Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Apache Airflow 3.2.0 Clear all filters
TI-2025-35631 CVE-2025-57735 · GHSA-c92r-g8j5-vhcx

Apache Airflow: Airflow Logout Not Invalidating JWT

Priority MEDIUM 46

When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00679 Published 2026-04-09 Fixed in 3.2.0 CWE-613
TI-2026-26787 CVE-2026-34538 · GHSA-r7vr-m4jw-r794

Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure)

Priority LOW 30

Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, w…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00697 Published 2026-04-09 Fixed in 3.2.0 CWE-668