the webserver context.
Exploitation requires Dag Author capabilities.
Remediation
Install update from vendor's website.
References
- https://lists.apache.org/api/email.lua?id=clzywkx8t4dftk9qgs5rw0lxw6orrovl
- https://github.com/apache/airflow/pull/64415
- https://lists.apache.org/api/email.lua?id=xlkvyjbrpmbocw1gjybnk3353ym3obh2
- https://github.com/apache/airflow/pull/61339
- https://lists.apache.org/api/email.lua?id=fr3fmj2thdzvtckt0hlhpzjg701zhsj1
- https://github.com/apache/airflow/pull/58662
- https://lists.apache.org/api/email.lua?id=y5hsqvz77721vmj2kh3xkfgz369yzx5d
- https://github.com/apache/airflow/pull/64148
- https://lists.apache.org/api/email.lua?id=xfvd1kg7ho2jlptg6ovhvj3vy6j5hyhj
- https://lists.apache.org/api/email.lua?id=2jprv94pfy6z53fjx763m3nyw4sb7731
- https://github.com/apache/airflow/pull/62964
- https://lists.apache.org/api/email.lua?id=9wjs6gf9cm9zj12373g7g4sdp570xp85
- https://github.com/apache/airflow/pull/63028
- https://lists.apache.org/api/email.lua?id=bq875fv20nzr91f5n84spjowtj1pn9gy
- https://github.com/apache/airflow/pull/63480
- https://lists.apache.org/api/email.lua?id=w5q5fwkrhr8ypgqhbyxgkx18l1r6z3y9
- https://github.com/apache/airflow/pull/64129
- https://lists.apache.org/api/email.lua?id=m9bxrx7syy7863z9n2g3o3xd3q70w4qm
- https://github.com/apache/airflow/pull/63338
- https://lists.apache.org/api/email.lua?id=zsnzbmz95psztzj4gd0ckjc08vgcc44s
- https://github.com/apache/airflow/pull/61641