Jarek Potiuk

A path traversal in the SFTP provider (`SFTPHook.retrieve directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is any deployment downloading directories from an untrusted SFTP server. Upgrade `apache-airflow-providers-sftp` to 5.8.1 or later.

**Name of the Vulnerable Software and Affected Versions** apache-airflow-providers-samba versions prior to 4.12.6 **Description** The `GCSToSambaOperator` in the Apache Airflow Samba provider fails to perform a containment check when joining GCS object names to the SMB destination path. This allows an attacker who can write objects into the source GCS bucket to use `../` segments in object names to resolve a write path outside the configured `destination path`, enabling the writing of files to arbitrary locations on the Samba target. **Recommendations** Upgrade apache-airflow-providers-samba to version 4.12.6 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.2.2 **Description** A bug in the GET '/api/v2/connections/{connection id}' REST API endpoint allows an authenticated UI/API user with Connection-read permission to retrieve secrets stored in a Connection's `extra` JSON blob. This occurs when secrets are stored under field names not included in the redaction allowlist (`DEFAULT SENSITIVE FIELDS`), resulting in sensitive data, such as Slack-provider credential field names, being returned in plaintext. This issue affects deployments that store credentials in Connection `extra` blobs and grant Connection-read access to multiple users. **Recommendations** Upgrade to version 3.2.2 or later. Store sensitive credential values in a secret-backend instead of inlining them into the Connection's `extra` field.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.2.2 **Description** A flaw in the `FileTaskHandler` allows a DAG author to access or modify files outside the configured `base log folder` when the worker log folder is shared with the API server. This can be achieved through a read-path attack by creating a symlink in the task's log directory pointing to an arbitrary file readable by the API server process, such as `/etc/passwd` or `airflow.cfg`. Alternatively, a write-path attack can be performed by providing a `task id` containing `..` sequences that are accepted by the Task SDK's `KEY REGEX`. These actions can lead to the leakage or overwriting of arbitrary files. **Recommendations** Upgrade to version 3.2.2 or later. Deploy the worker and API server with separate log volumes to ensure worker-controlled paths cannot reach the API server's filesystem.

**Name of the Vulnerable Software and Affected Versions** apache-airflow versions prior to 3.2.2 **Description** The 'structure data' endpoint in the Airflow UI fails to verify if the caller has read permissions for linked DAGs (Directed Acyclic Graphs, which are collections of all the tasks you want to run, organized in a way that reflects their relationships and dependencies). Consequently, an authenticated UI or API user with authorization for one DAG can enumerate linked DAG IDs and dependency metadata for other DAGs they are not authorized to access. This issue impacts deployments using per-DAG read scoping to maintain the privacy of DAG dependency topology across different teams. **Recommendations** Upgrade to version 3.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.2.2 **Description** The `JWTRefreshMiddleware` sets the JWT authentication cookie without the `Secure` flag. In deployments where the Airflow API server is positioned behind an HTTPS-terminating reverse proxy, the session JWT can be replayed over cleartext HTTP requests to the same host. A network-positioned attacker could induce a logged-in user's browser to issue an HTTP request to the hostname, capture the JWT cookie, and replay it against the authenticated API. **Recommendations** Upgrade to version 3.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.2.2 **Description** A bug in the Variable response masker allows the bypass of nested-key redaction when the nesting depth of a JSON value exceeds the recursion limit of the shared secrets masker. This occurs with key names suffixed by secrets, such as `password`, `token`, `secret`, or `api key`, as the masker returns the original nested item before verifying the sensitive key name. An authenticated UI or API user with Variable read permissions can harvest plaintext secret values stored within deeply-nested JSON Variables. **Recommendations** Update to version 3.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.2.2 **Description** A bug in the XCom PATCH endpoint "PATCH /api/v2/xcomEntries/{key}" allows an authenticated UI/API user with XCom write permission on a Dag to set XCom entries using reserved key names, such as `return value`. While the POST endpoint validates against `FORBIDDEN XCOM KEYS`, the PATCH endpoint does not. Additionally, the endpoint accepts serialized payload shapes that the triggerer's deserializer treats as code. This combination enables Remote Code Execution (RCE) on the triggerer when the affected task next defers. This issue specifically affects deployments where untrusted users possess XCom write permissions on Dags that defer to the triggerer. **Recommendations** Update to version 3.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.2.2 **Description** A bug in the rendered-template field handling allows the bypass of nested sensitive-key masking. When a rendered field exceeds the `[core] max templated field length` limit, the software stringifies the structure before redaction, which removes the nested key context and results in plaintext values being persisted into `rendered fields`. This affects deployments where DAG authors pass structured JSON to operators containing nested sensitive keys such as `password`, `token`, `secret`, or `api key`. An authenticated UI or API user with permissions to read rendered template fields can harvest these secret values. **Recommendations** Update to version 3.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.2.2 **Description** The scheduler-side deadline-reference decoder (`SerializedCustomReference.deserialize reference`) imports and dispatches arbitrary class paths from serialized state controlled by a DAG author without using an allowlist or plugin-registry gate. In deployments where DAG-author code is less trusted than the scheduler process, such as single-host deployments where the DAG bundle is importable from the scheduler process, an attacker could embed a custom `DeadlineReference`. This allows the attacker to specify a controlled module path, leading the scheduler to execute `import string(...)` and instantiate the class with an active SQLAlchemy session attached. **Recommendations** Upgrade to version 3.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.2.2 **Description** The Log server authorizes JWT tokens against Dag IDs by applying the `str.lstrip()` function to the requested path segment when verifying the `sub` claim. Because `str.lstrip()` removes any character from a specified set rather than a specific prefix, a token issued for one Dag can authorize access to any other Dag whose name begins with any subset of the characters in the original Dag's name. This allows an authenticated Airflow worker with a valid Log-server JWT to enumerate and read logs of other Dags, potentially leaking task output and error traces. This issue affects deployments using per-Dag log-access scoping, such as multi-team, shared-executor, or shared-worker topologies. **Recommendations** Upgrade to version 3.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.2.2 **Description** The EmailOperator and `airflow.utils.email` helpers establish SMTP STARTTLS connections without verifying the remote certificate when the deployment is configured with `smtp starttls=True` and `smtp ssl=False`. This allows an attacker positioned between the worker and the SMTP server to perform a Man-in-the-Middle (MITM) attack by presenting a self-signed certificate. Consequently, the attacker can silently complete the STARTTLS handshake and capture SMTP AUTH credentials and the contents of forwarded messages. **Recommendations** Upgrade to version 3.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** apache-airflow versions prior to 3.2.2 **Description** The 'partitioned dag runs' endpoints in the UI enforce only asset-level access control instead of per-Dag authorization. This allows an authenticated UI or API user with global `Asset:read` permission to enumerate the partition run state, schedule configuration, and asset wiring for Dags they are not authorized to read. This issue impacts deployments that use per-Dag read scoping while granting users broader Asset access. **Recommendations** Upgrade to version 3.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** apache-airflow-providers-google versions prior to 22.0.0 **Description** The `ComputeEngineSSHHook` disables SSH host-key verification by default. This configuration exposes SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers, who may intercept or modify the session. **Recommendations** Update to version 22.0.0 or later.

**Name of the Vulnerable Software and Affected Versions** apache-airflow-providers-elasticsearch versions prior to 6.5.3 **Description** The Elasticsearch logging provider writes the full host URL into task logs when configured with a `host` URL that embeds credentials. This allows any user with task-log read permissions to harvest the backend credentials. **Recommendations** Upgrade to version 6.5.3 or later. Configure backend credentials via a secret backend instead of embedding them in the `host` URL.

**Name of the Vulnerable Software and Affected Versions** apache-airflow-providers-opensearch versions prior to 1.9.1 **Description** The OpenSearch logging provider writes the full host URL into task logs when configured with a `host` URL that embeds credentials. This allows any user with task-log read permissions to harvest the backend credentials. **Recommendations** Upgrade to version 1.9.1 or later. Configure backend credentials via a secret backend instead of embedding them in the `host` URL.

**Name of the Vulnerable Software and Affected Versions** apache-airflow-providers-smtp (affected versions not specified) **Description** The `SmtpHook` component in the SMTP provider calls the Python function `smtplib.SMTP.starttls()` without an SSL context. This omission prevents certificate validation during the TLS upgrade. Consequently, a man-in-the-middle attacker positioned between the Airflow worker and the SMTP server could present a self-signed certificate to complete the STARTTLS upgrade and capture SMTP credentials transmitted during the `login()` call. **Recommendations** Upgrade to the version of `apache-airflow-providers-smtp` that contains the fix.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined versions prior to 3.2.1 **Description** The asset dependency graph fails to restrict nodes based on the viewer's DAG read permissions. This allows a user with read access to at least one DAG to browse the asset graph for any other asset in the deployment, enabling them to discover the existence and names of DAGs and assets outside their authorized scope. **Recommendations** Upgrade to version 3.2.1.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow Providers Edge3 versions prior to 2.0.0 **Description** The Edge3 provider for Apache Airflow 2 contains an issue that allows a Dag author to perform Remote Code Execution (RCE) in the webserver context through a non-public API. This API was intended for testing the Edge Provider during development and was implicitly enabled when the Edge3 provider was installed and configured on Airflow 2. The Edge3 provider support in Airflow 2 was development-only and not officially released. The issue is present only if the Edge3 provider was installed and configured on Airflow 2. **Recommendations** If you installed and configured the Edge3 provider for Airflow 2, uninstall it and migrate to Airflow 3. If you used the Edge Provider in Airflow 3, you are not affected.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow Providers FAB version 1.2.1 Apache Airflow Providers FAB version 1.2.0 **Description** The issue is related to an Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB, which prevented the user from logging out. This affects Apache Airflow Providers FAB version 1.2.1 when used with Apache Airflow 2.9.3, and FAB version 1.2.0 for all Airflow versions. **Recommendations** Upgrade to Apache Airflow Providers FAB version 1.2.2 to fix the issue if you are using Apache Airflow 2.9.3 with FAB provider 1.2.1. Upgrade to Apache Airflow Providers FAB version 1.2.2 to fix the issue if you are using any Apache Airflow version with FAB provider 1.2.0. Also, consider upgrading Apache Airflow to the latest version available. Pull the latest Airflow images or reinstall FAB provider according to the current constraints to ensure you have the updated version.