https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T12:38:16.892626+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-airflow-2022-38170 BIT-airflow-2022-38170 — Overly permissive umask for daemons 2026-10-17T12:38:16.896341+00:00

Affected: Bitnami: airflow

In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver.

 https://cve.radiocsirt.org/vuln/euvd-2026-18952 EUVD-2026-18952 2026-10-17T12:38:16.896396+00:00 EUVD-2026-18952 https://cve.radiocsirt.org/vuln/fkie_cve-2022-38170 fkie_cve-2022-38170 2026-10-17T12:38:16.896414+00:00

In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver.

 https://cve.radiocsirt.org/vuln/ghsa-q8h9-pqcx-59hw GHSA-q8h9-pqcx-59hw — Apache Airflow exposes arbitrary file content 2026-10-17T12:38:16.896437+00:00

Affected: PyPI: apache-airflow

In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver.

 https://cve.radiocsirt.org/vuln/gsd-2022-38170 gsd-2022-38170 2026-10-17T12:38:16.896459+00:00 gsd-2022-38170 https://cve.radiocsirt.org/vuln/pysec-2022-261 PYSEC-2022-261 2026-10-17T12:38:16.896470+00:00

Affected: PyPI: apache-airflow

In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver.