CVE-2026-81930: Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain
Apache Airflow's Snowflake provider can leak SQL API bearer tokens off-domain via an unvalidated account field (CVE-2026-81930).
Stories per day · 30 days
2 RSS
2 stories, newest first · one card per story
Stories tagged #provider
CVE-2026-86792: Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration
Apache Airflow Kafka provider 1.15.0 before 2.0.0 resolves unvalidated dotted-path strings into Python callables, enabling Scheduler RCE.