Vulnerabilities

TI-2025-20375 CVE-2025-27555 · GHSA-8r55-rv5w-6pfm

Apache Airflow: Connection Secrets not masked in UI when Connection are added via Airflow cli

LOW 29

Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00419 Published 2026-02-24 Fixed in 2.11.1 CWE-532

TI-2024-37330 CVE-2024-56373 · GHSA-r837-hpv7-pc2f

Apache Airflow: SSTI to Code Execution in Airflow through Shared DB Information

MEDIUM 41

DAG Author (who already has quite a lot of permissions) could manipulate database of Airflow 2 in the way to execute arbitrary code in the web-server context, which they should normally not be able to do, leading to pote…

CVSS 3.1HIGH 8.4 Network High privileges User interaction EPSS 0.01232 Published 2026-02-24 Fixed in 2.11.1 CWE-94

Vulnerabilities

Filters

Apache Airflow: Connection Secrets not masked in UI when Connection are added via Airflow cli

Apache Airflow: SSTI to Code Execution in Airflow through Shared DB Information