Version 2.10.3
apache-airflow
Apache Airflow - A platform to programmatically author, schedule, and monitor workflows
Install Instructions
pip install apache-airflow
Current Version Release Date November 05, 2024
Language Python
Package URL (purl) pkg:pip/apache-airflow@2.10.3
Find apache-airflow vulnerabilities in your supply chain.
apache-airflow Vulnerabilities
Sort by
CVE (Latest)
CVE (Latest)
-
CVE (Latest)
-
CVE (Oldest)
-
CVSS Score (Highest)
-
CVSS Score (Lowest)
CVE  |
CVSS Score |
CWE(s) |
EPSS Score |
EPSS % |
Impacted Versions |
|---|---|---|---|---|---|
| CVE-2019-0216 | Medium 4.8 | CWE-79 | 0.00112 | 0.45957 |
|
| CVE-2019-0229 | High 8.8 | CWE-352 | 0.00083 | 0.36799 |
|
| CVE-2019-12398 | Medium 4.8 | CWE-79 | 0.0011 | 0.45565 |
|
| CVE-2019-12417 | Medium 4.8 | CWE-79 | 0.00047 | 0.18678 |
|
| CVE-2020-11978 | High 8.8 | CWE-77, CWE-78 | 0.97403 | 0.99947 |
|
| CVE-2020-11981 | High 9.8 | CWE-78 | 0.92576 | 0.99104 |
|
| CVE-2020-11982 | High 9.8 | CWE-502 | 0.01395 | 0.8691 |
|
| CVE-2020-11983 | Medium 5.4 | CWE-79 | 0.00055 | 0.24396 |
|
| CVE-2020-13944 | Medium 6.1 | CWE-79 | 0.00471 | 0.76288 |
|
| CVE-2020-13927 | High 9.8 | CWE-1188, CWE-306, CWE-1056 | 0.96682 | 0.99698 |
|
| CVE-2020-17511 | Medium 6.5 | CWE-312 | 0.00067 | 0.31125 |
|
| CVE-2020-17515 | Medium 6.1 | CWE-79 | 0.00268 | 0.68414 |
|
| CVE-2020-17513 | Medium 5.3 | CWE-918 | 0.00126 | 0.48705 |
|
| CVE-2020-17526 | High 7.7 | CWE-269 | 0.11593 | 0.95476 |
|
| CVE-2020-9485 | Medium 6.1 | CWE-79 | 0.00186 | 0.56912 |
|
| CVE-2021-26697 | Medium 5.3 | CWE-306, CWE-287, CWE-269 | 0.00751 | 0.81584 |
|
| CVE-2021-28359 | Medium 6.1 | CWE-79 | 0.002 | 0.58656 |
|
| CVE-2021-35936 | Medium 5.3 | CWE-306 | 0.00054 | 0.23154 |
|
| CVE-2021-45230 | Medium 6.5 | CWE-269 | 0.00054 | 0.23338 |
|
| CVE-2021-45229 | Medium 6.1 | CWE-79 | 0.00187 | 0.5711 |
|
| CVE-2022-24288 | High 8.8 | CWE-78 | 0.94889 | 0.99368 |
|
| CVE-2022-27949 | High 7.5 | CWE-200 | 0.00122 | 0.47873 |
|
| CVE-2022-38170 | Medium 4.7 | CWE-362 | 0.00042 | 0.05119 |
|
| CVE-2022-38649 | High 9.8 | CWE-78 | 0.0078 | 0.81988 |
|
| CVE-2022-40127 | High 8.8 | CWE-94 | 0.26712 | 0.96911 |
|
| CVE-2022-40189 | High 9.8 | CWE-78 | 0.00665 | 0.80282 |
|
| CVE-2022-40954 | Medium 5.5 | CWE-78 | 0.00058 | 0.26275 |
|
| CVE-2022-41131 | High 7.8 | CWE-78 | 0.00058 | 0.26275 |
|
| CVE-2022-41672 | High 8.1 | CWE-613 | 0.00067 | 0.31125 |
|
| CVE-2022-43982 | Medium 6.1 | CWE-79 | 0.00097 | 0.42035 |
|
| CVE-2022-43985 | Medium 6.1 | CWE-601 | 0.00102 | 0.43238 |
|
| CVE-2022-45402 | Medium 6.1 | CWE-601 | 0.00378 | 0.73599 |
|
| CVE-2023-22884 | High 9.8 | CWE-77 | 0.01201 | 0.85765 |
|
| CVE-2022-46651 | Medium 6.5 | CWE-200 | 0.00052 | 0.21724 |
|
| CVE-2023-22887 | Medium 6.5 | CWE-22 | 0.00047 | 0.19041 |
|
| CVE-2023-22888 | Medium 6.5 | CWE-20 | 0.00076 | 0.34388 |
|
| CVE-2023-25695 | Medium 5.3 | CWE-209 | 0.00102 | 0.42987 |
|
| CVE-2023-25754 | High 9.8 | CWE-270 | 0.00671 | 0.80368 |
|
| CVE-2023-28707 | High 7.5 | CWE-20 | 0.00205 | 0.59133 |
|
| CVE-2023-29247 | Medium 5.4 | CWE-79 | 0.001 | 0.42614 |
|
| CVE-2023-35908 | Medium 6.5 | CWE-863 | 0.00097 | 0.42026 |
|
| CVE-2023-36543 | Medium 6.5 | CWE-1333, CWE-20 | 0.00108 | 0.45129 |
|
| CVE-2023-37379 | High 8.1 | CWE-200, CWE-918, CWE-400 | 0.00176 | 0.55763 |
|
| CVE-2023-39441 | Medium 5.9 | CWE-295 | 0.00169 | 0.54964 |
|
| CVE-2023-39508 | High 8.8 | CWE-200, CWE-250 | 0.0015 | 0.52229 |
|
| CVE-2023-39553 | High 7.5 | CWE-20 | 0.00135 | 0.50192 |
|
| CVE-2023-40273 | High 8 | CWE-384 | 0.00239 | 0.62562 |
|
| CVE-2023-40611 | Medium 4.3 | CWE-863 | 0.00124 | 0.48169 |
|
| CVE-2023-40712 | Medium 6.5 | CWE-200 | 0.00151 | 0.52447 |
|
| CVE-2023-42663 | Medium 6.5 | CWE-200 | 0.00062 | 0.28009 |
|
| CVE-2023-42780 | Medium 6.5 | CWE-200 | 0.00048 | 0.19491 |
|
| CVE-2023-42781 | Medium 6.5 | CWE-200 | 0.00099 | 0.42516 |
|
| CVE-2023-42792 | Medium 6.5 | CWE-668 | 0.00152 | 0.52586 |
|
| CVE-2023-46215 | High 7.5 | CWE-532 | 0.00612 | 0.79265 |
|
| CVE-2023-47037 | Medium 4.3 | CWE-863 | 0.00131 | 0.49395 |
|
| CVE-2023-48291 | Medium 4.3 | CWE-668 | 0.00143 | 0.51382 |
|
| CVE-2023-50783 | Medium 6.5 | CWE-284 | 0.00101 | 0.42809 |
|
| CVE-2023-50943 | High 7.5 | CWE-502 | 0.00521 | 0.7749 |
|
| CVE-2023-50944 | Medium 6.5 | CWE-862 | 0.00117 | 0.46959 |
|
| CVE-2024-25142 | Unknown | CWE-525 | 0.00043 | 0.10302 |
|
| CVE-2024-26280 | Medium 4.7 | CWE-276 | 0.00045 | 0.17069 |
|
| CVE-2024-27906 | Unknown | CWE-668 | 0.00045 | 0.17069 |
|
| CVE-2024-39863 | Medium 5.4 | CWE-74, CWE-79 | 0.00062 | 0.28069 |
|
| CVE-2024-41937 | Medium 6.1 | CWE-79 | 0.00126 | 0.48611 |
|
| CVE-2024-45034 | High 8.8 | CWE-250 | 0.00043 | 0.10302 |
|
| CVE-2024-45498 | High 8.8 | CWE-116 | 0.00043 | 0.10302 |
|
| CVE-2024-50378 | Medium 4.9 | CWE-201 | 0.00043 | 0.10302 |
|
| CVE-2017-12614 | Medium 6.1 | CWE-79 | 0.00188 | 0.57282 |
|
| CVE-2017-15720 | High 8.8 | CWE-20 | 0.00063 | 0.28956 |
|
| CVE-2017-17836 | High 9.8 | CWE-255 | 0.00176 | 0.55757 |
|
| CVE-2017-17835 | High 8.8 | CWE-352 | 0.00071 | 0.3242 |
|
| CVE-2018-20245 | High 7.5 | CWE-295 | 0.00102 | 0.43069 |
|
| CVE-2018-20244 | Medium 5.5 | CWE-79 | 0.00157 | 0.53143 |
|
| CVE-2021-38540 | High 9.8 | CWE-306, CWE-269 | 0.01354 | 0.867 |
|
| CVE-2021-26559 | Medium 6.5 | CWE-284, CWE-269 | 0.00091 | 0.40099 |
|
| CVE-2022-38054 | High 9.8 | CWE-384 | 0.06148 | 0.93792 |
|
| CVE-2022-40604 | High 7.5 | CWE-134 | 0.00126 | 0.48612 |
|
| CVE-2022-40754 | Medium 6.1 | CWE-601 | 0.00146 | 0.51718 |
|
| CVE-2023-51702 | Medium 6.5 | CWE-532, CWE-312 | 0.00117 | 0.4695 |
|
| CVE-2023-46288 | Medium 4.3 | CWE-200 | 0.00053 | 0.22247 |
|
| CVE-2024-39877 | High 8.8 | CWE-94, CWE-277 | 0.00096 | 0.4165 |
|
| CVE-2023-47265 | Medium 5.4 | CWE-79 | 0.00146 | 0.51775 |
|
| CVE-2023-35005 | Medium 6.5 | CWE-200 | 0.0006 | 0.26828 |
|
| CVE-2023-49920 | Medium 6.5 | CWE-352 | 0.00226 | 0.61508 |
|
| CVE-2024-31869 | Unknown | CWE-200 | 0.00045 | 0.17069 |
|
| CVE-2023-45348 | Medium 4.3 | CWE-200 | 0.00052 | 0.21984 |
|
| CVE-2024-28746 | Unknown | CWE-281 | 0.00045 | 0.17069 |
|
| CVE-2024-29735 | Medium 5.3 | CWE-281 | 0.00045 | 0.17069 |
|
| CVE-2024-32077 | Unknown | CWE-79 | 0.00045 | 0.17069 |
|
apache-airflow Vulnerability Remediation Guidance
| CVE | Description | Full list of Impacted Versions | Fix |
|---|---|---|---|
| CVE-2024-50378 | Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive variables were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow database. While this risk is limited to users with audit log access, it is recommended to upgrade to Airflow 2.10.3 or a later version, which addresses this issue. Users who previously used the CLI to set secret variables should manually delete entries with those variables from the log table. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2024-45498 | Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the dangerous example; see https://github.com/apache/airflow/pull/41873 for more information. We recommend against exposing the example DAGs in your deployment. If you must expose the example DAGs, upgrade Airflow to version 2.10.1 or later. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2024-45034 | Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2024-41937 | Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This would require the provider to be installed on the web server and the user to click the provider link. Users should upgrade to 2.10.0 or later, which fixes this vulnerability. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2024-39877 | Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability. | 2.4.0, 2.4.1rc1, 2.6.2, 2.6.2rc2, 2.6.1, 2.6.2rc1, 2.6.1rc3, 2.6.1rc2 (Show all) | Minor → 2.10.3 |
| CVE-2024-39863 | Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2024-32077 | Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs. Users are recommended to upgrade to version 2.9.1, which fixes this issue. | 2.9.0 | Minor → 2.10.3 |
| CVE-2024-31869 | Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.expose_config" configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your "expose_config" configuration to False as a workaround. This is similar, but different to CVE-2023-46288 https://github.com/advisories/GHSA-9qqg-mh7c-chfq which concerned API, not UI configuration page. | 2.7.2, 2.7.1rc2, 2.7.0, 2.7.1rc1, 2.7.1, 2.7.2rc1, 2.7.3rc1, 2.8.0b1 (Show all) | Minor → 2.10.3 |
| CVE-2024-29735 | Improper Preservation of Permissions vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.8.2 through 2.8.3. Airflow's local file task handler in Airflow incorrectly set permissions for all parent folders of log folder, in default configuration adding write access to Unix group of the folders. In the case Airflow is run with the root user (not recommended) it added group write permission to all folders up to the root of the filesystem. If your log files are stored in the home directory, these permission changes might impact your ability to run SSH operations after your home directory becomes group-writeable. This issue does not affect users who use or extend Airflow using Official Airflow Docker reference images ( https://hub.docker.com/r/apache/airflow/ ) - those images require to have group write permission set anyway. You are affected only if you install Airflow using local installation / virtualenv or other Docker images, but the issue has no impact if docker containers are used as intended, i.e. where Airflow components do not share containers with other applications and users. Also you should not be affected if your umask is 002 (group write enabled) - this is the default on many linux systems. Recommendation for users using Airflow outside of the containers: * if you are using root to run Airflow, change your Airflow user to use non-root * upgrade Apache Airflow to 2.8.4 or above * If you prefer not to upgrade, you can change the https://airflow.apache.org/docs/apache-airflow/stable/configurations-ref.html#file-task-handler-new-folder-permissions to 0o755 (original value 0o775). * if you already ran Airflow tasks before and your default umask is 022 (group write disabled) you should stop Airflow components, check permissions of AIRFLOW_HOME/logs in all your components and all parent directories of this directory and remove group write access for all the parent directories | 2.8.3, 2.8.2, 2.8.4rc1, 2.8.3rc1 | Minor → 2.10.3 |
| CVE-2024-28746 | Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access. Users of Apache Airflow are recommended to upgrade to version 2.8.3 or newer to mitigate the risk associated with this vulnerability | 2.8.1, 2.8.2rc2, 2.8.2rc3, 2.8.2, 2.8.0, 2.8.2rc1, 2.8.1rc1 | Minor → 2.10.3 |
| CVE-2024-27906 | Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI. Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2024-26280 | Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by default, they need to be explicitly granted permissions to see the logs. Only admin users have audit log permission by default. Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2024-25142 | Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. Airflow did not return "Cache-Control" header for dynamic content, which in case of some browsers could result in potentially storing sensitive data in local cache of the browser. This issue affects Apache Airflow: before 2.9.2. Users are recommended to upgrade to version 2.9.2, which fixes the issue. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2023-51702 | Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an Airflow version between 2.3.0 and 2.6.0, the configuration dictionary will be logged as plain text in the triggerer service without masking. This allows anyone with access to the metadata or triggerer log to obtain the configuration file and use it to access the Kubernetes cluster. This behavior was changed in version 7.0.0, which stopped serializing the file contents and started providing the file path instead to read the contents into the trigger. Users are recommended to upgrade to version 7.0.0, which fixes this issue. | 2.3.3rc3, 2.3.3, 2.3.3rc2, 2.3.2, 2.3.3rc1, 2.3.2rc1, 2.3.0, 2.3.2rc2 (Show all) | Patch → 2.10.3 |
| CVE-2023-50944 | Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2023-50943 | Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enable_xcom_pickling=False" configuration setting resulting in poisoned data after XCom deserialization. This vulnerability is considered low since it requires a DAG author to exploit it. Users are recommended to upgrade to version 2.8.1 or later, which fixes this issue. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2023-50783 | Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable. This flaw compromises the integrity of variable management, potentially leading to unauthorized data modification. Users are recommended to upgrade to 2.8.0, which fixes this issue | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2023-49920 | Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user's consent. Users are advised to upgrade to version 2.8.0 or later which is not affected | 2.7.2, 2.7.1rc2, 2.7.0, 2.7.1rc1, 2.7.1, 2.7.2rc1, 2.7.3rc1, 2.8.0b1 (Show all) | Minor → 2.10.3 |
| CVE-2023-48291 | Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn't. This is a missing fix for CVE-2023-42792 in Apache Airflow 2.7.2 Users of Apache Airflow are strongly advised to upgrade to version 2.8.0 or newer to mitigate the risk associated with this vulnerability. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2023-47265 | Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG. This Javascript can be executed on the client side of any of the user who looks at the tasks in the browser sandbox. While this issue does not allow to exit the browser sandbox or manipulation of the server-side data - more than the DAG author already has, it allows to modify what the user looking at the DAG details sees in the browser - which opens up all kinds of possibilities of misleading other users. Users of Apache Airflow are recommended to upgrade to version 2.8.0 or newer to mitigate the risk associated with this vulnerability | 2.6.2, 2.6.2rc2, 2.6.1, 2.6.2rc1, 2.6.1rc3, 2.6.1rc2, 2.6.1rc1, 2.6.0 (Show all) | Minor → 2.10.3 |
| CVE-2023-47037 | We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then. Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to version 2.7.3 or later which has removed the vulnerability. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2023-46288 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.4.0 to 2.7.0. Sensitive configuration information has been exposed to authenticated users with the ability to read configuration via Airflow REST API for configuration even when the expose_config option is set to non-sensitive-only. The expose_config option is False by default. It is recommended to upgrade to a version that is not affected if you set expose_config to non-sensitive-only configuration. This is a different error than CVE-2023-45348 which allows authenticated user to retrieve individual configuration values in 2.7.* by specially crafting their request (solved in 2.7.2). Users are recommended to upgrade to version 2.7.2, which fixes the issue and additionally fixes CVE-2023-45348. | 2.4.0, 2.4.1rc1, 2.6.2, 2.6.2rc2, 2.6.1, 2.6.2rc1, 2.6.1rc3, 2.6.1rc2 (Show all) | Minor → 2.10.3 |
| CVE-2023-46215 | Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow. Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend Note: the vulnerability is about the information exposed in the logs not about accessing the logs. This issue affects Apache Airflow Celery provider: from 3.3.0 through 3.4.0; Apache Airflow: from 1.10.0 through 2.6.3. Users are recommended to upgrade Airflow Celery provider to version 3.4.1 and Apache Airlfow to version 2.7.0 which fixes the issue. | 1.10.3rc2, 1.10.3rc1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2, 1.10.2rc2 (Show all) | Patch → 2.10.3 |
| CVE-2023-45348 | Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when the "expose_config" option is set to "non-sensitive-only". The `expose_config` option is False by default. It is recommended to upgrade to a version that is not affected. | 2.7.1rc2, 2.7.0, 2.7.1rc1, 2.7.1, 2.7.2rc1 | Patch → 2.10.3 |
| CVE-2023-42792 | Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn't. Users of Apache Airflow are strongly advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2023-42781 | Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. This is a different issue than CVE-2023-42663 but leading to similar outcome. Users of Apache Airflow are advised to upgrade to version 2.7.3 or newer to mitigate the risk associated with this vulnerability. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2023-42780 | Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAGs. It would reveal the dag_ids and the stack-traces of import errors for those DAGs with import errors. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2023-42663 | Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2023-40712 | Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly advised to upgrade to version 2.7.1 or later which has removed the vulnerability. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2023-40611 | Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to version 2.7.1 or later which has removed the vulnerability. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2023-40273 | The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database (for database session backend), or changing the secure_key and restarting the webserver, there were no mechanisms to force-logout the user (and all other users with that). With this fix implemented, when using the database session backend, the existing sessions of the user are invalidated when the password of the user is reset. When using the securecookie session backend, the sessions are NOT invalidated and still require changing the secure key and restarting the webserver (and logging out all other users), but the user resetting the password is informed about it with a flash message warning displayed in the UI. Documentation is also updated explaining this behaviour. Users of Apache Airflow are advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2023-39553 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider. Apache Airflow Drill Provider is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection with DrillHook giving an opportunity to read files on the Airflow server. This issue affects Apache Airflow Drill Provider: before 2.4.3. It is recommended to upgrade to a version that is not affected. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2023-39508 | Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the webserver context as well as allows to bypas limitation of access the user has to certain DAGs. The "Run Task" feature is considered dangerous and it has been removed entirely in Airflow 2.6.0 This issue affects Apache Airflow: before 2.6.0. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2023-39441 | Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL Certificate vulnerability. The default SSL context with SSL library did not check a server's X.509 certificate. Instead, the code accepted any certificate, which could result in the disclosure of mail server credentials or mail contents when the client connects to an attacker in a MITM position. Users are strongly advised to upgrade to Apache Airflow version 2.7.0 or newer, Apache Airflow IMAP Provider version 3.3.0 or newer, and Apache Airflow SMTP Provider version 1.3.0 or newer to mitigate the risk associated with this vulnerability | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2023-37379 | Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connection feature by sending many requests, leading to a denial of service (DoS) condition on the server. Furthermore, malicious actors can leverage this vulnerability to establish harmful connections with the server. Users of Apache Airflow are strongly advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability. Additionally, administrators are encouraged to review and adjust user permissions to restrict access to sensitive functionalities, reducing the attack surface. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2023-36543 | Apache Airflow, versions before 2.6.3, has a vulnerability where an authenticated user can use crafted input to make the current request hang. It is recommended to upgrade to a version that is not affected | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2023-35908 | Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL. It is recommended to upgrade to a version that is not affected | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2023-35005 | In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all uncensored values are actually sentitive. This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are recommended to update to version 2.6.2 or later. | 2.6.1, 2.6.1rc3, 2.6.1rc2, 2.6.1rc1, 2.6.0, 2.6.0rc5, 2.6.0rc4, 2.6.0rc3 (Show all) | Minor → 2.10.3 |
| CVE-2023-29247 | Task instance details page in the UI is vulnerable to a stored XSS.This issue affects Apache Airflow: before 2.6.0. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2023-28707 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.This issue affects Apache Airflow Drill Provider: before 2.3.2. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2023-25754 | Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.6.0. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2023-25695 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.5.2. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2023-22888 | Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to cause a service disruption by manipulating the run_id parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2023-22887 | Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended directory structure by manipulating the run_id parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2023-22884 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL Provider: before 4.0.0. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2022-46651 | Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2022-45402 | In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2022-43985 | In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's `/confirm` endpoint. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2022-43982 | In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2022-41672 | In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2022-41131 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG files. This issue affects Hive Provider versions prior to 4.1.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case HIve Provider is installed (Hive Provider 4.1.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the HIve Provider version 4.1.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version that has lower version of the Hive Provider installed). | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2022-40954 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Spark Provider is installed (Spark Provider 4.0.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the Spark Provider version 4.0.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version that has lower version of the Spark Provider installed). | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2022-40754 | In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's `/confirm` endpoint. | 2.3.3rc3, 2.3.3, 2.3.3rc2, 2.3.2, 2.3.3rc1, 2.3.2rc1, 2.3.0, 2.3.2rc2 (Show all) | Patch → 2.10.3 |
| CVE-2022-40604 | In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction. | 2.3.3rc3, 2.3.3, 2.3.3rc2, 2.3.2, 2.3.3rc1, 2.3.2rc1, 2.3.0, 2.3.2rc2 (Show all) | Patch → 2.10.3 |
| CVE-2022-40189 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Pig Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Pig Provider is installed (Pig Provider 4.0.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the Pig Provider version 4.0.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2022-40127 | A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2022-38649 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Apache Airflow Pinot Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Apache Airflow Pinot Provider is installed (Apache Airflow Pinot Provider 4.0.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the Pinot Provider version 4.0.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2022-38170 | In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2022-38054 | In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation. | 2.2.5rc1, 2.2.4, 2.3.3rc3, 2.3.3, 2.3.3rc2, 2.3.2, 2.3.3rc1, 2.3.2rc1 (Show all) | Patch → 2.10.3 |
| CVE-2022-27949 | A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example when they were depending on past and previous instances of the task failed). This issue affects Apache Airflow prior to 2.3.1. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2022-24288 | In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2021-45230 | In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "can_create" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for. | 1.10.3rc2, 1.10.3rc1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2, 1.10.2rc2 (Show all) | Patch → 2.10.3 |
| CVE-2021-45229 | It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. This issue affects Apache Airflow versions 2.2.3 and below. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2021-38540 | The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow >=2.0.0, <2.1.3. | 2.0.1rc2, 2.0.1, 2.0.1rc1, 2.0.0, 2.0.2rc1, 2.1.0, 2.1.0rc2, 2.1.0rc1 (Show all) | Patch → 2.10.3 |
| CVE-2021-35936 | If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG jobs. This issue affects Apache Airflow < 2.1.2. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2021-28359 | The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions <1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fix the issue completely. Update to Airflow 1.10.15 or 2.0.2. Please also update your Python version to the latest available PATCH releases of the installed MINOR versions, example update to Python 3.6.13 if you are on Python 3.6. (Those contain the fix for CVE-2021-23336 https://nvd.nist.gov/vuln/detail/CVE-2021-23336). | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2021-26697 | The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue affects Apache Airflow 2.0.0. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2021-26559 | Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when `[webserver] expose_config` is set to `False` in `airflow.cfg`. This allowed a privilege escalation attack. This issue affects Apache Airflow 2.0.0. | 2.0.0 | Minor → 2.10.3 |
| CVE-2020-9485 | An issue was found in Apache Airflow versions 1.10.10 and below. A stored XSS vulnerability was discovered in the Chart pages of the the "classic" UI. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2020-17526 | Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2020-17515 | The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2020-17513 | In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2020-17511 | In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. Same happened when creating a Connection with a password field. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2020-13944 | In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2020-13927 | The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2020-11983 | An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the admin management screens in the new/RBAC UI handled escaping incorrectly, allowing authenticated users with appropriate permissions to create stored XSS attacks. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2020-11982 | An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious payload directly to the broker which could lead to a deserialization attack (and thus remote code execution) on the Worker. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2020-11981 | An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2020-11978 | An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2019-12417 | A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2019-12398 | In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2019-0229 | A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2019-0216 | A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. | 1.10.3rc2, 1.10.3rc1, 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.3b2, 1.10.3b1, 1.10.2 (Show all) | Patch → 2.10.3 |
| CVE-2018-20245 | The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checking. | 1.8.1, 1.10.1b1, 1.10.1rc2, 1.10.0, 1.9.0, 1.8.2, 1.8.2rc1 | Major → 2.10.3 |
| CVE-2018-20244 | In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. | 1.8.1, 1.10.2rc3, 1.10.2rc1, 1.10.2rc2, 1.10.1b1, 1.10.1, 1.10.1rc2, 1.10.0 (Show all) | Major → 2.10.3 |
| CVE-2017-17836 | In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, whether it be via XSS or by leaving a machine unlocked can exfiltrate all credentials from the system. | 1.8.1, 1.8.2, 1.8.2rc1 | Major → 2.10.3 |
| CVE-2017-17835 | In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow. | 1.8.1, 1.8.2, 1.8.2rc1 | Major → 2.10.3 |
| CVE-2017-15720 | In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object. | 1.8.1, 1.8.2, 1.8.2rc1 | Major → 2.10.3 |
| CVE-2017-12614 | It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to Apache Airflow 1.9.0 or above. | 1.8.1, 1.8.2, 1.8.2rc1 | Major → 2.10.3 |
Instantly see if these apache-airflow vulnerabilities affect your code.
Dependencies
Packages using versions of apache-airflow affected by its vulnerabilities
| Dependent Packages |
|---|
| alembic<2.0,>=1.13.1 |
| argcomplete>=1.10 |
| asgiref>=2.3.0 |
| attrs>=22.1.0 |
| blinker>=1.6.2 |
| colorlog>=6.8.2 |
| configupdater>=3.1.1 |
| connexion[flask]<3.0,>=2.14.2 |
| cron-descriptor>=1.2.24 |
| croniter>=2.0.2 |
| cryptography>=41.0.0 |
| deprecated>=1.2.13 |
| dill>=0.2.2 |
| flask-caching>=2.0.0 |
| flask-session<0.6,>=0.4.0 |
| flask-wtf>=1.1.0 |
| flask<2.3,>=2.2.1 |
| fsspec>=2023.10.0 |
| google-re2>=1.0; python_version < "3.12" |
| google-re2>=1.1; python_version >= "3.12" |
| gunicorn>=20.1.0 |
| httpx>=0.25.0 |
| importlib_metadata>=6.5; python_version < "3.12" |
| importlib_resources!=6.2.0,!=6.3.0,!=6.3.1,>=5.2; python_version < "3.9" |
| itsdangerous>=2.0 |
| jinja2>=3.0.0 |
| jsonschema>=4.18.0 |
| lazy-object-proxy>=1.2.0 |
| linkify-it-py>=2.0.0 |
| lockfile>=0.12.2 |
| markdown-it-py>=2.1.0 |
| markupsafe>=1.1.1 |
| marshmallow-oneofschema>=2.0.1 |
| mdit-py-plugins>=0.3.0 |
| methodtools>=0.4.7 |
| opentelemetry-api>=1.15.0 |
| opentelemetry-exporter-otlp>=1.15.0 |
| packaging>=23.0 |
| pathspec>=0.9.0 |
| pendulum<4.0,>=2.1.2; python_version < "3.12" |
| pendulum<4.0,>=3.0.0; python_version >= "3.12" |
| pluggy>=1.5.0 |
| psutil>=5.8.0 |
| pygments>=2.0.1 |
| pyjwt>=2.0.0 |
| python-daemon>=3.0.0 |
| python-dateutil>=2.7.0 |
| python-nvd3>=0.15.0 |
| python-slugify>=5.0 |
| requests<3,>=2.27.0 |
| requests-toolbelt>=0.4.0 |
| rfc3339-validator>=0.1.4 |
| rich-argparse>=1.0.0 |
| rich>=12.4.4 |
| setproctitle>=1.3.3 |
| sqlalchemy<2.0,>=1.4.36 |
| sqlalchemy-jsonfield>=1.0 |
| tabulate>=0.7.5 |
| tenacity!=8.2.0,>=8.0.0 |
| termcolor>=1.1.0 |
| universal-pathlib!=0.2.4,>=0.2.2 |
| werkzeug<3,>=2.0 |
| apache-airflow-providers-common-compat |
| apache-airflow-providers-common-io |
| apache-airflow-providers-common-sql |
| apache-airflow-providers-fab>=1.0.2 |
| apache-airflow-providers-ftp |
| apache-airflow-providers-http |
| apache-airflow-providers-imap |
| apache-airflow-providers-smtp |
| apache-airflow-providers-sqlite |
| aiobotocore>=2.9.0; extra == "aiobotocore" |
| eventlet>=0.33.3; extra == "async" |
| gevent>=0.13; extra == "async" |
| greenlet>=0.4.9; extra == "async" |
| atlasclient>=0.1.2; extra == "apache-atlas" |
| hdfs[avro,dataframe,kerberos]>=2.0.4; extra == "apache-webhdfs" |
| cgroupspy>=0.2.2; extra == "cgroups" |
| cloudpickle; extra == "cloudpickle" |
| requests<3,>=2.27.0; extra == "deprecated-api" |
| apache-airflow[fab]; extra == "github-enterprise" |
| authlib>=1.0.0; extra == "github-enterprise" |
| apache-airflow[fab]; extra == "google-auth" |
| authlib>=1.0.0; extra == "google-auth" |
| graphviz>=0.12; extra == "graphviz" |
| pykerberos>=1.1.13; extra == "kerberos" |
| requests-kerberos>=0.10.0; extra == "kerberos" |
| thrift-sasl>=0.2.0; extra == "kerberos" |
| ldap3>=2.5.1; extra == "ldap" |
| python-ldap; extra == "ldap" |
| plyvel; extra == "leveldb" |
| opentelemetry-exporter-prometheus; extra == "otel" |
| pandas<2.2,>=1.2.5; extra == "pandas" |
| bcrypt>=2.0.0; extra == "password" |
| flask-bcrypt>=0.7.1; extra == "password" |
| pydantic>=2.3.0; extra == "pydantic" |
| amqp; extra == "rabbitmq" |
| s3fs>=2023.10.0; extra == "s3fs" |
| python3-saml>=1.16.0; extra == "saml" |
| blinker>=1.1; extra == "sentry" |
| sentry-sdk!=1.33.0,>=1.32.0; extra == "sentry" |
| statsd>=3.3.0; extra == "statsd" |
| uv>=0.1.32; extra == "uv" |
| virtualenv; extra == "virtualenv" |
| apache-airflow[apache-cassandra]; extra == "all-dbs" |
| apache-airflow[apache-drill]; extra == "all-dbs" |
| apache-airflow[apache-druid]; extra == "all-dbs" |
| apache-airflow[apache-hdfs]; extra == "all-dbs" |
| apache-airflow[apache-hive]; extra == "all-dbs" |
| apache-airflow[apache-impala]; extra == "all-dbs" |
| apache-airflow[apache-pinot]; extra == "all-dbs" |
| apache-airflow[arangodb]; extra == "all-dbs" |
| apache-airflow[cloudant]; extra == "all-dbs" |
| apache-airflow[databricks]; extra == "all-dbs" |
| apache-airflow[exasol]; extra == "all-dbs" |
| apache-airflow[influxdb]; extra == "all-dbs" |
| apache-airflow[microsoft-mssql]; extra == "all-dbs" |
| apache-airflow[mongo]; extra == "all-dbs" |
| apache-airflow[mysql]; extra == "all-dbs" |
| apache-airflow[neo4j]; extra == "all-dbs" |
| apache-airflow[postgres]; extra == "all-dbs" |
| apache-airflow[presto]; extra == "all-dbs" |
| apache-airflow[trino]; extra == "all-dbs" |
| apache-airflow[vertica]; extra == "all-dbs" |
| apache-airflow[apache-atlas]; extra == "atlas" |
| apache-airflow[amazon]; extra == "aws" |
| apache-airflow[microsoft-azure]; extra == "azure" |
| apache-airflow[apache-cassandra]; extra == "cassandra" |
| apache-airflow[apache-druid]; extra == "druid" |
| apache-airflow[google]; extra == "gcp" |
| apache-airflow[google]; extra == "gcp-api" |
| apache-airflow[apache-hdfs]; extra == "hdfs" |
| apache-airflow[apache-hive]; extra == "hive" |
| apache-airflow[cncf-kubernetes]; extra == "kubernetes" |
| apache-airflow[microsoft-mssql]; extra == "mssql" |
| apache-airflow[apache-pinot]; extra == "pinot" |
| apache-airflow[amazon]; extra == "s3" |
| apache-airflow[apache-spark]; extra == "spark" |
| apache-airflow[apache-webhdfs]; extra == "webhdfs" |
| apache-airflow[microsoft-winrm]; extra == "winrm" |
| apache-airflow-providers-airbyte; extra == "airbyte" |
| apache-airflow-providers-alibaba; extra == "alibaba" |
| apache-airflow-providers-amazon; extra == "amazon" |
| apache-airflow-providers-apache-beam; python_version != "3.12" and extra == "apache-beam" |
| apache-airflow-providers-apache-cassandra; extra == "apache-cassandra" |
| apache-airflow-providers-apache-drill; extra == "apache-drill" |
| apache-airflow-providers-apache-druid; extra == "apache-druid" |
| apache-airflow-providers-apache-flink; extra == "apache-flink" |
| apache-airflow-providers-apache-hdfs; extra == "apache-hdfs" |
| apache-airflow-providers-apache-hive; extra == "apache-hive" |
| apache-airflow-providers-apache-iceberg; extra == "apache-iceberg" |
| apache-airflow-providers-apache-impala; extra == "apache-impala" |
| apache-airflow-providers-apache-kafka; extra == "apache-kafka" |
| apache-airflow-providers-apache-kylin; extra == "apache-kylin" |
| apache-airflow-providers-apache-livy; extra == "apache-livy" |
| apache-airflow-providers-apache-pig; extra == "apache-pig" |
| apache-airflow-providers-apache-pinot; extra == "apache-pinot" |
| apache-airflow-providers-apache-spark; extra == "apache-spark" |
| apache-airflow-providers-apprise; extra == "apprise" |
| apache-airflow-providers-arangodb; extra == "arangodb" |
| apache-airflow-providers-asana; extra == "asana" |
| apache-airflow-providers-atlassian-jira; extra == "atlassian-jira" |
| apache-airflow-providers-celery; extra == "celery" |
| apache-airflow-providers-cloudant; extra == "cloudant" |
| apache-airflow-providers-cncf-kubernetes; extra == "cncf-kubernetes" |
| apache-airflow-providers-cohere; extra == "cohere" |
| apache-airflow-providers-common-compat; extra == "common-compat" |
| apache-airflow-providers-common-io; extra == "common-io" |
| apache-airflow-providers-common-sql; extra == "common-sql" |
| apache-airflow-providers-databricks; extra == "databricks" |
| apache-airflow-providers-datadog; extra == "datadog" |
| apache-airflow-providers-dbt-cloud; extra == "dbt-cloud" |
| apache-airflow-providers-dingding; extra == "dingding" |
| apache-airflow-providers-discord; extra == "discord" |
| apache-airflow-providers-docker; extra == "docker" |
| apache-airflow-providers-elasticsearch; extra == "elasticsearch" |
| apache-airflow-providers-exasol; extra == "exasol" |
| apache-airflow-providers-fab; extra == "fab" |
| apache-airflow-providers-facebook; extra == "facebook" |
| apache-airflow-providers-ftp; extra == "ftp" |
| apache-airflow-providers-github; extra == "github" |
| apache-airflow-providers-google; extra == "google" |
| apache-airflow-providers-grpc; extra == "grpc" |
| apache-airflow-providers-hashicorp; extra == "hashicorp" |
| apache-airflow-providers-http; extra == "http" |
| apache-airflow-providers-imap; extra == "imap" |
| apache-airflow-providers-influxdb; extra == "influxdb" |
| apache-airflow-providers-jdbc; extra == "jdbc" |
| apache-airflow-providers-jenkins; extra == "jenkins" |
| apache-airflow-providers-microsoft-azure; extra == "microsoft-azure" |
| apache-airflow-providers-microsoft-mssql; extra == "microsoft-mssql" |
| apache-airflow-providers-microsoft-psrp; extra == "microsoft-psrp" |
| apache-airflow-providers-microsoft-winrm; extra == "microsoft-winrm" |
| apache-airflow-providers-mongo; extra == "mongo" |
| apache-airflow-providers-mysql; extra == "mysql" |
| apache-airflow-providers-neo4j; extra == "neo4j" |
| apache-airflow-providers-odbc; extra == "odbc" |
| apache-airflow-providers-openai; extra == "openai" |
| apache-airflow-providers-openfaas; extra == "openfaas" |
| apache-airflow-providers-openlineage; extra == "openlineage" |
| apache-airflow-providers-opensearch; extra == "opensearch" |
| apache-airflow-providers-opsgenie; extra == "opsgenie" |
| apache-airflow-providers-oracle; extra == "oracle" |
| apache-airflow-providers-pagerduty; extra == "pagerduty" |
| apache-airflow-providers-papermill; python_version != "3.12" and extra == "papermill" |
| apache-airflow-providers-pgvector; extra == "pgvector" |
| apache-airflow-providers-pinecone; extra == "pinecone" |
| apache-airflow-providers-postgres; extra == "postgres" |
| apache-airflow-providers-presto; extra == "presto" |
| apache-airflow-providers-qdrant; extra == "qdrant" |
| apache-airflow-providers-redis; extra == "redis" |
| apache-airflow-providers-salesforce; extra == "salesforce" |
| apache-airflow-providers-samba; extra == "samba" |
| apache-airflow-providers-segment; extra == "segment" |
| apache-airflow-providers-sendgrid; extra == "sendgrid" |
| apache-airflow-providers-sftp; extra == "sftp" |
| apache-airflow-providers-singularity; extra == "singularity" |
| apache-airflow-providers-slack; extra == "slack" |
| apache-airflow-providers-smtp; extra == "smtp" |
| apache-airflow-providers-snowflake; extra == "snowflake" |
| apache-airflow-providers-sqlite; extra == "sqlite" |
| apache-airflow-providers-ssh; extra == "ssh" |
| apache-airflow-providers-tableau; extra == "tableau" |
| apache-airflow-providers-tabular; extra == "tabular" |
| apache-airflow-providers-telegram; extra == "telegram" |
| apache-airflow-providers-teradata; extra == "teradata" |
| apache-airflow-providers-trino; extra == "trino" |
| apache-airflow-providers-vertica; extra == "vertica" |
| apache-airflow-providers-weaviate; extra == "weaviate" |
| apache-airflow-providers-yandex; extra == "yandex" |
| apache-airflow-providers-ydb; extra == "ydb" |
| apache-airflow-providers-zendesk; extra == "zendesk" |
| apache-airflow[aiobotocore]; extra == "all-core" |
| apache-airflow[apache-atlas]; extra == "all-core" |
| apache-airflow[apache-webhdfs]; extra == "all-core" |
| apache-airflow[async]; extra == "all-core" |
| apache-airflow[cgroups]; extra == "all-core" |
| apache-airflow[cloudpickle]; extra == "all-core" |
| apache-airflow[deprecated-api]; extra == "all-core" |
| apache-airflow[github-enterprise]; extra == "all-core" |
| apache-airflow[google-auth]; extra == "all-core" |
| apache-airflow[graphviz]; extra == "all-core" |
| apache-airflow[kerberos]; extra == "all-core" |
| apache-airflow[ldap]; extra == "all-core" |
| apache-airflow[leveldb]; extra == "all-core" |
| apache-airflow[otel]; extra == "all-core" |
| apache-airflow[pandas]; extra == "all-core" |
| apache-airflow[password]; extra == "all-core" |
| apache-airflow[pydantic]; extra == "all-core" |
| apache-airflow[rabbitmq]; extra == "all-core" |
| apache-airflow[s3fs]; extra == "all-core" |
| apache-airflow[saml]; extra == "all-core" |
| apache-airflow[sentry]; extra == "all-core" |
| apache-airflow[statsd]; extra == "all-core" |
| apache-airflow[uv]; extra == "all-core" |
| apache-airflow[virtualenv]; extra == "all-core" |
| apache-airflow[aiobotocore]; extra == "all" |
| apache-airflow[airbyte]; extra == "all" |
| apache-airflow[alibaba]; extra == "all" |
| apache-airflow[all-dbs]; extra == "all" |
| apache-airflow[amazon]; extra == "all" |
| apache-airflow[apache-atlas]; extra == "all" |
| apache-airflow[apache-beam]; extra == "all" |
| apache-airflow[apache-cassandra]; extra == "all" |
| apache-airflow[apache-drill]; extra == "all" |
| apache-airflow[apache-druid]; extra == "all" |
| apache-airflow[apache-flink]; extra == "all" |
| apache-airflow[apache-hdfs]; extra == "all" |
| apache-airflow[apache-hive]; extra == "all" |
| apache-airflow[apache-iceberg]; extra == "all" |
| apache-airflow[apache-impala]; extra == "all" |
| apache-airflow[apache-kafka]; extra == "all" |
| apache-airflow[apache-kylin]; extra == "all" |
| apache-airflow[apache-livy]; extra == "all" |
| apache-airflow[apache-pig]; extra == "all" |
| apache-airflow[apache-pinot]; extra == "all" |
| apache-airflow[apache-spark]; extra == "all" |
| apache-airflow[apache-webhdfs]; extra == "all" |
| apache-airflow[apprise]; extra == "all" |
| apache-airflow[arangodb]; extra == "all" |
| apache-airflow[asana]; extra == "all" |
| apache-airflow[async]; extra == "all" |
| apache-airflow[atlassian-jira]; extra == "all" |
| apache-airflow[celery]; extra == "all" |
| apache-airflow[cgroups]; extra == "all" |
| apache-airflow[cloudant]; extra == "all" |
| apache-airflow[cloudpickle]; extra == "all" |
| apache-airflow[cncf-kubernetes]; extra == "all" |
| apache-airflow[cohere]; extra == "all" |
| apache-airflow[common-compat]; extra == "all" |
| apache-airflow[common-io]; extra == "all" |
| apache-airflow[common-sql]; extra == "all" |
| apache-airflow[databricks]; extra == "all" |
| apache-airflow[datadog]; extra == "all" |
| apache-airflow[dbt-cloud]; extra == "all" |
| apache-airflow[deprecated-api]; extra == "all" |
| apache-airflow[dingding]; extra == "all" |
| apache-airflow[discord]; extra == "all" |
| apache-airflow[docker]; extra == "all" |
| apache-airflow[elasticsearch]; extra == "all" |
| apache-airflow[exasol]; extra == "all" |
| apache-airflow[fab]; extra == "all" |
| apache-airflow[facebook]; extra == "all" |
| apache-airflow[ftp]; extra == "all" |
| apache-airflow[github]; extra == "all" |
| apache-airflow[github-enterprise]; extra == "all" |
| apache-airflow[google]; extra == "all" |
| apache-airflow[google-auth]; extra == "all" |
| apache-airflow[graphviz]; extra == "all" |
| apache-airflow[grpc]; extra == "all" |
| apache-airflow[hashicorp]; extra == "all" |
| apache-airflow[http]; extra == "all" |
| apache-airflow[imap]; extra == "all" |
| apache-airflow[influxdb]; extra == "all" |
| apache-airflow[jdbc]; extra == "all" |
| apache-airflow[jenkins]; extra == "all" |
| apache-airflow[kerberos]; extra == "all" |
| apache-airflow[ldap]; extra == "all" |
| apache-airflow[leveldb]; extra == "all" |
| apache-airflow[microsoft-azure]; extra == "all" |
| apache-airflow[microsoft-mssql]; extra == "all" |
| apache-airflow[microsoft-psrp]; extra == "all" |
| apache-airflow[microsoft-winrm]; extra == "all" |
| apache-airflow[mongo]; extra == "all" |
| apache-airflow[mysql]; extra == "all" |
| apache-airflow[neo4j]; extra == "all" |
| apache-airflow[odbc]; extra == "all" |
| apache-airflow[openai]; extra == "all" |
| apache-airflow[openfaas]; extra == "all" |
| apache-airflow[openlineage]; extra == "all" |
| apache-airflow[opensearch]; extra == "all" |
| apache-airflow[opsgenie]; extra == "all" |
| apache-airflow[oracle]; extra == "all" |
| apache-airflow[otel]; extra == "all" |
| apache-airflow[pagerduty]; extra == "all" |
| apache-airflow[pandas]; extra == "all" |
| apache-airflow[papermill]; extra == "all" |
| apache-airflow[password]; extra == "all" |
| apache-airflow[pgvector]; extra == "all" |
| apache-airflow[pinecone]; extra == "all" |
| apache-airflow[postgres]; extra == "all" |
| apache-airflow[presto]; extra == "all" |
| apache-airflow[pydantic]; extra == "all" |
| apache-airflow[qdrant]; extra == "all" |
| apache-airflow[rabbitmq]; extra == "all" |
| apache-airflow[redis]; extra == "all" |
| apache-airflow[s3fs]; extra == "all" |
| apache-airflow[salesforce]; extra == "all" |
| apache-airflow[samba]; extra == "all" |
| apache-airflow[saml]; extra == "all" |
| apache-airflow[segment]; extra == "all" |
| apache-airflow[sendgrid]; extra == "all" |
| apache-airflow[sentry]; extra == "all" |
| apache-airflow[sftp]; extra == "all" |
| apache-airflow[singularity]; extra == "all" |
| apache-airflow[slack]; extra == "all" |
| apache-airflow[smtp]; extra == "all" |
| apache-airflow[snowflake]; extra == "all" |
| apache-airflow[sqlite]; extra == "all" |
| apache-airflow[ssh]; extra == "all" |
| apache-airflow[statsd]; extra == "all" |
| apache-airflow[tableau]; extra == "all" |
| apache-airflow[tabular]; extra == "all" |
| apache-airflow[telegram]; extra == "all" |
| apache-airflow[teradata]; extra == "all" |
| apache-airflow[trino]; extra == "all" |
| apache-airflow[uv]; extra == "all" |
| apache-airflow[vertica]; extra == "all" |
| apache-airflow[virtualenv]; extra == "all" |
| apache-airflow[weaviate]; extra == "all" |
| apache-airflow[yandex]; extra == "all" |
| apache-airflow[ydb]; extra == "all" |
| apache-airflow[zendesk]; extra == "all" |
| aiobotocore>=2.9.0; extra == "devel-ci" |
| aiofiles>=23.2.0; extra == "devel-ci" |
| aioresponses>=0.7.6; extra == "devel-ci" |
| amqp; extra == "devel-ci" |
| astroid<3.0,>=2.12.3; extra == "devel-ci" |
| atlasclient>=0.1.2; extra == "devel-ci" |
| authlib>=1.0.0; extra == "devel-ci" |
| backports-zoneinfo>=0.2.1; python_version < "3.9" and extra == "devel-ci" |
| bcrypt>=2.0.0; extra == "devel-ci" |
| beautifulsoup4>=4.7.1; extra == "devel-ci" |
| black>=23.12.0; extra == "devel-ci" |
| blinker>=1.1; extra == "devel-ci" |
| blinker>=1.7.0; extra == "devel-ci" |
| cgroupspy>=0.2.2; extra == "devel-ci" |
| checksumdir>=1.2.0; extra == "devel-ci" |
| click>=8.0; extra == "devel-ci" |
| click!=8.1.4,!=8.1.5,>=8.0; extra == "devel-ci" |
| cloudpickle; extra == "devel-ci" |
| coverage>=7.4.0; extra == "devel-ci" |
| diagrams>=0.23.4; extra == "devel-ci" |
| docutils<0.17,>=0.16; extra == "devel-ci" |
| duckdb>=0.10.0; python_version >= "3.12" and extra == "devel-ci" |
| duckdb>=0.9.0; python_version < "3.12" and extra == "devel-ci" |
| eralchemy2>=1.3.8; extra == "devel-ci" |
| eventlet>=0.33.3; extra == "devel-ci" |
| flask-bcrypt>=0.7.1; extra == "devel-ci" |
| gevent>=0.13; extra == "devel-ci" |
| gitpython>=3.1.40; extra == "devel-ci" |
| graphviz>=0.12; extra == "devel-ci" |
| greenlet>=0.4.9; extra == "devel-ci" |
| hatch>=1.9.1; extra == "devel-ci" |
| hdfs[avro,dataframe,kerberos]>=2.0.4; extra == "devel-ci" |
| incremental!=24.7.0,!=24.7.1,>=22.10.0; extra == "devel-ci" |
| ipdb>=0.13.13; extra == "devel-ci" |
| jmespath>=0.7.0; extra == "devel-ci" |
| ldap3>=2.5.1; extra == "devel-ci" |
| mypy==1.9.0; extra == "devel-ci" |
| opentelemetry-exporter-prometheus; extra == "devel-ci" |
| pandas<2.2,>=1.2.5; extra == "devel-ci" |
| pipdeptree>=2.13.1; extra == "devel-ci" |
| plyvel; extra == "devel-ci" |
| pre-commit>=3.5.0; extra == "devel-ci" |
| pydantic>=2.3.0; extra == "devel-ci" |
| pygithub>=2.1.1; extra == "devel-ci" |
| pykerberos>=1.1.13; extra == "devel-ci" |
| pytest-asyncio>=0.23.6; extra == "devel-ci" |
| pytest-cov>=4.1.0; extra == "devel-ci" |
| pytest-custom-exit-code>=0.3.0; extra == "devel-ci" |
| pytest-icdiff>=0.9; extra == "devel-ci" |
| pytest-instafail>=0.5.0; extra == "devel-ci" |
| pytest-mock>=3.12.0; extra == "devel-ci" |
| pytest-rerunfailures>=13.0; extra == "devel-ci" |
| pytest-timeouts>=1.2.1; extra == "devel-ci" |
| pytest-xdist>=3.5.0; extra == "devel-ci" |
| pytest<9,>=8.2; extra == "devel-ci" |
| python-ldap; extra == "devel-ci" |
| python3-saml>=1.16.0; extra == "devel-ci" |
| requests-kerberos>=0.10.0; extra == "devel-ci" |
| requests-mock>=1.11.0; extra == "devel-ci" |
| requests<3,>=2.27.0; extra == "devel-ci" |
| restructuredtext-lint>=1.4.0; extra == "devel-ci" |
| rich-click>=1.7.0; extra == "devel-ci" |
| ruff==0.5.5; extra == "devel-ci" |
| s3fs>=2023.10.0; extra == "devel-ci" |
| semver>=3.0.2; extra == "devel-ci" |
| sentry-sdk!=1.33.0,>=1.32.0; extra == "devel-ci" |
| sphinx-airflow-theme>=0.0.12; extra == "devel-ci" |
| sphinx-argparse>=0.4.0; extra == "devel-ci" |
| sphinx-autoapi>=2.1.1; extra == "devel-ci" |
| sphinx-copybutton>=0.5.2; extra == "devel-ci" |
| sphinx-design>=0.5.0; extra == "devel-ci" |
| sphinx-jinja>=2.0.2; extra == "devel-ci" |
| sphinx-rtd-theme>=2.0.0; extra == "devel-ci" |
| sphinx<6.0.0,>=5.3.0; extra == "devel-ci" |
| sphinxcontrib-applehelp>=1.0.4; extra == "devel-ci" |
| sphinxcontrib-devhelp>=1.0.2; extra == "devel-ci" |
| sphinxcontrib-htmlhelp>=2.0.1; extra == "devel-ci" |
| sphinxcontrib-httpdomain>=1.8.1; extra == "devel-ci" |
| sphinxcontrib-jquery>=4.1; extra == "devel-ci" |
| sphinxcontrib-jsmath>=1.0.1; extra == "devel-ci" |
| sphinxcontrib-qthelp>=1.0.3; extra == "devel-ci" |
| sphinxcontrib-redoc>=1.6.0; extra == "devel-ci" |
| sphinxcontrib-serializinghtml==1.1.5; extra == "devel-ci" |
| sphinxcontrib-spelling>=8.0.0; extra == "devel-ci" |
| statsd>=3.3.0; extra == "devel-ci" |
| thrift-sasl>=0.2.0; extra == "devel-ci" |
| time-machine>=2.13.0; extra == "devel-ci" |
| towncrier>=23.11.0; extra == "devel-ci" |
| twine>=4.0.2; extra == "devel-ci" |
| types-aiofiles; extra == "devel-ci" |
| types-certifi; extra == "devel-ci" |
| types-croniter; extra == "devel-ci" |
| types-deprecated; extra == "devel-ci" |
| types-docutils; extra == "devel-ci" |
| types-markdown; extra == "devel-ci" |
| types-paramiko; extra == "devel-ci" |
| types-protobuf; extra == "devel-ci" |
| types-pymysql; extra == "devel-ci" |
| types-python-dateutil; extra == "devel-ci" |
| types-python-slugify; extra == "devel-ci" |
| types-pytz; extra == "devel-ci" |
| types-pyyaml; extra == "devel-ci" |
| types-redis; extra == "devel-ci" |
| types-requests; extra == "devel-ci" |
| types-setuptools; extra == "devel-ci" |
| types-tabulate; extra == "devel-ci" |
| types-termcolor; extra == "devel-ci" |
| types-toml; extra == "devel-ci" |
| uv>=0.1.32; extra == "devel-ci" |
| virtualenv; extra == "devel-ci" |
| wheel>=0.42.0; extra == "devel-ci" |
| yamllint>=1.33.0; extra == "devel-ci" |