VulertSecurity VulertSecurity

Vulnerability Database · PyPI · apache-airflow · Version

apache-airflow 2.10.3

2.10.3 is affected by 73 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 3.3.2.

Critical 4 High 15 Medium 54 Low 0 Unrated 0

All apache-airflow versions & vulnerabilities → Source repository Search the database for this package →
Released 05 Nov 2024 Licence non-standard Also known from other sources 67 Newer releases 300 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

apache-airflow 2.10.3 vulnerabilities

73 vulnerabilities cover apache-airflow 2.10.3. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
Apache Airflow allows code execution through unsafe serialized DAG deserialization 9.8 critical 3.3.0 07 Jul 2026
CVE-2026-33264: Apache Airflow Remote Code Execution Vulnerability via Unrestricted Deserialization 9.8 critical 3.3.0 07 Jul 2026
CVE-2024-42447: Apache Airflow Providers FAB Insufficient Session Expiration Vulnerability 9.8 critical No fix published 05 Aug 2024
CVE-2023-25693: Apache Airflow Sqoop Provider Improper Input Validation Vulnerability 9.8 critical 3.1.1 24 Feb 2023
CVE-2024-45498: Apache Airflow Arbitrary Command Execution Vulnerability 8.8 high No fix published 07 Sep 2024
CVE-2024-56373: Apache Airflow Code Injection Vulnerability in LogTemplate Table 8.4 high 2.11.1 13 Jul 2026
CVE-2024-56373: Apache Airflow Code Injection Vulnerability via LogTemplate Table 8.4 high 2.11.1 24 Feb 2026
CVE-2025-54550: Apache Airflow RCE Vulnerability via Race Condition in example_xcom DAG 8.1 high 3.2.0 13 Jul 2026
CVE-2025-54550: Apache Airflow RCE Vulnerability in example_xcom DAG 8.1 high 3.2.0 16 Apr 2026
CVE-2026-68968: Apache Airflow Backfill API Cross-DAG Authorization Bypass Vulnerability 7.5 high 3.3.1 12 Aug 2026
CVE-2026-68968: Apache Airflow Backfill API Authorization Flaw 7.5 high 3.3.1 12 Aug 2026
CVE-2026-30912: Apache Airflow SQL Error Exposure Vulnerability 7.5 high 3.2.0 18 Apr 2026
CVE-2025-68675: Apache Airflow Proxy Credentials Leakage in Task Logs 7.5 high 3.1.6 16 Jan 2026
CVE-2025-68675: Apache Airflow Proxy Credential Exposure Vulnerability 7.5 high 3.1.6 16 Jan 2026
CVE-2026-45360: Apache Airflow Arbitrary Class Import Vulnerability 7.3 high 3.2.2 01 Jun 2026
CVE-2026-45360: Apache Airflow Arbitrary Class Path Import Vulnerability 7.3 high 3.2.2 01 Jun 2026
CVE-2026-40961: Apache Airflow Authenticated User URL Bypass Vulnerability 7.2 high 3.2.2 13 Jul 2026
CVE-2026-40961: Apache Airflow Authenticated User URL Bypass Vulnerability 7.2 high 3.2.2 01 Jun 2026
CVE-2026-25917: Apache Airflow Arbitrary Code Execution via XCom Payload 7.2 high 3.2.0 18 Apr 2026
CVE-2026-48828: Apache Airflow Exposes Sensitive JSON Variable Values Through Bulk Variables API 6.5 medium 3.3.0 10 Sep 2026
CVE-2026-68970: Apache Airflow Task SDK Exposes Secrets in List-Shaped JSON Variables 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-68971: Apache Airflow Cross-Team Dag Actions and XCom Read Vulnerability 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-68969: Apache Airflow Secrets Exposure via Bulk Endpoints 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-59244: Apache Airflow Exposes Sensitive Dict-Valued Secrets in Rendered Templates 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-68969: Apache Airflow Audit Log Exposes Secrets in Cleartext 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-68971: Apache Airflow Team-Scope Bypass Vulnerability 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-68970: Apache Airflow Task SDK Exposes Secrets in Logs 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-59244: Apache Airflow Secrets Masking Failure Exposes Sensitive Data 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-42358: Apache Airflow Vulnerable to Exposure of Sensitive Information 6.5 medium 3.2.2 13 Jul 2026
CVE-2026-25219: Apache Airflow Sensitive Azure Service Bus Connection String Exposure 6.5 medium 3.1.8 13 Jul 2026
CVE-2025-65995: Apache Airflow Exposes Sensitive kwargs in Error Reporting 6.5 medium 2.11.1 13 Jul 2026
CVE-2025-27555: Apache Airflow Sensitive Information Exposure in Audit Logs 6.5 medium 2.11.1 13 Jul 2026
CVE-2026-49296: Apache Airflow DAG Source Authorization Bypass Vulnerability 6.5 medium 3.3.0 07 Jul 2026
Apache Airflow exposes deferred trigger kwargs in task-instance API responses 6.5 medium 3.3.0 07 Jul 2026
Apache Airflow exposes secrets backend credentials through the Config API 6.5 medium 3.3.0 07 Jul 2026
Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API 6.5 medium 3.3.0 07 Jul 2026
CVE-2026-49487: Apache Airflow Task Instance API Exposes Secrets in Clear Text 6.5 medium 3.3.0 07 Jul 2026
CVE-2026-48892: Apache Airflow Exposes Secrets via Config API 6.5 medium 3.3.0 07 Jul 2026
CVE-2026-49296: Apache Airflow Source Disclosure Vulnerability 6.5 medium 3.3.0 07 Jul 2026
CVE-2026-48726: Apache Airflow JWT Token Invalidation Flaw Post-Logout 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-42360: Apache Airflow Vulnerable to Exposure of Sensitive Information 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-42358: Apache Airflow Vulnerable to Exposure of Sensitive Information 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-40861: Apache Airflow Symlink Vulnerability Leading to File Leakage and Overwrite 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-45192: Apache Airflow Incomplete Redaction Exposes Secrets in Connection Extra 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-48726: Apache Airflow JWT Token Vulnerability Post-Logout 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-42360: Apache Airflow Nested Sensitive Key Masking Bypass Vulnerability 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-40861: Apache Airflow Symlink and Path Traversal Vulnerability 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-45192: Apache Airflow Connection Extra Field Exposure Vulnerability 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-25219: Apache Airflow Exposes Sensitive Azure Service Bus Connection Strings to Users with View Access 6.5 medium 3.1.8 15 Apr 2026
CVE-2025-27555: Apache Airflow Audit Log Exposure of Sensitive Information 6.5 medium 2.11.1 24 Feb 2026
CVE-2025-65995: Apache Airflow Exposes Sensitive kwargs in Error Reporting 6.5 medium 2.11.1 21 Feb 2026
CVE-2026-24098: Apache Airflow UI Exposes DAG Import Errors to Unauthorized Users 6.5 medium 3.1.7 09 Feb 2026
CVE-2025-54831: Apache Airflow 3.0.3 Sensitive Information Exposure Vulnerability 6.5 medium No fix published 26 Sep 2025
CVE-2026-49267: Apache Airflow SMTP STARTTLS Certificate Validation Bypass 5.9 medium 3.2.2 13 Jul 2026
CVE-2026-49267: Apache Airflow SMTP STARTTLS Certificate Validation Bypass 5.9 medium 3.2.2 01 Jun 2026
CVE-2026-68076: Apache Airflow Cross-Team Credential Exposure via Environment Variables 5.4 medium 3.3.1 12 Aug 2026
CVE-2026-59242: Apache Airflow XCom API Unsafe Deserialization Vulnerability 5.4 medium 3.3.1 12 Aug 2026
CVE-2026-68076: Apache Airflow Multi-Team Scope Misconfiguration Vulnerability 5.4 medium 3.3.1 12 Aug 2026
CVE-2026-59242: Apache Airflow Arbitrary Class Instantiation Vulnerability 5.4 medium 3.3.1 12 Aug 2026
CVE-2024-32077: Apache Airflow 2.9.0 Task Instance Log Injection Vulnerability 5.4 medium No fix published 14 May 2024
CVE-2025-66236: Apache Airflow - Plain Text Logging of Secrets in DAG Run Logs 5.3 medium 3.2.0 13 Apr 2026
CVE-2026-75158: Apache Airflow Asset Events Exposure Vulnerability 4.3 medium 3.3.2 21 Sep 2026
CVE-2026-54183: Apache Airflow Variables UI Exposes Sensitive Values in Deeply Nested Iterables 4.3 medium 3.3.1 12 Aug 2026
CVE-2026-54183: Apache Airflow UI Exposure of Sensitive Variables Due to Masking Limitations 4.3 medium 3.3.1 12 Aug 2026
CVE-2026-46764: Apache Airflow Authorization Bypass Through User-Controlled Key 4.3 medium 3.2.2 13 Jul 2026
CVE-2026-38743: Apache Airflow Insufficient Access Control on HITL and TaskInstance Records 4.3 medium 3.2.1rc1 13 Jul 2026
CVE-2026-40690: Apache Airflow Asset Dependency Graph Lacks DAG Read Permission Restrictions 4.3 medium 3.2.1rc1 13 Jul 2026
Apache Airflow exposes unreadable DAG identifiers in the scheduling dependencies graph 4.3 medium 3.3.0 07 Jul 2026
CVE-2026-48891: Apache Airflow Information Disclosure via Dependency Graph 4.3 medium 3.3.0 07 Jul 2026
CVE-2026-46764: Apache Airflow Authorization Bypass Through User-Controlled Key 4.3 medium 3.2.2 01 Jun 2026
CVE-2026-38743: Apache Airflow Insufficient Access Control on HITL and TaskInstance Records 4.3 medium 3.2.1rc1 24 Apr 2026
CVE-2026-40690: Apache Airflow Asset Dependency Graph Permissions Exposure 4.3 medium 3.2.1rc1 24 Apr 2026
CVE-2026-82355: Apache Airflow Session Cookie Misconfiguration Vulnerability 4.2 medium No fix published 21 Sep 2026

Looking for another version, or everything Vulert holds for apache-airflow?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About apache-airflow 2.10.3

Is apache-airflow 2.10.3 vulnerable?

Yes. 73 vulnerabilities in the Vulert database cover apache-airflow 2.10.3: 4 critical, 15 high, 54 medium and 0 low. The upgrade Vulert recommends is 3.3.2, and each entry above names the fixed version to move to.

Which version of apache-airflow should I use instead of 2.10.3?

3.3.2 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 2.10.3 the latest release of apache-airflow?

No. 2.10.3 was published 05 Nov 2024, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor apache-airflow for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the apache-airflow version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.