CVE Уведомления

Мониторинг уязвимостей, аналитика угроз и оперативные CVE-оповещения. База данных актуальных уязвимостей (Common Vulnerabilities and Exposures) с подробным описанием рисков, оценкой критичности по шкале CVSS и официальными рекомендациями по устранению.

  • CVE-2025-57735

    🚨 CVE-2025-57735 When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token...

  • CVE-2025-66236

    🚨 CVE-2025-66236 Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions...

  • CVE-2026-33858

    🚨 CVE-2026-33858 Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the...

  • CVE-2025-54550

    🚨 CVE-2025-54550 The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the...

  • CVE-2026-25219

    🚨 CVE-2026-25219 The `access_key` and `connection_string` connection properties were not marked as sensitive names in secrets masker. This means...

  • CVE-2026-31987

    🚨 CVE-2026-31987 JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to...

  • CVE-2026-30898

    🚨 CVE-2026-30898 An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause...

  • CVE-2026-30912

    🚨 CVE-2026-30912 In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false...

  • CVE-2026-32228

    🚨 CVE-2026-32228 UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow...

  • CVE-2026-32690

    🚨 CVE-2026-32690 Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user...

  • CVE-2026-38743

    🚨 CVE-2026-38743 The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance...

  • CVE-2026-40690

    🚨 CVE-2026-40690 The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one...

  • CVE-2026-45192

    🚨 CVE-2026-45192 A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allowed an authenticated UI/API user...

  • CVE-2026-40861

    🚨 CVE-2026-40861 A Dag author could either (a) create a symlink under their task's log directory pointing to an arbitrary file readable by the API...

  • CVE-2026-40961

    🚨 CVE-2026-40961 A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the `is_safe_url`...

  • CVE-2026-40963

    🚨 CVE-2026-40963 The structure_data endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking whether...

  • CVE-2026-41014

    🚨 CVE-2026-41014 The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization. An...

  • CVE-2026-41017

    🚨 CVE-2026-41017 Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure` flag, so deployments running the Airflow API...

Статистика статей

Статьи
53,092
Просмотры
273,024
Независимый арбитраж: В случае возникновения споров или несоответствия товара описанию, сервис выступает в качестве арбитра, принимая объективное решение на основе заранее оговоренных условий.
Назад
Сверху