Technology · Apache
Apache Airflow vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 95 vulnerabilities in Apache Airflow: 18 in the last 7 days and 24 in the last 90 days, 7 of them critical and 2 exploited in the wild. The most recent, CVE-2026-96285, was published on 9 November 2026. Nothing in the last four weeks, down from 6 vulnerabilities in the four before. 0 critical against 2.
- Last 7 days
- 18
- Last 90 days
- 24
- Critical, all time
- 7
- Exploited in the wild
- 2
About Apache Airflow
Apache Airflow is a workflow orchestration platform for authoring, scheduling, and monitoring data pipelines.
Latest Apache Airflow vulnerabilities
- CVE-2026-96285: Apache Airflow incomplete deserialization check bypass in schedulerinfo
- CVE-2026-86829: Apache Airflow scheduler XCom deserialization privilege escalationinfo
- CVE-2026-86468: Apache Airflow CLI audit log secrets exposureinfo
- CVE-2026-82337: Apache Airflow unsafe deserialization in deadline alert fieldsinfo
- CVE-2026-76185: Apache Airflow Task SDK secret cache key collision in multi-team deploymentsinfo
- CVE-2026-68982: Apache Airflow CeleryExecutor callback code executioninfo
- CVE-2026-50204: Apache Airflow secrets exposure in audit loginfo
- CVE-2026-40913: Apache Airflow Import Errors API information disclosureinfo
- CVE-2026-113508: Apache Airflow logout token revocation failureinfo
- CVE-2026-113504: Apache Airflow secrets masker insufficient nesting depthinfo
- CVE-2026-111455: Apache Airflow connection test privilege escalationinfo
- CVE-2026-111454: Apache Airflow asset API information disclosureinfo
- CVE-2026-111453: Apache Airflow queued events deletion privilege escalationinfo
- CVE-2026-111452: Apache Airflow secrets masker bypass for camelCase keysinfo
- CVE-2026-111421: Apache Airflow Task Execution API XCom deserialization in dependency evaluationinfo
- CVE-2026-111395: Apache Airflow reserved serialization key injection in DAG run confinfo
- CVE-2026-107474: Apache Airflow connections API sensitive extra masking bypassinfo
- CVE-2026-101031: Apache Airflow command injection in example_dag_decoratorinfo
- CVE-2026-86473: Apache Airflow Core API logout incomplete token revocationcriticalCVSS 9.1EPSS 0.5%
- CVE-2026-82355: Apache Airflow authentication bypass via session cookie precedencemediumCVSS 4.2EPSS 0.3%
- CVE-2026-75158: Apache Airflow information disclosure in /assets/events APImediumCVSS 4.3EPSS 0.4%
- CVE-2026-75157: Apache Airflow privilege escalation in asset queued-events DELETEhighCVSS 7.5EPSS 0.4%
- CVE-2026-82310: Apache Airflow FAB provider token revocation bypass for deactivated accountshighCVSS 7.2EPSS 1.0%
- CVE-2026-76186: Apache Airflow Keycloak provider session token binding bypasscriticalCVSS 9.1EPSS 0.8%
- CVE-2026-68971: Apache Airflow authorization bypass in asset materialization and XCom endpointsmediumCVSS 6.5EPSS 0.6%
Most severe Apache Airflow vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2020-13927: Authentication bypass in Apache Airflowcriticalexploited in the wildCVSS 3.1EPSS 99.8%
- CVE-2020-11978: Remote code execution (RCE) in Apache Airflowcriticalexploited in the wildCVSS 3.1EPSS 99.2%
- CVE-2026-33264: Apache Airflow RCE via Deserialization in BaseSerializationcriticalCVSS 9.8EPSS 1.7%
- CVE-2026-76186: Apache Airflow Keycloak provider session token binding bypasscriticalCVSS 9.1EPSS 0.8%
- CVE-2025-57735: Apache Airflow insufficient session expiration in JWT logoutcriticalCVSS 9.1EPSS 0.7%
- CVE-2026-42252: Apache Airflow command injection via unsafe documentation examplecriticalCVSS 9.1EPSS 0.6%
- CVE-2026-86473: Apache Airflow Core API logout incomplete token revocationcriticalCVSS 9.1EPSS 0.5%
- CVE-2024-45498: Apache Airflow command execution in example DAGshighCVSS 8.8EPSS 1.2%
- CVE-2026-67587: Apache Airflow arbitrary module import via deserialized callbackhighCVSS 8.8EPSS 1.2%
- CVE-2026-33858: Apache Airflow insecure deserialization in XCom APIhighCVSS 8.8EPSS 1.1%
Vulnerabilities per week
Nothing in the last four weeks, down from 6 vulnerabilities in the four before. 0 critical against 2. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 3 | 1 | |
| 21 Sep 2026 | 3 | 1 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 18 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Apache Airflow vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/airflow)<a href="https://junglewise.ai/threats/technologies/airflow"><img src="https://junglewise.ai/threats/technologies/airflow/badge.svg" alt="Apache Airflow vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/airflow.json, and this page as text at https://junglewise.ai/threats/technologies/airflow.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Apache Airflow vulnerabilities", https://junglewise.ai/threats/technologies/airflow, 12 November 2026.