VulertSecurity VulertSecurity

Vulnerability Database · PyPI · apache-airflow · Version

apache-airflow 3.3.1rc2

3.3.1rc2 is affected by 32 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 3.3.2.

Critical 2 High 9 Medium 21 Low 0 Unrated 0

All apache-airflow versions & vulnerabilities → Source repository Search the database for this package →
Released 11 Aug 2026 Licence Apache-2.0 Also known from other sources 27 Newer releases 300 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

apache-airflow 3.3.1rc2 vulnerabilities

32 vulnerabilities cover apache-airflow 3.3.1rc2. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2024-42447: Apache Airflow Providers FAB Insufficient Session Expiration Vulnerability 9.8 critical No fix published 05 Aug 2024
CVE-2026-86473: Apache Airflow Session Token Vulnerability Allows Unauthorized Access Post Logout 9.1 critical 3.3.2 21 Sep 2026
CVE-2026-67587: Apache Airflow Task SDK Callback Deserialization Vulnerability 8.8 high 3.3.1 12 Aug 2026
CVE-2026-58076: Apache Airflow Arbitrary Callable Execution via Exception Node Deserialization 8.8 high 3.3.1 12 Aug 2026
CVE-2026-67587: Apache Airflow Arbitrary Module Import via Callback Deserialization 8.8 high 3.3.1 12 Aug 2026
CVE-2026-58076: Apache Airflow Arbitrary Code Execution via Serialization Layer 8.8 high 3.3.1 12 Aug 2026
CVE-2024-45498: Apache Airflow Arbitrary Command Execution Vulnerability 8.8 high No fix published 07 Sep 2024
CVE-2026-68968: Apache Airflow Backfill API Cross-DAG Authorization Bypass Vulnerability 7.5 high 3.3.1 12 Aug 2026
CVE-2026-68968: Apache Airflow Backfill API Authorization Flaw 7.5 high 3.3.1 12 Aug 2026
CVE-2026-67260: Apache Airflow Scheduler Vulnerability in Human-in-the-Loop Task Deserialization 7.3 high 3.3.1 12 Aug 2026
CVE-2026-67260: Apache Airflow Arbitrary Module Import Vulnerability 7.3 high 3.3.1 12 Aug 2026
CVE-2026-68970: Apache Airflow Task SDK Exposes Secrets in List-Shaped JSON Variables 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-68969: Apache Airflow Secrets Exposure via Bulk Endpoints 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-68971: Apache Airflow Cross-Team Dag Actions and XCom Read Vulnerability 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-65017: Apache Airflow Sensitive Configuration Exposure in Config API 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-59244: Apache Airflow Exposes Sensitive Dict-Valued Secrets in Rendered Templates 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-68969: Apache Airflow Audit Log Exposes Secrets in Cleartext 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-68971: Apache Airflow Team-Scope Bypass Vulnerability 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-68970: Apache Airflow Task SDK Exposes Secrets in Logs 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-65017: Apache Airflow Sensitive Configuration Exposure in Multi-Team Deployments 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-59244: Apache Airflow Secrets Masking Failure Exposes Sensitive Data 6.5 medium 3.3.1 12 Aug 2026
CVE-2026-22922: Apache Airflow Authorization Bypass Vulnerability Allows Unauthorized Task Log Access 6.5 medium 3.17.0 09 Feb 2026
CVE-2025-54831: Apache Airflow 3.0.3 Sensitive Information Exposure Vulnerability 6.5 medium No fix published 26 Sep 2025
CVE-2026-68076: Apache Airflow Cross-Team Credential Exposure via Environment Variables 5.4 medium 3.3.1 12 Aug 2026
CVE-2026-59242: Apache Airflow XCom API Unsafe Deserialization Vulnerability 5.4 medium 3.3.1 12 Aug 2026
CVE-2026-68076: Apache Airflow Multi-Team Scope Misconfiguration Vulnerability 5.4 medium 3.3.1 12 Aug 2026
CVE-2026-59242: Apache Airflow Arbitrary Class Instantiation Vulnerability 5.4 medium 3.3.1 12 Aug 2026
CVE-2024-32077: Apache Airflow 2.9.0 Task Instance Log Injection Vulnerability 5.4 medium No fix published 14 May 2024
CVE-2026-75158: Apache Airflow Asset Events Exposure Vulnerability 4.3 medium 3.3.2 21 Sep 2026
CVE-2026-54183: Apache Airflow Variables UI Exposes Sensitive Values in Deeply Nested Iterables 4.3 medium 3.3.1 12 Aug 2026
CVE-2026-54183: Apache Airflow UI Exposure of Sensitive Variables Due to Masking Limitations 4.3 medium 3.3.1 12 Aug 2026
CVE-2026-82355: Apache Airflow Session Cookie Misconfiguration Vulnerability 4.2 medium No fix published 21 Sep 2026

Looking for another version, or everything Vulert holds for apache-airflow?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About apache-airflow 3.3.1rc2

Is apache-airflow 3.3.1rc2 vulnerable?

Yes. 32 vulnerabilities in the Vulert database cover apache-airflow 3.3.1rc2: 2 critical, 9 high, 21 medium and 0 low. The upgrade Vulert recommends is 3.3.2, and each entry above names the fixed version to move to.

Which version of apache-airflow should I use instead of 3.3.1rc2?

3.3.2 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 3.3.1rc2 the latest release of apache-airflow?

No. 3.3.1rc2 was published 11 Aug 2026, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor apache-airflow for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the apache-airflow version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.