https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T18:21:12.016648+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-airflow-2021-26559 BIT-airflow-2021-26559 — CWE-284 Improper Access Control on Configurations Endpoint for the Stable API 2026-10-18T18:21:12.020701+00:00

Affected: Bitnami: airflow

Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when `[webserver] expose_config` is set to `False` in `airflow.cfg`. This allowed a privilege escalation attack. This issue affects Apache Airflow 2.0.0.

 https://cve.radiocsirt.org/vuln/cnvd-2021-12107 cnvd-2021-12107 2026-10-18T18:21:12.020751+00:00 cnvd-2021-12107 https://cve.radiocsirt.org/vuln/euvd-2026-215958 EUVD-2026-215958 2026-10-18T18:21:12.020768+00:00 EUVD-2026-215958 https://cve.radiocsirt.org/vuln/fkie_cve-2021-26559 fkie_cve-2021-26559 2026-10-18T18:21:12.020780+00:00

Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when `[webserver] expose_config` is set to `False` in `airflow.cfg`. This allowed a privilege escalation attack. This issue affects Apache Airflow 2.0.0.

 https://cve.radiocsirt.org/vuln/ghsa-ffw3-6mp6-jmvj GHSA-ffw3-6mp6-jmvj — Improper Access Control in Apache Airflow 2026-10-18T18:21:12.020801+00:00

Affected: PyPI: apache-airflow

Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when `[webserver] expose_config` is set to `False` in `airflow.cfg`. This allowed a privilege escalation attack. This issue affects Apache Airflow 2.0.0.

 https://cve.radiocsirt.org/vuln/gsd-2021-26559 gsd-2021-26559 2026-10-18T18:21:12.020821+00:00 gsd-2021-26559 https://cve.radiocsirt.org/vuln/pysec-2021-2 PYSEC-2021-2 2026-10-18T18:21:12.020832+00:00

Affected: PyPI: apache-airflow

Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when `[webserver] expose_config` is set to `False` in `airflow.cfg`. This allowed a privilege escalation attack. This issue affects Apache Airflow 2.0.0.