VulertSecurity VulertSecurity

Vulnerability Database · PyPI · apache-airflow · Version

apache-airflow 3.0.3rc2

3.0.3rc2 is affected by 99 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 3.3.2.

Critical 9 High 19 Medium 66 Low 5 Unrated 0

All apache-airflow versions & vulnerabilities → Source repository Search the database for this package →
Released 03 Jul 2025 Licence non-standard Also known from other sources 95 Newer releases 300 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

apache-airflow 3.0.3rc2 vulnerabilities

99 vulnerabilities cover apache-airflow 3.0.3rc2. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
Apache Airflow allows code execution through unsafe serialized DAG deserialization 9.8 critical 3.3.0 07 Jul 2026
CVE-2026-33264: Apache Airflow Remote Code Execution Vulnerability via Unrestricted Deserialization 9.8 critical 3.3.0 07 Jul 2026
CVE-2024-42447: Apache Airflow Providers FAB Insufficient Session Expiration Vulnerability 9.8 critical No fix published 05 Aug 2024
CVE-2023-25693: Apache Airflow Sqoop Provider Improper Input Validation Vulnerability 9.8 critical 3.1.1 24 Feb 2023
CVE-2026-86473: Apache Airflow Session Token Vulnerability Allows Unauthorized Access Post Logout 9.1 critical 3.3.2 21 Sep 2026
CVE-2025-57735: Apache Airflow JWT Token Vulnerability Post-Logout 9.1 critical 3.2.0 29 Jun 2026
CVE-2026-42252: Apache Airflow Critical Shell Injection Vulnerability 9.1 critical 3.2.2 01 Jun 2026
CVE-2026-42252: Apache Airflow Shell Metacharacter Injection Vulnerability 9.1 critical 3.2.2 01 Jun 2026
CVE-2025-57735: Apache Airflow JWT Token Not Invalidated After Logout 9.1 critical 3.2.0 09 Apr 2026
CVE-2024-45498: Apache Airflow Arbitrary Command Execution Vulnerability 8.8 high No fix published 07 Sep 2024
CVE-2025-54550: Apache Airflow RCE Vulnerability via Race Condition in example_xcom DAG 8.1 high 3.2.0 13 Jul 2026
CVE-2025-54550: Apache Airflow RCE Vulnerability in example_xcom DAG 8.1 high 3.2.0 16 Apr 2026
CVE-2026-30911: Apache Airflow Execution API HITL Endpoints Lacking Per-Task Authorization 8.1 high 3.1.8 17 Mar 2026
CVE-2026-68968: Apache Airflow Backfill API Cross-DAG Authorization Bypass Vulnerability 7.5 high 3.3.1 12 Aug 2026
CVE-2026-68968: Apache Airflow Backfill API Authorization Flaw 7.5 high 3.3.1 12 Aug 2026
CVE-2026-31987: Apache Airflow JWT Token Exposure in Logs 7.5 high 3.2.0 13 Jul 2026
CVE-2026-30912: Apache Airflow SQL Error Exposure Vulnerability 7.5 high 3.2.0 18 Apr 2026
CVE-2025-66236: Apache Airflow Deployment Security Oversight 7.5 high 3.2.0 13 Apr 2026
CVE-2026-28779: Apache Airflow Session Token Path Vulnerability Leading to Session Hijacking 7.5 high 3.1.8 17 Mar 2026
CVE-2026-26929: Apache Airflow Wildcard DagVersion Listing Bypasses Per-DAG RBAC and Leaks Metadata 7.5 high 3.1.8 17 Mar 2026
CVE-2026-28779: Apache Airflow Session Token Vulnerability Leading to Session Takeover 7.5 high 3.1.8 17 Mar 2026
CVE-2025-68675: Apache Airflow Proxy Credentials Leakage in Task Logs 7.5 high 3.1.6 16 Jan 2026
CVE-2025-68675: Apache Airflow Proxy Credential Exposure Vulnerability 7.5 high 3.1.6 16 Jan 2026
CVE-2026-45360: Apache Airflow Arbitrary Class Import Vulnerability 7.3 high 3.2.2 01 Jun 2026
CVE-2026-45360: Apache Airflow Arbitrary Class Path Import Vulnerability 7.3 high 3.2.2 01 Jun 2026
CVE-2026-40961: Apache Airflow Authenticated User URL Bypass Vulnerability 7.2 high 3.2.2 13 Jul 2026
CVE-2026-40961: Apache Airflow Authenticated User URL Bypass Vulnerability 7.2 high 3.2.2 01 Jun 2026
CVE-2026-25917: Apache Airflow Arbitrary Code Execution via XCom Payload 7.2 high 3.2.0 18 Apr 2026
CVE-2026-31987: Apache Airflow JWT Token Exposure in Logs 6.9 medium 3.2.0 16 Apr 2026
CVE-2026-48828: Apache Airflow Exposes Sensitive JSON Variable Values Through Bulk Variables API 6.5 medium 3.3.0 10 Sep 2026
CVE-2026-68969: Apache Airflow Secrets Exposure via Bulk Endpoints 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-68970: Apache Airflow Task SDK Exposes Secrets in List-Shaped JSON Variables 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-68971: Apache Airflow Cross-Team Dag Actions and XCom Read Vulnerability 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-59244: Apache Airflow Exposes Sensitive Dict-Valued Secrets in Rendered Templates 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-68969: Apache Airflow Audit Log Exposes Secrets in Cleartext 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-68970: Apache Airflow Task SDK Exposes Secrets in Logs 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-68971: Apache Airflow Team-Scope Bypass Vulnerability 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-59244: Apache Airflow Secrets Masking Failure Exposes Sensitive Data 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-42358: Apache Airflow Vulnerable to Exposure of Sensitive Information 6.5 medium 3.2.2 13 Jul 2026
CVE-2026-25219: Apache Airflow Sensitive Azure Service Bus Connection String Exposure 6.5 medium 3.1.8 13 Jul 2026
CVE-2025-65995: Apache Airflow Exposes Sensitive kwargs in Error Reporting 6.5 medium 2.11.1 13 Jul 2026
Apache Airflow exposes deferred trigger kwargs in task-instance API responses 6.5 medium 3.3.0 07 Jul 2026
CVE-2026-49296: Apache Airflow DAG Source Authorization Bypass Vulnerability 6.5 medium 3.3.0 07 Jul 2026
Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API 6.5 medium 3.3.0 07 Jul 2026
Apache Airflow exposes secrets backend credentials through the Config API 6.5 medium 3.3.0 07 Jul 2026
CVE-2026-49487: Apache Airflow Task Instance API Exposes Secrets in Clear Text 6.5 medium 3.3.0 07 Jul 2026
CVE-2026-48892: Apache Airflow Exposes Secrets via Config API 6.5 medium 3.3.0 07 Jul 2026
CVE-2026-49296: Apache Airflow Source Disclosure Vulnerability 6.5 medium 3.3.0 07 Jul 2026
CVE-2026-48726: Apache Airflow JWT Token Invalidation Flaw Post-Logout 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-42358: Apache Airflow Vulnerable to Exposure of Sensitive Information 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-42360: Apache Airflow Vulnerable to Exposure of Sensitive Information 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-40861: Apache Airflow Symlink Vulnerability Leading to File Leakage and Overwrite 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-45192: Apache Airflow Incomplete Redaction Exposes Secrets in Connection Extra 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-48726: Apache Airflow JWT Token Vulnerability Post-Logout 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-42360: Apache Airflow Nested Sensitive Key Masking Bypass Vulnerability 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-40861: Apache Airflow Symlink and Path Traversal Vulnerability 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-45192: Apache Airflow Connection Extra Field Exposure Vulnerability 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-25219: Apache Airflow Exposes Sensitive Azure Service Bus Connection Strings to Users with View Access 6.5 medium 3.1.8 15 Apr 2026
CVE-2026-34538: Apache Airflow Authorization Bypass in DagRun Wait Endpoint 6.5 medium 3.2.0 09 Apr 2026
CVE-2026-34538: Apache Airflow XCom Exposure Vulnerability for Viewer Role 6.5 medium 3.2.0 09 Apr 2026
CVE-2026-26929: Apache Airflow Wildcard DAG Authorization Bypass Vulnerability 6.5 medium 3.1.8 17 Mar 2026
CVE-2026-24098: Apache Airflow UI Exposes DAG Import Errors to Unauthorized Users 6.5 medium 3.1.7 09 Feb 2026
CVE-2026-24098: Apache Airflow Allows Unauthorized Access to Import Errors 6.5 medium 3.1.7 09 Feb 2026
CVE-2025-54831: Apache Airflow 3.0.3 Sensitive Information Exposure Vulnerability 6.5 medium No fix published 26 Sep 2025
CVE-2026-49267: Apache Airflow SMTP STARTTLS Certificate Validation Bypass 5.9 medium 3.2.2 13 Jul 2026
CVE-2026-49267: Apache Airflow SMTP STARTTLS Certificate Validation Bypass 5.9 medium 3.2.2 01 Jun 2026
CVE-2026-41017: Apache Airflow Sensitive Cookie Vulnerability in HTTPS Session 5.9 medium 3.2.2 01 Jun 2026
CVE-2026-41017: Apache Airflow JWT Cookie Vulnerability Exposes Sessions to Replay Attacks 5.9 medium 3.2.2 01 Jun 2026
CVE-2026-68076: Apache Airflow Cross-Team Credential Exposure via Environment Variables 5.4 medium 3.3.1 12 Aug 2026
CVE-2026-59242: Apache Airflow XCom API Unsafe Deserialization Vulnerability 5.4 medium 3.3.1 12 Aug 2026
CVE-2026-68076: Apache Airflow Multi-Team Scope Misconfiguration Vulnerability 5.4 medium 3.3.1 12 Aug 2026
CVE-2026-59242: Apache Airflow Arbitrary Class Instantiation Vulnerability 5.4 medium 3.3.1 12 Aug 2026
CVE-2025-62402: Apache Airflow DAG Code Execution Vulnerability in API 5.4 medium 3.1.1 07 Jul 2026
CVE-2025-62402: Apache Airflow DAG Code Execution Vulnerability in API 5.4 medium 3.1.1 30 Oct 2025
CVE-2024-32077: Apache Airflow 2.9.0 Task Instance Log Injection Vulnerability 5.4 medium No fix published 14 May 2024
CVE-2025-66236: Apache Airflow - Plain Text Logging of Secrets in DAG Run Logs 5.3 medium 3.2.0 13 Apr 2026
CVE-2025-54941: Apache Airflow Command Injection Vulnerability in example_dag_decorator 5.2 medium 3.0.5 07 Jul 2026
CVE-2025-54941: Apache Airflow Command Injection Vulnerability in example_dag_decorator 5.2 medium 3.0.5 30 Oct 2025
CVE-2025-62503: Apache Airflow Allows Unauthorized Upsert of Pools, Connections, and Variables 4.6 medium 3.1.1 07 Jul 2026
CVE-2025-62503: Apache Airflow Allows Unauthorized Upsert of Pools/Connections/Variables 4.6 medium 3.1.1 30 Oct 2025
CVE-2026-75158: Apache Airflow Asset Events Exposure Vulnerability 4.3 medium 3.3.2 21 Sep 2026
CVE-2026-54183: Apache Airflow Variables UI Exposes Sensitive Values in Deeply Nested Iterables 4.3 medium 3.3.1 12 Aug 2026
CVE-2026-54183: Apache Airflow UI Exposure of Sensitive Variables Due to Masking Limitations 4.3 medium 3.3.1 12 Aug 2026
CVE-2026-46764: Apache Airflow Authorization Bypass Through User-Controlled Key 4.3 medium 3.2.2 13 Jul 2026
CVE-2026-38743: Apache Airflow Insufficient Access Control on HITL and TaskInstance Records 4.3 medium 3.2.1rc1 13 Jul 2026
CVE-2026-40690: Apache Airflow Asset Dependency Graph Lacks DAG Read Permission Restrictions 4.3 medium 3.2.1rc1 13 Jul 2026
Apache Airflow exposes unreadable DAG identifiers in the scheduling dependencies graph 4.3 medium 3.3.0 07 Jul 2026
CVE-2026-48891: Apache Airflow Information Disclosure via Dependency Graph 4.3 medium 3.3.0 07 Jul 2026
CVE-2026-46764: Apache Airflow Authorization Bypass Through User-Controlled Key 4.3 medium 3.2.2 01 Jun 2026
CVE-2026-40690: Apache Airflow Asset Dependency Graph Permissions Exposure 4.3 medium 3.2.1rc1 24 Apr 2026
CVE-2026-38743: Apache Airflow Insufficient Access Control on HITL and TaskInstance Records 4.3 medium 3.2.1rc1 24 Apr 2026
CVE-2026-28563: Apache Airflow DAG Authorization Bypass Vulnerability 4.3 medium 3.1.8 17 Mar 2026
CVE-2026-28563: Apache Airflow DAG Dependency Exposure Vulnerability 4.3 medium 3.1.8 17 Mar 2026
CVE-2026-82355: Apache Airflow Session Cookie Misconfiguration Vulnerability 4.2 medium No fix published 21 Sep 2026
CVE-2026-32690: Apache Airflow JSON Secrets Exposure Vulnerability 3.7 low 3.2.0 18 Apr 2026
CVE-2026-40963: Apache Airflow Improper Authorization Vulnerability 3.1 low 3.2.2 13 Jul 2026
CVE-2026-45426: Apache Airflow Incorrect Authorization Vulnerability 3.1 low 3.2.2 01 Jun 2026
CVE-2026-40963: Apache Airflow Improper Authorization Vulnerability 3.1 low 3.2.2 01 Jun 2026
CVE-2026-45426: Apache Airflow Log Server JWT Authorization Bypass Vulnerability 3.1 low 3.2.2 01 Jun 2026

Looking for another version, or everything Vulert holds for apache-airflow?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About apache-airflow 3.0.3rc2

Is apache-airflow 3.0.3rc2 vulnerable?

Yes. 99 vulnerabilities in the Vulert database cover apache-airflow 3.0.3rc2: 9 critical, 19 high, 66 medium and 5 low. The upgrade Vulert recommends is 3.3.2, and each entry above names the fixed version to move to.

Which version of apache-airflow should I use instead of 3.0.3rc2?

3.3.2 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 3.0.3rc2 the latest release of apache-airflow?

No. 3.0.3rc2 was published 03 Jul 2025, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor apache-airflow for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the apache-airflow version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.