[NEW] [medium] Apache Airflow: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in Apache Airflow to bypass security precautions, manipulate data, disclose confidential information or trigger a Denial-of-Service condition.
CSIRTS triage
- What
- Multiple vulnerabilities in Apache Airflow enable attackers to bypass security controls, manipulate data, disclose confidential information, and trigger denial of service.
- Who is affected
- Apache Airflow deployments of unspecified versions are affected.
- Urgency
- Medium urgency; security bypass and data disclosure risks present, but no active exploitation reported.
- Action
- Update Apache Airflow to a patched version addressing CVE-2026-54183, CVE-2026-58076, CVE-2026-59242, CVE-2026-59244, CVE-2026-65017, CVE-2026-67260, CVE-2026-67587, and CVE-2026-68076.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Airflow
Get an email when a new Airflow advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2823
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-541830.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-580760.48% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 40% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-592420.58% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 45% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-592440.23% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 14% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-650170.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-672600.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-675870.42% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 35% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-680760.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-688680.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-689680.42% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 35% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-54183 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-58076 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-59242 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-59244 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-65017 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-67260 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-67587 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-68076 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-68868 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-68968 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-68969 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-68970 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-68971 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- mediumCVE-2026-68971: Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`)…nvd
- mediumCVE-2026-68970: Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, …nvd
- mediumCVE-2026-68969: Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in clear…nvd
- highCVE-2026-68968: Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whe…nvd
- mediumCVE-2026-68076: Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Var…nvd
- highCVE-2026-67587: Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its c…nvd
- highCVE-2026-67260: Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input…nvd
- mediumCVE-2026-65017: Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-t…nvd
- mediumCVE-2026-59244: Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict …nvd
- mediumCVE-2026-59242: Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a…nvd
- highCVE-2026-58076: Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()…nvd
- mediumCVE-2026-54183: Apache Airflow's secrets masker hides values stored under sensitive key names when they are di…nvd
Recent advisories for Apache Airflow
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- mediumCVE-2026-68971: Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`)…nvd · 2026-08-12
- mediumCVE-2026-68970: Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, …nvd · 2026-08-12
- mediumCVE-2026-68969: Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in clear…nvd · 2026-08-12
- highCVE-2026-68968: Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whe…nvd · 2026-08-12
- mediumCVE-2026-68076: Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Var…nvd · 2026-08-12
- highCVE-2026-67587: Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its c…nvd · 2026-08-12
More from CERT-Bund (BSI) Security Advisories
- high[NEW] [high] GStreamer: Multiple Vulnerabilities2026-08-17
- high[NEW] [high] Golang Go: Multiple vulnerabilities2026-08-17
- medium[NEW] [medium] Apache Struts: Multiple vulnerabilities2026-08-17
- high[NEW] [high] PostgreSQL: Multiple vulnerabilities2026-08-17
- high[UPDATE] [high] Oracle PeopleSoft: Multiple Vulnerabilities2026-08-17