Apache Airflow: DAG Code and Import Error Permissions Ignored

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2024-27906 · ADVISORY
• apache/airflow#37290 · WEB
• apache/airflow#37468 · WEB
• apache/airflow commit 08d2560 · WEB
• apache/airflow commit 0a95299 · WEB
• apache/airflow commit 2adbe88 · WEB
• apache/airflow commit 2cb6027 · WEB
• apache/airflow commit 90255d9 · WEB
• apache/airflow commit 9c4defa · WEB
• apache/airflow commit a7fa258 · WEB
• apache/airflow commit bc2646b

Lỗ hổng khác của apache-airflow

• CVE-2026-86473NGHIÊM TRỌNG 9.1Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting …
• CVE-2026-82355TRUNG BÌNH 4.2When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the cal…
• CVE-2026-75158TRUNG BÌNH 4.3Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the…
• CVE-2026-68971TRUNG BÌNH 6.5Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_un…
• CVE-2026-68970TRUNG BÌNH 6.5Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cl…