https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T23:08:00.747244+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2021-38540 CVE-2021-38540 — Apache Airflow: Variable Import endpoint missed authentication check 2026-10-17T23:08:00.749736+00:00

Affected: Apache Software Foundation Apache Airflow

The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow >=2.0.0, <2.1.3.

 https://cve.radiocsirt.org/vuln/ghsa-h88f-r7cw-8fv3 GHSA-h88f-r7cw-8fv3 — Missing Authentication for Critical Function in Apache Airflow 2026-10-17T23:08:00.749811+00:00

Affected: PyPI: apache-airflow

The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow >=2.0.0, <2.1.3.