Apache Airflow (Python) – Support, CVEs & Health

GHSA-22hf-vx2v-gjff CVSS_V3

Apache Airflow exposes deferred trigger kwargs in task-instance API responses

Published: 2026-07-07 Fixed in: 3.3.0

GHSA-2522-mrjc-m688 CVSS_V3

Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used

Published: 2024-04-18 Fixed in: 2.9.0

GHSA-269x-pg5c-5xgm CVSS_V3

Apache Airflow Execution with Unnecessary Privileges

Published: 2023-08-05 Fixed in: 2.6.0b1

GHSA-273c-4g26-4jpm CVSS_V3

Apache Airflow `/api/v2/dagReports` executes DAG Python in API

Published: 2025-10-30 Fixed in: 3.1.1

GHSA-2883-wwh7-x57v CVSS_V3

Apache Airflow: Incomplete redaction allowlist exposes secrets in Connection `extra` to read-permitted users

Published: 2026-06-01 Fixed in: 3.2.2

GHSA-2943-9672-r45w CVSS_V3

Apache Airflow allows code execution through unsafe serialized DAG deserialization

Published: 2026-07-07 Fixed in: 3.3.0

GHSA-2h84-3crq-vgfj CVSS_V3

Apache Airflow Incorrect Authorization vulnerability

Published: 2023-07-12 Fixed in: 2.6.3

GHSA-2qjv-p2gc-mjg2 CVSS_V3

Apache Airflow Task SDK Callback deserialization can import arbitrary modules in the scheduler

Published: 2026-08-12 Fixed in: 3.3.1

GHSA-2r5m-76wx-56gx CVSS_V3

Apache Airflow Vulnerable to Deserialization of Untrusted Data

Published: 2026-06-01 Fixed in: 3.2.2

GHSA-32wr-qqw6-5mfp CVSS_V3

Apache Airflow vulnerable to sensitive information exposure

Published: 2023-10-14 Fixed in: 2.7.2

Apache Airflow