Technology · PyPI
apache-airflow (PyPI) vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 159 vulnerabilities in apache-airflow (PyPI): 0 in the last 7 days and 3 in the last 90 days, 11 of them critical and 2 exploited in the wild. The most recent, CVE-2026-86473, was published on 21 September 2026. Nothing in the last four weeks, down from 3 vulnerabilities in the four before. 0 critical against 1.
- Last 7 days
- 0
- Last 90 days
- 3
- Critical, all time
- 11
- Exploited in the wild
- 2
About apache-airflow (PyPI)
Python package for programmatically authoring, scheduling, and monitoring workflows.
Latest apache-airflow (PyPI) vulnerabilities
- CVE-2026-86473: Apache Airflow Core API logout incomplete token revocationcriticalCVSS 9.1EPSS 0.5%
- CVE-2026-82355: Apache Airflow authentication bypass via session cookie precedencemediumCVSS 4.2EPSS 0.3%
- CVE-2026-75158: Apache Airflow information disclosure in /assets/events APImediumCVSS 4.3EPSS 0.4%
- CVE-2026-68971: Apache Airflow authorization bypass in asset materialization and XCom endpointsmediumCVSS 6.5EPSS 0.6%
- CVE-2026-68970: Apache Airflow Task SDK variable masking bypass for list-shaped valuesmediumCVSS 6.5EPSS 0.4%
- CVE-2026-68969: Apache Airflow information disclosure in audit logsmediumCVSS 6.5EPSS 0.6%
- CVE-2026-68968: Apache Airflow Backfill API authorization bypass via type coercion mismatchhighCVSS 7.5EPSS 0.8%
- CVE-2026-68076: Apache Airflow environment-variable secrets backend team-scope bypassmediumCVSS 5.4EPSS 0.6%
- CVE-2026-67587: Apache Airflow arbitrary module import via deserialized callbackhighCVSS 8.8EPSS 1.2%
- CVE-2026-67260: Apache Airflow unsafe deserialization in awaiting_input task statehighCVSS 7.3EPSS 1.4%
- CVE-2026-65017: Apache Airflow Config API sensitive value masking bypass in multi-team modemediumCVSS 6.5EPSS 0.7%
- CVE-2026-59244: Apache Airflow secrets exposure in Rendered Templates UImediumCVSS 6.5EPSS 0.4%
- CVE-2026-59242: Apache Airflow XCom deserialization arbitrary class instantiationmediumCVSS 5.4EPSS 0.8%
- CVE-2026-58076: Apache Airflow unsafe exception deserialization remote code executionhighCVSS 8.8EPSS 0.9%
- CVE-2026-54183: Apache Airflow secrets masker bypass in UI displaymediumCVSS 4.3EPSS 0.6%
- CVE-2026-32794: Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token ExchangelowCVSS 3.1EPSS 0.4%
- CVE-2024-56373: PYSEC-2026-2355 - Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate tablelowCVSS 3.1EPSS 1.1%
- CVE-2025-27555: PYSEC-2026-2347 - Apache Airflow exposes sensitive information in its log fileslowCVSS 3.1EPSS 0.4%
- CVE-2023-51702: PYSEC-2026-2350 - Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without…lowCVSS 3.1EPSS 0.4%
- CVE-2023-46215: PYSEC-2026-2364 - Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerabilitylowCVSS 3.1EPSS 1.2%
- CVE-2023-39441: PYSEC-2026-2368 - Apache Airflow missing Certificate ValidationlowCVSS 3.1EPSS 0.8%
- CVE-2024-45784: PYSEC-2026-1112 - Apache Airflow: Sensitive configuration values are not masked in the logs by defaultlowCVSS 3.1EPSS 1.3%
- CVE-2024-50378: PYSEC-2026-1134 - Apache Airflow vulnerable to Insertion of Sensitive Information Into Sent DatalowCVSS 3.1EPSS 1.2%
- CVE-2024-31869: PYSEC-2026-1128 - Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config usedlowCVSS 3.1EPSS 1.1%
- CVE-2024-29735: PYSEC-2026-1132 - Apache Airflow Improper Preservation of Permissions vulnerabilitylowCVSS 3.1EPSS 1.5%
Most severe apache-airflow (PyPI) vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2020-13927: Authentication bypass in Apache Airflowcriticalexploited in the wildCVSS 3.1EPSS 99.8%
- CVE-2020-11978: Remote code execution (RCE) in Apache Airflowcriticalexploited in the wildCVSS 3.1EPSS 99.2%
- CVE-2023-22884: Command Injection in Apache Airflow and Apache Airflow MySQL ProvidercriticalCVSS 9.8EPSS 11.1%
- CVE-2022-40189: OS Command Injection in Apache AirflowcriticalCVSS 9.8EPSS 4.1%
- CVE-2022-38649: OS Command Injection in Apache AirflowcriticalCVSS 9.8EPSS 3.3%
- CVE-2023-25693: Apache Airflow Sqoop Provider improper input validationcriticalCVSS 9.8EPSS 1.9%
- CVE-2026-33264: Apache Airflow RCE via Deserialization in BaseSerializationcriticalCVSS 9.8EPSS 1.7%
- CVE-2025-67895: Apache Airflow Providers Edge3 RCE in web server contextcriticalCVSS 9.8EPSS 1.0%
- CVE-2025-57735: Apache Airflow insufficient session expiration in JWT logoutcriticalCVSS 9.1EPSS 0.7%
- CVE-2026-42252: Apache Airflow command injection via unsafe documentation examplecriticalCVSS 9.1EPSS 0.6%
Vulnerabilities per week
Nothing in the last four weeks, down from 3 vulnerabilities in the four before. 0 critical against 1. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 3 | 1 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many apache-airflow (PyPI) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/apache-airflow)<a href="https://junglewise.ai/threats/technologies/apache-airflow"><img src="https://junglewise.ai/threats/technologies/apache-airflow/badge.svg" alt="apache-airflow (PyPI) vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/apache-airflow.json, and this page as text at https://junglewise.ai/threats/technologies/apache-airflow.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "apache-airflow (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/apache-airflow, 13 November 2026.