Apache Airflow vulnerabilities

Since version 5.2.0, when using deferrable mode with a Kubernetes configuration file for authentication, the Airflow worker serializes this file as a dictionary and stores it in metadata without encryption. In versions 2.3.0-2.6.0, the dictionary is also logged as plain text in the triggerer service. This allows anyone with access to metadata or logs to obtain the configuration file and access the Kubernetes cluster.

The session fixation vulnerability allowed authenticated users to continue accessing the Airflow webserver even after their password was reset by the admin, until the user's session expired. The fix implemented invalidates existing user sessions when the password is reset, when using the database session backend.

Apache Airflow, in versions prior to 2.7.0, contains a vulnerability that can be exploited by an authenticated user with Connection edit privileges. This allows access to connection information and the exploitation of the test connection feature, potentially leading to a denial of service (DoS) condition on the server.

A vulnerability in Apache Airflow allows authenticated users to bypass some restrictions, enabling code execution in the webserver context and access to certain DAGs that the user normally cannot access. The 'Run Task' feature has been deemed dangerous and removed in version 2.6.0.

Apache Airflow, versions before 2.6.3, has a vulnerability where an authenticated user can use crafted input to make the current request hang.

Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL.

In Apache Airflow, there is a vulnerability that may expose potentially sensitive values to users in certain situations. This issue affects versions from 2.5.0 before 2.6.2.