https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T21:30:49.330437+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-airflow-2026-34538 BIT-airflow-2026-34538 — Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure) 2026-10-06T21:30:49.754898+00:00

Affected: Bitnami: airflow

Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security model documentation that defines the Viewer role as read-only.

Airflow uses the FAB Auth Manager to manage access control on a per-resource basis. The Viewer role is intended to be read-only by default, and the security model documentation defines Viewer users as those who can inspect DAGs without accessing sensitive execution results.

Users are recommended to upgrade to Apache Airflow 3.2.0 which resolves this issue.

 https://cve.radiocsirt.org/vuln/euvd-2026-290194 EUVD-2026-290194 2026-10-06T21:30:49.754981+00:00 EUVD-2026-290194 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34538 fkie_cve-2026-34538 2026-10-06T21:30:49.755006+00:00

Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security model documentation that defines the Viewer role as read-only.

Airflow uses the FAB Auth Manager to manage access control on a per-resource basis. The Viewer role is intended to be read-only by default, and the security model documentation defines Viewer users as those who can inspect DAGs without accessing sensitive execution results.

Users are recommended to upgrade to Apache Airflow 3.2.0 which resolves this issue.

 https://cve.radiocsirt.org/vuln/ghsa-r7vr-m4jw-r794 GHSA-r7vr-m4jw-r794 — Apache Airflow has an authorization bypass in DagRun wait endpoint 2026-10-06T21:30:49.755048+00:00

Affected: PyPI: apache-airflow

Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security model documentation that defines the Viewer role as read-only.

Airflow uses the FAB Auth Manager to manage access control on a per-resource basis. The Viewer role is intended to be read-only by default, and the security model documentation defines Viewer users as those who can inspect DAGs without accessing sensitive execution results.

Users are recommended to upgrade to Apache Airflow 3.2.0 which resolves this issue.

 https://cve.radiocsirt.org/vuln/pysec-2026-21 PYSEC-2026-21 2026-10-06T21:30:49.755086+00:00

Affected: PyPI: apache-airflow

Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security model documentation that defines the Viewer role as read-only.

Airflow uses the FAB Auth Manager to manage access control on a per-resource basis. The Viewer role is intended to be read-only by default, and the security model documentation defines Viewer users as those who can inspect DAGs without accessing sensitive execution results.

Users are recommended to upgrade to Apache Airflow 3.2.0 which resolves this issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1042 WID-SEC-W-2026-1042 — Apache Airflow: Mehrere Schwachstellen 2026-10-06T21:30:49.755119+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um Sicherheitsvorkehrungen zu umgehen und vertrauliche Informationen offenzulegen.