Apache Airflow vulnerable to Stored XSS

Description

References

• nvd.nist.gov/vuln/detail/CVE-2019-0216 · ADVISORY
• apache/airflow commit 73280e4 · WEB
• apache/airflow commit a7d8fe6 · WEB
• GitHub Advisory GHSA-8p7v-2jvj-v54r · ADVISORY
• apache/airflow · WEB
• pypa/advisory-database · WEB
• lists.apache.org/thread.html/2de387213d45bc626d27554a1bde7b8c67d08720901f82a50b6f4231@%3Cdev.airflow.apache.org%3E · WEB
• web.archive.org/web/20200227081055/http://www.securityfocus.com/bid/107869 · WEB
• openwall.com/lists/oss-security/2019/04/10/6 · WEB
• securityfocus.com/bid/107869
• lists.apache.org/thread.html/2de387213d45bc626d27554a1bde7b8c67d08720901f82a50b6f4231%40%3Cdev.airflow.apache.org%3E

Autres vulnérabilités de apache-airflow

• CVE-2026-86473CRITIQUE 9.1Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting …
• CVE-2026-82355MOYENNE 4.2When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the cal…
• CVE-2026-75158MOYENNE 4.3Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the…
• CVE-2026-68971MOYENNE 6.5Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_un…
• CVE-2026-68970MOYENNE 6.5Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cl…