Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: Apache Airflow 3.1.8 Clear all filters
TI-2026-22818 CVE-2026-28563 · GHSA-x3fv-96qh-67m7

Apache Airflow: DAG authorization bypass

Priority LOW 20

Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00457 Published 2026-03-17 Fixed in 3.1.8 CWE-732
TI-2026-23737 CVE-2026-30911 · GHSA-8x34-9q3v-h7g8

Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization

Priority LOW 36

Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workf…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00558 Published 2026-03-17 Fixed in 3.1.8 CWE-862
TI-2026-22974 CVE-2026-28779 · GHSA-4fhm-p86v-hwpx

Exposure of resource to wrong sphere in Apache Airflow

Priority MEDIUM 40

Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00704 Published 2026-03-17 Fixed in 3.1.8 CWE-668