VulertSecurity VulertSecurity

Vulnerability Database · PyPI · apache-airflow · Version

apache-airflow 3.2.0

3.2.0 is affected by 72 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 3.3.2.

Critical 6 High 11 Medium 51 Low 4 Unrated 0

All apache-airflow versions & vulnerabilities → Source repository Search the database for this package →
Released 07 Apr 2026 Licence Apache-2.0 Also known from other sources 67 Newer releases 300 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

apache-airflow 3.2.0 vulnerabilities

72 vulnerabilities cover apache-airflow 3.2.0. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
Apache Airflow allows code execution through unsafe serialized DAG deserialization 9.8 critical 3.3.0 07 Jul 2026
CVE-2026-33264: Apache Airflow Remote Code Execution Vulnerability via Unrestricted Deserialization 9.8 critical 3.3.0 07 Jul 2026
CVE-2024-42447: Apache Airflow Providers FAB Insufficient Session Expiration Vulnerability 9.8 critical No fix published 05 Aug 2024
CVE-2026-86473: Apache Airflow Session Token Vulnerability Allows Unauthorized Access Post Logout 9.1 critical 3.3.2 21 Sep 2026
CVE-2026-42252: Apache Airflow Critical Shell Injection Vulnerability 9.1 critical 3.2.2 01 Jun 2026
CVE-2026-42252: Apache Airflow Shell Metacharacter Injection Vulnerability 9.1 critical 3.2.2 01 Jun 2026
CVE-2026-42359: Apache Airflow Deserialization of Untrusted Data Vulnerability 8.8 high 3.2.2 01 Jun 2026
CVE-2026-42359: Apache Airflow XCom PATCH Endpoint Vulnerability Leading to Remote Code Execution 8.8 high 3.2.2 01 Jun 2026
CVE-2024-45498: Apache Airflow Arbitrary Command Execution Vulnerability 8.8 high No fix published 07 Sep 2024
CVE-2026-68968: Apache Airflow Backfill API Cross-DAG Authorization Bypass Vulnerability 7.5 high 3.3.1 12 Aug 2026
CVE-2026-68968: Apache Airflow Backfill API Authorization Flaw 7.5 high 3.3.1 12 Aug 2026
CVE-2026-41084: Apache Airflow Authorization Bypass Vulnerability 7.5 high 3.2.2 01 Jun 2026
CVE-2026-41084: Apache Airflow Task Instance State Manipulation Vulnerability 7.5 high 3.2.2 01 Jun 2026
CVE-2026-45360: Apache Airflow Arbitrary Class Import Vulnerability 7.3 high 3.2.2 01 Jun 2026
CVE-2026-45360: Apache Airflow Arbitrary Class Path Import Vulnerability 7.3 high 3.2.2 01 Jun 2026
CVE-2026-40961: Apache Airflow Authenticated User URL Bypass Vulnerability 7.2 high 3.2.2 13 Jul 2026
CVE-2026-40961: Apache Airflow Authenticated User URL Bypass Vulnerability 7.2 high 3.2.2 01 Jun 2026
CVE-2026-48828: Apache Airflow Exposes Sensitive JSON Variable Values Through Bulk Variables API 6.5 medium 3.3.0 10 Sep 2026
CVE-2026-68971: Apache Airflow Cross-Team Dag Actions and XCom Read Vulnerability 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-68970: Apache Airflow Task SDK Exposes Secrets in List-Shaped JSON Variables 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-68969: Apache Airflow Secrets Exposure via Bulk Endpoints 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-59244: Apache Airflow Exposes Sensitive Dict-Valued Secrets in Rendered Templates 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-68971: Apache Airflow Team-Scope Bypass Vulnerability 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-68970: Apache Airflow Task SDK Exposes Secrets in Logs 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-68969: Apache Airflow Audit Log Exposes Secrets in Cleartext 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-59244: Apache Airflow Secrets Masking Failure Exposes Sensitive Data 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-42358: Apache Airflow Vulnerable to Exposure of Sensitive Information 6.5 medium 3.2.2 13 Jul 2026
Apache Airflow exposes deferred trigger kwargs in task-instance API responses 6.5 medium 3.3.0 07 Jul 2026
CVE-2026-49296: Apache Airflow DAG Source Authorization Bypass Vulnerability 6.5 medium 3.3.0 07 Jul 2026
Apache Airflow exposes secrets backend credentials through the Config API 6.5 medium 3.3.0 07 Jul 2026
Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API 6.5 medium 3.3.0 07 Jul 2026
CVE-2026-49296: Apache Airflow Source Disclosure Vulnerability 6.5 medium 3.3.0 07 Jul 2026
CVE-2026-48892: Apache Airflow Exposes Secrets via Config API 6.5 medium 3.3.0 07 Jul 2026
CVE-2026-49487: Apache Airflow Task Instance API Exposes Secrets in Clear Text 6.5 medium 3.3.0 07 Jul 2026
CVE-2026-48726: Apache Airflow JWT Token Invalidation Flaw Post-Logout 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-42360: Apache Airflow Vulnerable to Exposure of Sensitive Information 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-42358: Apache Airflow Vulnerable to Exposure of Sensitive Information 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-40861: Apache Airflow Symlink Vulnerability Leading to File Leakage and Overwrite 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-45192: Apache Airflow Incomplete Redaction Exposes Secrets in Connection Extra 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-48726: Apache Airflow JWT Token Vulnerability Post-Logout 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-42360: Apache Airflow Nested Sensitive Key Masking Bypass Vulnerability 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-40861: Apache Airflow Symlink and Path Traversal Vulnerability 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-45192: Apache Airflow Connection Extra Field Exposure Vulnerability 6.5 medium 3.2.2 01 Jun 2026
CVE-2026-22922: Apache Airflow Authorization Bypass Vulnerability Allows Unauthorized Task Log Access 6.5 medium 3.17.0 09 Feb 2026
CVE-2025-54831: Apache Airflow 3.0.3 Sensitive Information Exposure Vulnerability 6.5 medium No fix published 26 Sep 2025
CVE-2026-49267: Apache Airflow SMTP STARTTLS Certificate Validation Bypass 5.9 medium 3.2.2 13 Jul 2026
CVE-2026-49267: Apache Airflow SMTP STARTTLS Certificate Validation Bypass 5.9 medium 3.2.2 01 Jun 2026
CVE-2026-41017: Apache Airflow Sensitive Cookie Vulnerability in HTTPS Session 5.9 medium 3.2.2 01 Jun 2026
CVE-2026-41017: Apache Airflow JWT Cookie Vulnerability Exposes Sessions to Replay Attacks 5.9 medium 3.2.2 01 Jun 2026
CVE-2026-68076: Apache Airflow Cross-Team Credential Exposure via Environment Variables 5.4 medium 3.3.1 12 Aug 2026
CVE-2026-59242: Apache Airflow XCom API Unsafe Deserialization Vulnerability 5.4 medium 3.3.1 12 Aug 2026
CVE-2026-68076: Apache Airflow Multi-Team Scope Misconfiguration Vulnerability 5.4 medium 3.3.1 12 Aug 2026
CVE-2026-59242: Apache Airflow Arbitrary Class Instantiation Vulnerability 5.4 medium 3.3.1 12 Aug 2026
CVE-2024-32077: Apache Airflow 2.9.0 Task Instance Log Injection Vulnerability 5.4 medium No fix published 14 May 2024
CVE-2026-75158: Apache Airflow Asset Events Exposure Vulnerability 4.3 medium 3.3.2 21 Sep 2026
CVE-2026-54183: Apache Airflow Variables UI Exposes Sensitive Values in Deeply Nested Iterables 4.3 medium 3.3.1 12 Aug 2026
CVE-2026-54183: Apache Airflow UI Exposure of Sensitive Variables Due to Masking Limitations 4.3 medium 3.3.1 12 Aug 2026
CVE-2026-46764: Apache Airflow Authorization Bypass Through User-Controlled Key 4.3 medium 3.2.2 13 Jul 2026
CVE-2026-38743: Apache Airflow Insufficient Access Control on HITL and TaskInstance Records 4.3 medium 3.2.1rc1 13 Jul 2026
CVE-2026-40690: Apache Airflow Asset Dependency Graph Lacks DAG Read Permission Restrictions 4.3 medium 3.2.1rc1 13 Jul 2026
Apache Airflow exposes unreadable DAG identifiers in the scheduling dependencies graph 4.3 medium 3.3.0 07 Jul 2026
CVE-2026-48891: Apache Airflow Information Disclosure via Dependency Graph 4.3 medium 3.3.0 07 Jul 2026
CVE-2026-46764: Apache Airflow Authorization Bypass Through User-Controlled Key 4.3 medium 3.2.2 01 Jun 2026
CVE-2026-41014: Apache Airflow Missing Authorization Issue 4.3 medium 3.2.2 01 Jun 2026
CVE-2026-41014: apache-airflow Insufficient Per-Dag Authorization in UI/API 4.3 medium 3.2.2 01 Jun 2026
CVE-2026-40690: Apache Airflow Asset Dependency Graph Permissions Exposure 4.3 medium 3.2.1rc1 24 Apr 2026
CVE-2026-38743: Apache Airflow Insufficient Access Control on HITL and TaskInstance Records 4.3 medium 3.2.1rc1 24 Apr 2026
CVE-2026-82355: Apache Airflow Session Cookie Misconfiguration Vulnerability 4.2 medium No fix published 21 Sep 2026
CVE-2026-40963: Apache Airflow Improper Authorization Vulnerability 3.1 low 3.2.2 13 Jul 2026
CVE-2026-45426: Apache Airflow Incorrect Authorization Vulnerability 3.1 low 3.2.2 01 Jun 2026
CVE-2026-40963: Apache Airflow Improper Authorization Vulnerability 3.1 low 3.2.2 01 Jun 2026
CVE-2026-45426: Apache Airflow Log Server JWT Authorization Bypass Vulnerability 3.1 low 3.2.2 01 Jun 2026

Looking for another version, or everything Vulert holds for apache-airflow?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About apache-airflow 3.2.0

Is apache-airflow 3.2.0 vulnerable?

Yes. 72 vulnerabilities in the Vulert database cover apache-airflow 3.2.0: 6 critical, 11 high, 51 medium and 4 low. The upgrade Vulert recommends is 3.3.2, and each entry above names the fixed version to move to.

Which version of apache-airflow should I use instead of 3.2.0?

3.3.2 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 3.2.0 the latest release of apache-airflow?

No. 3.2.0 was published 07 Apr 2026, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor apache-airflow for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the apache-airflow version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.