Apache Airflow before 3.4.0 allows unauthenticated RCE via Celery (CVE-2026-68982)
Write access to the Celery broker is enough; 3.4.0 redeems a single-use token before any callback runs.
68
Product
Apache Airflow
- Mentions · 7d7
- Mentions · 30d11
- All mentions21
- First seenSep 8, 2026
- Last mentioned1d ago
Timeline
21 articles · newest firstApache Airflow before 3.4.0 allows unauthenticated RCE via Celery
A public proof of concept shows a broker message can invoke any importable Python function without Airflow credentials.
68
Airflow async connection test can overwrite later connections
A create-only user can replace a connection created by someone else when commit_on_success runs after the test.
32
Airflow asset API returns Dag IDs callers cannot read
Authenticated users with asset read access can learn scheduled, producing, or consuming Dag IDs before 3.4.0.
28
Airflow queued-event delete ignores per-Dag edit checks
Edit rights on one Dag let a user delete queued asset events for every Dag they can read.
34
Airflow secrets masker misses camelCase sensitive keys
Values under privateKey, connectionString, webhookUrl, or accessKey can appear unredacted in logs and API output.
36
Apache Airflow Import Errors API leaks stack traces (CVE-2026-40913)
The Import Errors API exposes raw parse-failure stack traces to users with ImportError.can_read permission in Apache Airflow before 3.4.0.
30
CVE-2026-96806: Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token
Apache Airflow Keycloak logout fails to end sessions because middleware reissues an unrevoked JWT.
44
CVE-2026-94135: Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default
Apache Airflow's async SFTP hook disables SSH host-key checks by default, enabling machine-in-the-middle attacks.
40
CVE-2026-94134: Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default
Apache Airflow SSH and SFTP hooks accept any server key by default, allowing machine-in-the-middle attacks.
42
CVE-2026-92228: Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read
Apache Airflow's Keycloak provider before 0.11.1 lets any team member read every team's audit logs.
52
CVE-2026-86843: Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag
Apache Airflow Teradata provider before 3.7.0 allows SQL injection via unconstrained example Dag Params.
24
CVE-2026-81930: Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain
Apache Airflow's Snowflake provider can leak SQL API bearer tokens off-domain via an unvalidated account field (CVE-2026-81930).
44
CVE-2026-81914: Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names
Apache Airflow Google provider before 22.6.0 allows Google Drive query injection via unescaped names (CVE-2026-81914).
30
CVE-2026-81862: Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs
Apache Airflow Teradata provider before 3.7.0 embeds cloud storage credentials in SQL and logs (CVE-2026-81862).
46
CVE-2026-97636: Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key
Apache Airflow HashiCorp provider flaw lets a team-scoped DAG author read another team's Vault secret.
48
CVE-2026-86473: Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry
Apache Airflow logout fails to revoke bearer tokens, leaving them valid until expiry.
28
CVE-2026-82355: Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation
Apache Airflow lets a session cookie override a bearer token, enabling session fixation.
30
CVE-2026-75158: Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter
Apache Airflow before 3.3.2 lets asset readers enumerate events for every Dag via CVE-2026-75158.
48
CVE-2026-75157: Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)
Apache Airflow before 3.3.2 lets any user with Dag read permission delete queued asset events, suppressing asset-triggered scheduling (CVE-2026-75157).
24
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider flaw (CVE-2026-75156) lets attackers bypass Azure AD OAuth token validation via unvalidated issuer and audience claims.
45
Related CVEs
by mentions- Arbitrary code execution in Apache Airflow CeleryExecutor via forged callbacks
- CVE-2026-75156<1%9.1Cross-tenant authentication bypass in Apache Airflow FAB provider
- Airflow Snowflake provider leaks bearer tokens via account URL
- CVE-2026-86843<1%6.3SQL injection in Airflow Teradata example Dag
- Permission Bypass in Apache Airflow 3.3.2 Asset Queued Events API
- Missing per-Dag Authorization in Apache Airflow Assets Events API Leaks Hidden Dag Data
- CVE-2026-81914<1%4.3Google Drive query injection in Apache Airflow Google provider
- Session Cookie Overrides Bearer Token in Apache Airflow 3.3.0–3.3.1
- Connection overwrite in Apache Airflow before 3.4.0
- Info Disclosure: Apache Airflow Asset API Leaks DAG IDs
Appears with
- Apachevendor · 13
- Apache Software Foundationvendor · 8
- Apache Software Foundationorganization · 7
- Apacheorganization · 3
- Apache Airflow Teradata Providerproduct · 2
- Teradatavendor · 2
- Keycloakproduct · 2
- Apache Airflow Keycloak providerproduct · 2
- Reflectizorganization · 2
- Apache Airflow SFTP Providerproduct · 2
- Snowflakevendor · 1
- Apache Airflow Snowflake Providerproduct · 1
- Snowflakeorganization · 1
- Teradataorganization · 1
- Googleorganization · 1
- Microsoftorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.