PT-2026-32366 · Airflow · Airflow

Amogh Desai + 1 · CVE-2025-66236 · Published 2026-04-13 · Updated 2026-04-16

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Airflow versions prior to 3.2.0

Description Lack of clarity regarding the responsibilities of the Deployment Manager in ensuring secure deployments. Certain assumptions about the security model, workload isolation, and JWT authentication were not explicit enough, which could lead to insecure configurations. The Deployment Manager is ultimately responsible for securing the deployment.

Recommendations Upgrade to version 3.2.0.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BIT-AIRFLOW-2025-66236

CVE-2025-66236

ECHO-16EB-CC5C-9B08

GHSA-J86X-FWP2-QH7V

PYSEC-2026-8

Affected Products

Airflow

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66236.json · Exploit
• https://github.com/apache/airflow/pull/58662 · Patch
• https://lists.apache.org/thread/g8fyy1tkmxkkfk7tx2v6h8mvwzpyykbo · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66236 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-8 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j86x-fwp2-qh7v · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2025-66236 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66236 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-8.yaml · Note
• http://openwall.com/lists/oss-security/2026/04/13/6 · Note
• https://twitter.com/CVEnew/status/2043733037821898902 · Twitter Post
• https://airflow.apache.org/blog/airflow-3.2.0 · Note
• https://twitter.com/VulmonFeeds/status/2043824319931777084 · Twitter Post
• https://pypi.python.org · Note