Apache Airflow vulnerabilities
158 published vulnerabilities in Apache Airflow, 2 of them exploited in the wild. The most were published in 2026 (56), and 56 so far in 2026.
Apache Airflow vulnerabilities by year
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
Most exploited Apache Airflow vulnerabilities
- CVE-2020-13927 Apache Airflow's Experimental API Authentication Bypass
- CVE-2020-11978 Apache Airflow Command Injection
- CVE-2026-33264 Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()
- CVE-2023-25754 Apache Airflow: Privilege escalation using airflow logs
- CVE-2023-22884 Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow
- CVE-2022-38649 Apache Airflow Pinot provider allowed Command Injection
- CVE-2022-40189 Apache Airlfow Pig Provider RCE
- CVE-2022-38054 Session Fixation
- CVE-2021-38540 Apache Airflow: Variable Import endpoint missed authentication check
- CVE-2020-11981 Command injection via Celery broker in Apache Airflow
- CVE-2020-11982 Insecure default config of Celery worker in Apache Airflow
- CVE-2017-17836 Apache Airflow vulnerable to XSS
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.