Apache Airflow logout token revocation fails open
Apache Airflow logout endpoint fails to revoke tokens when errors occur during server-side revocation.
20
Product
Airflow
- Mentions · 7d12
- Mentions · 30d12
- All mentions12
- First seenNov 9, 2026
- Last mentioned2d ago
Timeline
12 articles · newest firstApache Airflow secrets masker bounded at depth 5
Apache Airflow secrets masker stops descending into nested structures after five levels, exposing deeply-nested registered secrets in task logs.
30
Apache Airflow skips reserved-key check allowing task XComs to instantiate airflow classes (CVE-2026-111421)
A task author can write an XCom that causes the Execution API to deserialize and instantiate airflow.* classes in versions before 3.4.0.
45
Apache Airflow mishandles reserved keys in Dag run conf triggering scheduler crashes or Triggerer object reconstruction…
Reserved serialization keys in Dag run conf can crash the scheduler repeatedly or be rebuilt as objects inside the Triggerer via deadline callbacks in versions before 3.4.0.
40
Apache Airflow Connections API exposes apprise config extra in cleartext (CVE-2026-107474)
The apprise provider's config extra is returned unmasked in the Connections API allowing credential exposure in versions before 3.4.0.
50
Apache Airflow example Dag allows shell injection via IPv6 zone (CVE-2026-101031)
The example_dag_decorator Dag places IPv6 zone identifiers into shell commands when triggered with load_examples enabled.
40
Apache Airflow scheduler deserializes next_kwargs before dict check (CVE-2026-96285)
Deserialization of next_kwargs occurs before the dictionary check, allowing reconstruction of permitted nested objects in the scheduler.
45
Apache Airflow scheduler deserializes task-controlled XCom values (CVE-2026-86829)
Dag authors control XCom values that the scheduler fully deserializes during dependency evaluation.
60
Apache Airflow CLI masking misses Variable values and --conn-extra (CVE-2026-86468)
CLI argument masking by position leaves secrets like --conn-extra and Variable descriptions in cleartext audit logs.
40
Apache Airflow before 3.4.0 allows deserialization of DeadlineAlert fields (CVE-2026-82337)
Dag authors can construct arbitrary classes in scheduler and API server processes.
55
Apache Airflow CeleryExecutor vulnerability allows forged callback workloads
Apache Airflow CeleryExecutor ran callback workloads without workload-token validation, allowing arbitrary code execution on Celery workers.
60
Apache Airflow audit-log secrets masker redacts by key name only
Apache Airflow audit log stored Connection and Variable secret values in cleartext because the secrets masker matched only on configured sensitive key names.
45
Related CVEs
by mentions- Deserialization RCE in Apache Airflow Execution API
- Apache Airflow: Silent logout token revocation failure (external auth)
- Cleartext storage of secrets in Apache Airflow audit log
- Shell command injection in Apache Airflow example_dag_decorator Dag
- Deserialization in Apache Airflow Dag run conf via deadline callbacks
- Deserialization of next_kwargs before dict check in Apache Airflow scheduler
- CVE-2026-86829<1%—XCom deserialization in Apache Airflow scheduler
- Cleartext secrets in Apache Airflow audit logs via CLI arguments
- Arbitrary code execution in Apache Airflow CeleryExecutor via forged callbacks
- Deserialization bypass in Apache Airflow DeadlineAlert fields
Appears with
- Apachevendor · 12
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.