# Apache Airflow


- [CVE-2020-13927](https://insights.sbomify.com/CVE-2020-13927/): Apache Airflow's Experimental API Authentication Bypass (critical 9.8, exploited in the wild)
- [CVE-2020-11978](https://insights.sbomify.com/CVE-2020-11978/): Apache Airflow Command Injection (high 8.8, exploited in the wild)
- [CVE-2026-33264](https://insights.sbomify.com/CVE-2026-33264/): Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize() (critical 9.8)
- [CVE-2023-25754](https://insights.sbomify.com/CVE-2023-25754/): Apache Airflow: Privilege escalation using airflow logs (critical 9.8)
- [CVE-2023-22884](https://insights.sbomify.com/CVE-2023-22884/): Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow (critical 9.8)
- [CVE-2022-38649](https://insights.sbomify.com/CVE-2022-38649/): Apache Airflow Pinot provider allowed Command Injection (critical 9.8)
- [CVE-2022-40189](https://insights.sbomify.com/CVE-2022-40189/): Apache Airlfow Pig Provider RCE (critical 9.8)
- [CVE-2022-38054](https://insights.sbomify.com/CVE-2022-38054/): Session Fixation (critical 9.8)
- [CVE-2021-38540](https://insights.sbomify.com/CVE-2021-38540/): Apache Airflow: Variable Import endpoint missed authentication check (critical 9.8)
- [CVE-2020-11981](https://insights.sbomify.com/CVE-2020-11981/): Command injection via Celery broker in Apache Airflow (critical 9.8)
- [CVE-2020-11982](https://insights.sbomify.com/CVE-2020-11982/): Insecure default config of Celery worker in Apache Airflow (critical 9.8)
- [CVE-2017-17836](https://insights.sbomify.com/CVE-2017-17836/): Apache Airflow vulnerable to XSS (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/products/apache/airflow/