VulertSecurity VulertSecurity

Vulnerability Database · PyPI · apache-airflow · Version

apache-airflow 3.2.2

3.2.2 is affected by 36 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 3.3.2.

Critical 4 High 3 Medium 29 Low 0 Unrated 0

All apache-airflow versions & vulnerabilities → Source repository Search the database for this package →
Released 29 May 2026 Licence Apache-2.0 Also known from other sources 31 Newer releases 300 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

apache-airflow 3.2.2 vulnerabilities

36 vulnerabilities cover apache-airflow 3.2.2. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
Apache Airflow allows code execution through unsafe serialized DAG deserialization 9.8 critical 3.3.0 07 Jul 2026
CVE-2026-33264: Apache Airflow Remote Code Execution Vulnerability via Unrestricted Deserialization 9.8 critical 3.3.0 07 Jul 2026
CVE-2024-42447: Apache Airflow Providers FAB Insufficient Session Expiration Vulnerability 9.8 critical No fix published 05 Aug 2024
CVE-2026-86473: Apache Airflow Session Token Vulnerability Allows Unauthorized Access Post Logout 9.1 critical 3.3.2 21 Sep 2026
CVE-2024-45498: Apache Airflow Arbitrary Command Execution Vulnerability 8.8 high No fix published 07 Sep 2024
CVE-2026-68968: Apache Airflow Backfill API Cross-DAG Authorization Bypass Vulnerability 7.5 high 3.3.1 12 Aug 2026
CVE-2026-68968: Apache Airflow Backfill API Authorization Flaw 7.5 high 3.3.1 12 Aug 2026
CVE-2026-48828: Apache Airflow Exposes Sensitive JSON Variable Values Through Bulk Variables API 6.5 medium 3.3.0 10 Sep 2026
CVE-2026-68971: Apache Airflow Cross-Team Dag Actions and XCom Read Vulnerability 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-68969: Apache Airflow Secrets Exposure via Bulk Endpoints 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-68970: Apache Airflow Task SDK Exposes Secrets in List-Shaped JSON Variables 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-59244: Apache Airflow Exposes Sensitive Dict-Valued Secrets in Rendered Templates 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-68969: Apache Airflow Audit Log Exposes Secrets in Cleartext 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-68971: Apache Airflow Team-Scope Bypass Vulnerability 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-68970: Apache Airflow Task SDK Exposes Secrets in Logs 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-59244: Apache Airflow Secrets Masking Failure Exposes Sensitive Data 6.5 medium 3.3.1 12 Aug 2026
Apache Airflow exposes deferred trigger kwargs in task-instance API responses 6.5 medium 3.3.0 07 Jul 2026
CVE-2026-49296: Apache Airflow DAG Source Authorization Bypass Vulnerability 6.5 medium 3.3.0 07 Jul 2026
Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API 6.5 medium 3.3.0 07 Jul 2026
Apache Airflow exposes secrets backend credentials through the Config API 6.5 medium 3.3.0 07 Jul 2026
CVE-2026-49487: Apache Airflow Task Instance API Exposes Secrets in Clear Text 6.5 medium 3.3.0 07 Jul 2026
CVE-2026-48892: Apache Airflow Exposes Secrets via Config API 6.5 medium 3.3.0 07 Jul 2026
CVE-2026-49296: Apache Airflow Source Disclosure Vulnerability 6.5 medium 3.3.0 07 Jul 2026
CVE-2026-22922: Apache Airflow Authorization Bypass Vulnerability Allows Unauthorized Task Log Access 6.5 medium 3.17.0 09 Feb 2026
CVE-2025-54831: Apache Airflow 3.0.3 Sensitive Information Exposure Vulnerability 6.5 medium No fix published 26 Sep 2025
CVE-2026-68076: Apache Airflow Cross-Team Credential Exposure via Environment Variables 5.4 medium 3.3.1 12 Aug 2026
CVE-2026-59242: Apache Airflow XCom API Unsafe Deserialization Vulnerability 5.4 medium 3.3.1 12 Aug 2026
CVE-2026-68076: Apache Airflow Multi-Team Scope Misconfiguration Vulnerability 5.4 medium 3.3.1 12 Aug 2026
CVE-2026-59242: Apache Airflow Arbitrary Class Instantiation Vulnerability 5.4 medium 3.3.1 12 Aug 2026
CVE-2024-32077: Apache Airflow 2.9.0 Task Instance Log Injection Vulnerability 5.4 medium No fix published 14 May 2024
CVE-2026-75158: Apache Airflow Asset Events Exposure Vulnerability 4.3 medium 3.3.2 21 Sep 2026
CVE-2026-54183: Apache Airflow Variables UI Exposes Sensitive Values in Deeply Nested Iterables 4.3 medium 3.3.1 12 Aug 2026
CVE-2026-54183: Apache Airflow UI Exposure of Sensitive Variables Due to Masking Limitations 4.3 medium 3.3.1 12 Aug 2026
Apache Airflow exposes unreadable DAG identifiers in the scheduling dependencies graph 4.3 medium 3.3.0 07 Jul 2026
CVE-2026-48891: Apache Airflow Information Disclosure via Dependency Graph 4.3 medium 3.3.0 07 Jul 2026
CVE-2026-82355: Apache Airflow Session Cookie Misconfiguration Vulnerability 4.2 medium No fix published 21 Sep 2026

Looking for another version, or everything Vulert holds for apache-airflow?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About apache-airflow 3.2.2

Is apache-airflow 3.2.2 vulnerable?

Yes. 36 vulnerabilities in the Vulert database cover apache-airflow 3.2.2: 4 critical, 3 high, 29 medium and 0 low. The upgrade Vulert recommends is 3.3.2, and each entry above names the fixed version to move to.

Which version of apache-airflow should I use instead of 3.2.2?

3.3.2 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 3.2.2 the latest release of apache-airflow?

No. 3.2.2 was published 29 May 2026, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor apache-airflow for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the apache-airflow version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.