Skip to content

/

ZeroHour

ZeroHour aggregates public sources — security and AI press, vendor advisories, NVD, CISA KEV, FIRST EPSS, leak-site trackers and Have I Been Pwned — and classifies them with AI. Summaries can be wrong: read the original. All times are UTC.

News CVEs Incidents Tags Daily brief Traffic Sources RSS & API Kiosk Health Sitemap

Home
News feed
Exploited now

Security

CVEs
Ransomware & breaches
Threat actors & entities
IOCs

AI

AI & models

Explore

Tags
Daily brief
Analytics
Traffic & readers
Ask the feed
Sources

You

Watchlist
Saved
RSS, API & alerts

07:57 UTC· 6m ago

#apache-airflow — news, CVEs and analysis · ZeroHour

today 46 visits · 59 views · 7 reads·all time 17K views

Tag

#apache-airflow

4 stories this week · 14 this month · 14 in 6 months · mostly security

stories per day · 30 days

Related#cve 6 #fab-provider 5 #access-control 4 #authentication-bypass 3 #authorization 3 #oauth 3 #session-management 3 #authentication 2 #keycloak 2 #keycloak-provider 2 #password-reset 2 #secrets 2 #session-fixation 2 #account-deactivation 1 #akeyless 1 #api 1 #authentik 1 #azure-ad 1

9 stories, newest first · one card per story

oss-security·2d ago

CVE-2026-97636: Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key

#apache-airflow #hashicorp #vault

CVE-2026-97636

oss-security·5d ago

CVE-2026-75158: Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter

#apache-airflow #cve-2026-75158 #authorization

CVE-2026-75158

oss-security·9d ago

CVE-2026-75157: Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

#access-control #apache-airflow #authorization

CVE-2026-75157

oss-security·11d ago

CVE-2026-86792: Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration

#apache-airflow #cve-2026-86792 #kafka

CVE-2026-86792

4

oss-security·11d ago

CVE-2026-86465: Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key

#access-control #akeyless #apache-airflow

CVE-2026-86465

oss-security·11d ago

CVE-2026-86466: Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated

#apache-airflow #authentication-bypass #authentik

CVE-2026-86466

oss-security·11d ago

CVE-2026-82310: Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access

#access-control #account-deactivation #apache-airflow

CVE-2026-82310

oss-security·11d ago

CVE-2026-76187: Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT

#apache-airflow #authentication-bypass #client-credentials

CVE-2026-76187

oss-security·18d ago

CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass

#apache-airflow #authentication-bypass #azure-ad

CVE-2026-75156