[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIBKqkDPpvt_YFl6Q4QWtoljKx9ClJEOziKlGVak2ubs":3,"g5a-family:apache\u002Fairflow":450,"g5a-ex:apache\u002Fairflow@*":465},{"success":4,"data":5},true,{"product":6,"versions":246,"topVulnerabilitiesByEpss":361,"kevVulnerabilities":419,"seoMetadata":428,"meta":447},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":245},"apache","airflow",114,92,2,"2025-12-15",[14,18,20,22,24,26,28,30,32,34,36,38,40,42,44,46,48,50,52,55,57,59,61,63,65,67,69,71,73,75,77,79,81,83,85,87,89,91,93,95,97,99,101,103,105,107,109,111,113,115,117,119,121,123,125,127,129,131,133,135,137,139,141,143,145,147,149,151,153,155,157,159,161,163,165,167,169,171,173,175,177,179,181,183,185,187,189,191,193,195,197,199,201,203,205,207,209,211,213,215,217,219,221,223,225,227,229,231,233,235,237,239,241,243],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},"0.1",0,false,{"version":19,"cve_count":16,"kev_count":16,"has_kev":17},"0.2",{"version":21,"cve_count":16,"kev_count":16,"has_kev":17},"0.2.1",{"version":23,"cve_count":16,"kev_count":16,"has_kev":17},"0.2.2",{"version":25,"cve_count":16,"kev_count":16,"has_kev":17},"0.2.3",{"version":27,"cve_count":16,"kev_count":16,"has_kev":17},"0.3",{"version":29,"cve_count":16,"kev_count":16,"has_kev":17},"0.3.1",{"version":31,"cve_count":16,"kev_count":16,"has_kev":17},"0.3.2",{"version":33,"cve_count":16,"kev_count":16,"has_kev":17},"0.4",{"version":35,"cve_count":16,"kev_count":16,"has_kev":17},"0.4.1",{"version":37,"cve_count":16,"kev_count":16,"has_kev":17},"0.4.2",{"version":39,"cve_count":16,"kev_count":16,"has_kev":17},"0.4.3",{"version":41,"cve_count":16,"kev_count":16,"has_kev":17},"0.4.5",{"version":43,"cve_count":16,"kev_count":16,"has_kev":17},"0.4.6",{"version":45,"cve_count":16,"kev_count":16,"has_kev":17},"0.5.0",{"version":47,"cve_count":16,"kev_count":16,"has_kev":17},"1.0.0",{"version":49,"cve_count":16,"kev_count":16,"has_kev":17},"1.0.1",{"version":51,"cve_count":16,"kev_count":16,"has_kev":17},"1.1.0",{"version":53,"cve_count":54,"kev_count":16,"has_kev":17},"1.10.0",1,{"version":56,"cve_count":16,"kev_count":16,"has_kev":17},"1.10.1",{"version":58,"cve_count":16,"kev_count":16,"has_kev":17},"1.10.10",{"version":60,"cve_count":16,"kev_count":16,"has_kev":17},"1.10.11",{"version":62,"cve_count":16,"kev_count":16,"has_kev":17},"1.10.12",{"version":64,"cve_count":16,"kev_count":16,"has_kev":17},"1.10.13",{"version":66,"cve_count":16,"kev_count":16,"has_kev":17},"1.10.14",{"version":68,"cve_count":16,"kev_count":16,"has_kev":17},"1.10.15",{"version":70,"cve_count":16,"kev_count":16,"has_kev":17},"1.10.2",{"version":72,"cve_count":16,"kev_count":16,"has_kev":17},"1.10.5",{"version":74,"cve_count":16,"kev_count":16,"has_kev":17},"1.10.6",{"version":76,"cve_count":16,"kev_count":16,"has_kev":17},"1.10.7",{"version":78,"cve_count":16,"kev_count":16,"has_kev":17},"1.10.8",{"version":80,"cve_count":16,"kev_count":16,"has_kev":17},"1.10.9",{"version":82,"cve_count":16,"kev_count":16,"has_kev":17},"1.1.1",{"version":84,"cve_count":16,"kev_count":16,"has_kev":17},"1.2.0",{"version":86,"cve_count":16,"kev_count":16,"has_kev":17},"1.3.0",{"version":88,"cve_count":16,"kev_count":16,"has_kev":17},"1.4.0",{"version":90,"cve_count":16,"kev_count":16,"has_kev":17},"1.4.1",{"version":92,"cve_count":16,"kev_count":16,"has_kev":17},"1.5.0",{"version":94,"cve_count":16,"kev_count":16,"has_kev":17},"1.5.1",{"version":96,"cve_count":16,"kev_count":16,"has_kev":17},"1.5.2",{"version":98,"cve_count":16,"kev_count":16,"has_kev":17},"1.6.0",{"version":100,"cve_count":16,"kev_count":16,"has_kev":17},"1.6.1",{"version":102,"cve_count":16,"kev_count":16,"has_kev":17},"1.6.2",{"version":104,"cve_count":16,"kev_count":16,"has_kev":17},"1.7.0",{"version":106,"cve_count":16,"kev_count":16,"has_kev":17},"1.7.1",{"version":108,"cve_count":16,"kev_count":16,"has_kev":17},"1.7.1.1",{"version":110,"cve_count":16,"kev_count":16,"has_kev":17},"1.7.1.2",{"version":112,"cve_count":16,"kev_count":16,"has_kev":17},"1.7.1.3",{"version":114,"cve_count":16,"kev_count":16,"has_kev":17},"1.8.0",{"version":116,"cve_count":16,"kev_count":16,"has_kev":17},"1.8.1",{"version":118,"cve_count":16,"kev_count":16,"has_kev":17},"1.8.2",{"version":120,"cve_count":16,"kev_count":16,"has_kev":17},"1.9.0",{"version":122,"cve_count":11,"kev_count":16,"has_kev":17},"2.0.0",{"version":124,"cve_count":16,"kev_count":16,"has_kev":17},"2.0.1",{"version":126,"cve_count":16,"kev_count":16,"has_kev":17},"2.0.2",{"version":128,"cve_count":16,"kev_count":16,"has_kev":17},"2.1.0",{"version":130,"cve_count":54,"kev_count":16,"has_kev":17},"2.10.0",{"version":132,"cve_count":16,"kev_count":16,"has_kev":17},"2.10.1",{"version":134,"cve_count":16,"kev_count":16,"has_kev":17},"2.10.2",{"version":136,"cve_count":16,"kev_count":16,"has_kev":17},"2.10.3",{"version":138,"cve_count":16,"kev_count":16,"has_kev":17},"2.10.4",{"version":140,"cve_count":16,"kev_count":16,"has_kev":17},"2.10.5",{"version":142,"cve_count":16,"kev_count":16,"has_kev":17},"2.1.1",{"version":144,"cve_count":16,"kev_count":16,"has_kev":17},"2.11.0",{"version":146,"cve_count":16,"kev_count":16,"has_kev":17},"2.11.1",{"version":148,"cve_count":16,"kev_count":16,"has_kev":17},"2.1.2",{"version":150,"cve_count":16,"kev_count":16,"has_kev":17},"2.1.3",{"version":152,"cve_count":16,"kev_count":16,"has_kev":17},"2.1.4",{"version":154,"cve_count":16,"kev_count":16,"has_kev":17},"2.2.0",{"version":156,"cve_count":16,"kev_count":16,"has_kev":17},"2.2.1",{"version":158,"cve_count":16,"kev_count":16,"has_kev":17},"2.2.2",{"version":160,"cve_count":16,"kev_count":16,"has_kev":17},"2.2.3",{"version":162,"cve_count":16,"kev_count":16,"has_kev":17},"2.2.4",{"version":164,"cve_count":16,"kev_count":16,"has_kev":17},"2.2.5",{"version":166,"cve_count":16,"kev_count":16,"has_kev":17},"2.3.0",{"version":168,"cve_count":16,"kev_count":16,"has_kev":17},"2.3.1",{"version":170,"cve_count":16,"kev_count":16,"has_kev":17},"2.3.3",{"version":172,"cve_count":16,"kev_count":16,"has_kev":17},"2.3.4",{"version":174,"cve_count":16,"kev_count":16,"has_kev":17},"2.4.0",{"version":176,"cve_count":16,"kev_count":16,"has_kev":17},"2.4.1",{"version":178,"cve_count":16,"kev_count":16,"has_kev":17},"2.4.3",{"version":180,"cve_count":16,"kev_count":16,"has_kev":17},"2.5.0",{"version":182,"cve_count":16,"kev_count":16,"has_kev":17},"2.6.0",{"version":184,"cve_count":16,"kev_count":16,"has_kev":17},"2.6.1",{"version":186,"cve_count":16,"kev_count":16,"has_kev":17},"2.6.2",{"version":188,"cve_count":16,"kev_count":16,"has_kev":17},"2.6.3",{"version":190,"cve_count":16,"kev_count":16,"has_kev":17},"2.7.0",{"version":192,"cve_count":16,"kev_count":16,"has_kev":17},"2.7.1",{"version":194,"cve_count":16,"kev_count":16,"has_kev":17},"2.7.2",{"version":196,"cve_count":16,"kev_count":16,"has_kev":17},"2.7.3",{"version":198,"cve_count":16,"kev_count":16,"has_kev":17},"2.8.0",{"version":200,"cve_count":16,"kev_count":16,"has_kev":17},"2.8.1",{"version":202,"cve_count":16,"kev_count":16,"has_kev":17},"2.8.2",{"version":204,"cve_count":16,"kev_count":16,"has_kev":17},"2.8.3",{"version":206,"cve_count":16,"kev_count":16,"has_kev":17},"2.8.4",{"version":208,"cve_count":54,"kev_count":16,"has_kev":17},"2.9.0",{"version":210,"cve_count":16,"kev_count":16,"has_kev":17},"2.9.1",{"version":212,"cve_count":16,"kev_count":16,"has_kev":17},"2.9.2",{"version":214,"cve_count":54,"kev_count":16,"has_kev":17},"2.9.3",{"version":216,"cve_count":16,"kev_count":16,"has_kev":17},"3.0.0",{"version":218,"cve_count":16,"kev_count":16,"has_kev":17},"3.0.1",{"version":220,"cve_count":16,"kev_count":16,"has_kev":17},"3.0.2",{"version":222,"cve_count":54,"kev_count":16,"has_kev":17},"3.0.3",{"version":224,"cve_count":16,"kev_count":16,"has_kev":17},"3.0.4",{"version":226,"cve_count":16,"kev_count":16,"has_kev":17},"3.0.5",{"version":228,"cve_count":16,"kev_count":16,"has_kev":17},"3.0.6",{"version":230,"cve_count":16,"kev_count":16,"has_kev":17},"3.1.0",{"version":232,"cve_count":16,"kev_count":16,"has_kev":17},"3.1.1",{"version":234,"cve_count":16,"kev_count":16,"has_kev":17},"3.1.2",{"version":236,"cve_count":16,"kev_count":16,"has_kev":17},"3.1.3",{"version":238,"cve_count":16,"kev_count":16,"has_kev":17},"3.1.4",{"version":240,"cve_count":16,"kev_count":16,"has_kev":17},"3.1.5",{"version":242,"cve_count":16,"kev_count":16,"has_kev":17},"3.1.6",{"version":244,"cve_count":16,"kev_count":16,"has_kev":17},"3.1.7","Airflow by Apache is a technology product with 114 tracked versions and 92 known security vulnerabilities including 2 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},{"version":19,"cve_count":16,"kev_count":16,"has_kev":17},{"version":21,"cve_count":16,"kev_count":16,"has_kev":17},{"version":23,"cve_count":16,"kev_count":16,"has_kev":17},{"version":25,"cve_count":16,"kev_count":16,"has_kev":17},{"version":27,"cve_count":16,"kev_count":16,"has_kev":17},{"version":29,"cve_count":16,"kev_count":16,"has_kev":17},{"version":31,"cve_count":16,"kev_count":16,"has_kev":17},{"version":33,"cve_count":16,"kev_count":16,"has_kev":17},{"version":35,"cve_count":16,"kev_count":16,"has_kev":17},{"version":37,"cve_count":16,"kev_count":16,"has_kev":17},{"version":39,"cve_count":16,"kev_count":16,"has_kev":17},{"version":41,"cve_count":16,"kev_count":16,"has_kev":17},{"version":43,"cve_count":16,"kev_count":16,"has_kev":17},{"version":45,"cve_count":16,"kev_count":16,"has_kev":17},{"version":47,"cve_count":16,"kev_count":16,"has_kev":17},{"version":49,"cve_count":16,"kev_count":16,"has_kev":17},{"version":51,"cve_count":16,"kev_count":16,"has_kev":17},{"version":53,"cve_count":54,"kev_count":16,"has_kev":17},{"version":56,"cve_count":16,"kev_count":16,"has_kev":17},{"version":58,"cve_count":16,"kev_count":16,"has_kev":17},{"version":60,"cve_count":16,"kev_count":16,"has_kev":17},{"version":62,"cve_count":16,"kev_count":16,"has_kev":17},{"version":64,"cve_count":16,"kev_count":16,"has_kev":17},{"version":66,"cve_count":16,"kev_count":16,"has_kev":17},{"version":68,"cve_count":16,"kev_count":16,"has_kev":17},{"version":70,"cve_count":16,"kev_count":16,"has_kev":17},{"version":72,"cve_count":16,"kev_count":16,"has_kev":17},{"version":74,"cve_count":16,"kev_count":16,"has_kev":17},{"version":76,"cve_count":16,"kev_count":16,"has_kev":17},{"version":78,"cve_count":16,"kev_count":16,"has_kev":17},{"version":80,"cve_count":16,"kev_count":16,"has_kev":17},{"version":82,"cve_count":16,"kev_count":16,"has_kev":17},{"version":84,"cve_count":16,"kev_count":16,"has_kev":17},{"version":86,"cve_count":16,"kev_count":16,"has_kev":17},{"version":88,"cve_count":16,"kev_count":16,"has_kev":17},{"version":90,"cve_count":16,"kev_count":16,"has_kev":17},{"version":92,"cve_count":16,"kev_count":16,"has_kev":17},{"version":94,"cve_count":16,"kev_count":16,"has_kev":17},{"version":96,"cve_count":16,"kev_count":16,"has_kev":17},{"version":98,"cve_count":16,"kev_count":16,"has_kev":17},{"version":100,"cve_count":16,"kev_count":16,"has_kev":17},{"version":102,"cve_count":16,"kev_count":16,"has_kev":17},{"version":104,"cve_count":16,"kev_count":16,"has_kev":17},{"version":106,"cve_count":16,"kev_count":16,"has_kev":17},{"version":108,"cve_count":16,"kev_count":16,"has_kev":17},{"version":110,"cve_count":16,"kev_count":16,"has_kev":17},{"version":112,"cve_count":16,"kev_count":16,"has_kev":17},{"version":114,"cve_count":16,"kev_count":16,"has_kev":17},{"version":116,"cve_count":16,"kev_count":16,"has_kev":17},{"version":118,"cve_count":16,"kev_count":16,"has_kev":17},{"version":120,"cve_count":16,"kev_count":16,"has_kev":17},{"version":122,"cve_count":11,"kev_count":16,"has_kev":17},{"version":124,"cve_count":16,"kev_count":16,"has_kev":17},{"version":126,"cve_count":16,"kev_count":16,"has_kev":17},{"version":128,"cve_count":16,"kev_count":16,"has_kev":17},{"version":130,"cve_count":54,"kev_count":16,"has_kev":17},{"version":132,"cve_count":16,"kev_count":16,"has_kev":17},{"version":134,"cve_count":16,"kev_count":16,"has_kev":17},{"version":136,"cve_count":16,"kev_count":16,"has_kev":17},{"version":138,"cve_count":16,"kev_count":16,"has_kev":17},{"version":140,"cve_count":16,"kev_count":16,"has_kev":17},{"version":142,"cve_count":16,"kev_count":16,"has_kev":17},{"version":144,"cve_count":16,"kev_count":16,"has_kev":17},{"version":146,"cve_count":16,"kev_count":16,"has_kev":17},{"version":148,"cve_count":16,"kev_count":16,"has_kev":17},{"version":150,"cve_count":16,"kev_count":16,"has_kev":17},{"version":152,"cve_count":16,"kev_count":16,"has_kev":17},{"version":154,"cve_count":16,"kev_count":16,"has_kev":17},{"version":156,"cve_count":16,"kev_count":16,"has_kev":17},{"version":158,"cve_count":16,"kev_count":16,"has_kev":17},{"version":160,"cve_count":16,"kev_count":16,"has_kev":17},{"version":162,"cve_count":16,"kev_count":16,"has_kev":17},{"version":164,"cve_count":16,"kev_count":16,"has_kev":17},{"version":166,"cve_count":16,"kev_count":16,"has_kev":17},{"version":168,"cve_count":16,"kev_count":16,"has_kev":17},{"version":170,"cve_count":16,"kev_count":16,"has_kev":17},{"version":172,"cve_count":16,"kev_count":16,"has_kev":17},{"version":174,"cve_count":16,"kev_count":16,"has_kev":17},{"version":176,"cve_count":16,"kev_count":16,"has_kev":17},{"version":178,"cve_count":16,"kev_count":16,"has_kev":17},{"version":180,"cve_count":16,"kev_count":16,"has_kev":17},{"version":182,"cve_count":16,"kev_count":16,"has_kev":17},{"version":184,"cve_count":16,"kev_count":16,"has_kev":17},{"version":186,"cve_count":16,"kev_count":16,"has_kev":17},{"version":188,"cve_count":16,"kev_count":16,"has_kev":17},{"version":190,"cve_count":16,"kev_count":16,"has_kev":17},{"version":192,"cve_count":16,"kev_count":16,"has_kev":17},{"version":194,"cve_count":16,"kev_count":16,"has_kev":17},{"version":196,"cve_count":16,"kev_count":16,"has_kev":17},{"version":198,"cve_count":16,"kev_count":16,"has_kev":17},{"version":200,"cve_count":16,"kev_count":16,"has_kev":17},{"version":202,"cve_count":16,"kev_count":16,"has_kev":17},{"version":204,"cve_count":16,"kev_count":16,"has_kev":17},{"version":206,"cve_count":16,"kev_count":16,"has_kev":17},{"version":208,"cve_count":54,"kev_count":16,"has_kev":17},{"version":210,"cve_count":16,"kev_count":16,"has_kev":17},{"version":212,"cve_count":16,"kev_count":16,"has_kev":17},{"version":214,"cve_count":54,"kev_count":16,"has_kev":17},{"version":216,"cve_count":16,"kev_count":16,"has_kev":17},{"version":218,"cve_count":16,"kev_count":16,"has_kev":17},{"version":220,"cve_count":16,"kev_count":16,"has_kev":17},{"version":222,"cve_count":54,"kev_count":16,"has_kev":17},{"version":224,"cve_count":16,"kev_count":16,"has_kev":17},{"version":226,"cve_count":16,"kev_count":16,"has_kev":17},{"version":228,"cve_count":16,"kev_count":16,"has_kev":17},{"version":230,"cve_count":16,"kev_count":16,"has_kev":17},{"version":232,"cve_count":16,"kev_count":16,"has_kev":17},{"version":234,"cve_count":16,"kev_count":16,"has_kev":17},{"version":236,"cve_count":16,"kev_count":16,"has_kev":17},{"version":238,"cve_count":16,"kev_count":16,"has_kev":17},{"version":240,"cve_count":16,"kev_count":16,"has_kev":17},{"version":242,"cve_count":16,"kev_count":16,"has_kev":17},{"version":244,"cve_count":16,"kev_count":16,"has_kev":17},[362,370,377,382,389,394,399,403,408,414],{"cveId":363,"description":364,"publishedDate":365,"cvssScore":366,"cvssVersion":367,"severity":368,"isKev":4,"epssScore":369},"CVE-2020-13927","The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https:\u002F\u002Fairflow.apache.org\u002Fdocs\u002F1.10.11\u002Fsecurity.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https:\u002F\u002Fgithub.com\u002Fapache\u002Fairflow\u002Fblob\u002F1.10.11\u002FUPDATING.md#experimental-api-will-deny-all-request-by-default","2020-11-10",9.8,"v3.1","Critical",0.99778,{"cveId":371,"description":372,"publishedDate":373,"cvssScore":374,"cvssVersion":367,"severity":375,"isKev":4,"epssScore":376},"CVE-2020-11978","An issue was found in Apache Airflow versions 1.10.10 and below. A remote code\u002Fcommand injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker\u002Fscheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.","2020-07-17",8.8,"High",0.99189,{"cveId":378,"description":379,"publishedDate":380,"cvssScore":374,"cvssVersion":367,"severity":375,"isKev":17,"epssScore":381},"CVE-2022-40127","A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.","2022-11-14",0.85653,{"cveId":383,"description":384,"publishedDate":385,"cvssScore":386,"cvssVersion":367,"severity":387,"isKev":17,"epssScore":388},"CVE-2022-45402","In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `\u002Flogin` endpoint.","2022-11-15",6.1,"Medium",0.81836,{"cveId":390,"description":391,"publishedDate":392,"cvssScore":366,"cvssVersion":367,"severity":368,"isKev":17,"epssScore":393},"CVE-2021-38540","The variable import endpoint was not protected by authentication in Airflow >=2.0.0, \u003C2.1.3. This allowed unauthenticated users to hit that endpoint to add\u002Fmodify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow >=2.0.0, \u003C2.1.3.","2021-09-09",0.80938,{"cveId":395,"description":396,"publishedDate":397,"cvssScore":374,"cvssVersion":367,"severity":375,"isKev":17,"epssScore":398},"CVE-2022-24288","In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.","2022-02-25",0.7788,{"cveId":400,"description":401,"publishedDate":373,"cvssScore":366,"cvssVersion":367,"severity":368,"isKev":17,"epssScore":402},"CVE-2020-11981","An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.",0.36787,{"cveId":404,"description":405,"publishedDate":406,"cvssScore":386,"cvssVersion":367,"severity":387,"isKev":17,"epssScore":407},"CVE-2020-13944","In Apache Airflow \u003C 1.10.12, the \"origin\" parameter passed to some of the endpoints like '\u002Ftrigger' was vulnerable to XSS exploit.","2020-09-17",0.25076,{"cveId":409,"description":410,"publishedDate":411,"cvssScore":412,"cvssVersion":367,"severity":375,"isKev":17,"epssScore":413},"CVE-2020-17526","Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config.","2020-12-21",7.7,0.23864,{"cveId":415,"description":416,"publishedDate":417,"cvssScore":386,"cvssVersion":367,"severity":387,"isKev":17,"epssScore":418},"CVE-2020-17515","The \"origin\" parameter passed to some of the endpoints like '\u002Ftrigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.","2020-12-11",0.16214,[420,425],{"cveId":371,"description":372,"publishedDate":373,"cvssScore":374,"severity":375,"isKev":4,"epssScore":376,"cisaVulnName":421,"cisaDateAdded":422,"cisaShortDescription":423,"cisaRequiredAction":424},"Apache Airflow Command Injection","2022-01-18","A remote code\u002Fcommand injection vulnerability was discovered in one of the example DAGs shipped with Airflow.","Apply updates per vendor instructions.",{"cveId":363,"description":364,"publishedDate":365,"cvssScore":366,"severity":368,"isKev":4,"epssScore":369,"cisaVulnName":426,"cisaDateAdded":422,"cisaShortDescription":427,"cisaRequiredAction":424},"Apache Airflow's Experimental API Authentication Bypass","The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.",{"title":429,"metaDescription":430,"keywords":431,"structuredData":432},"Airflow by Apache - Security Vulnerabilities & Analysis | EdgeProtect","Comprehensive security analysis for Airflow by Apache covering 114 versions with 92 tracked vulnerabilities including 1 critical and 1 high-severity issues and 2 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Airflow vulnerabilities, Airflow security, Airflow CVE, Apache Airflow, Airflow threat intelligence, Apache security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Airflow KEV, Airflow exploited vulnerabilities",{"@context":433,"@type":434,"name":435,"description":430,"url":436,"manufacturer":437,"applicationCategory":441,"softwareVersion":442,"mainEntity":443},"https:\u002F\u002Fschema.org","SoftwareApplication","Airflow","https:\u002F\u002Fedgeprotect.io\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fapache\u002Fairflow",{"@type":438,"name":439,"url":440},"Organization","Apache","https:\u002F\u002Fedgeprotect.io\u002Fvendors\u002Fapache","Security Software","114 versions tracked",{"@type":444,"name":445,"description":446,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Airflow Security Vulnerabilities","Security vulnerabilities affecting Airflow by Apache",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":448,"apiVersion":449},"2026-10-28T15:13:07.623Z","3.0",[451,453,455,457,459,461,463],{"product":452,"cves":11},"airflow_cncf_kubernetes",{"product":454,"cves":54},"airflow_common_sql_provider",{"product":456,"cves":54},"airflow_celery_provider",{"product":458,"cves":54},"airflow_hive_provider",{"product":460,"cves":54},"airflow_spark_provider",{"product":462,"cves":54},"airflow_sqoop_provider",{"product":464,"cves":54},"airflow_hdfs_provider",{"rows":466,"total":11,"capped":17,"failed":16},[467,472],{"cveId":371,"name":421,"severity":375,"cvss":374,"added":422,"epss":376,"published":468,"ranges":469,"checked":4,"hits":471,"covers":17},"2020-07-17T00:15:10.337",[470],"before 1.10.11",[],{"cveId":363,"name":426,"severity":368,"cvss":366,"added":422,"epss":369,"published":473,"ranges":474,"checked":4,"hits":475,"covers":17},"2020-11-10T16:15:11.807",[470],[]]