Core packages for Apache Airflow, schedule and API server
Apache-2.0
All Versions
Vulnerabilities (Public)
Known vulnerabilities and security issues detected in the extension's dependencies and code.
| Vulnerability ID | Advisory | Affected Versions | |||
|---|---|---|---|---|---|
| CVE-2026-49298 | apache-airflow-core – Information Disclosure | High | – | – | < 3.2.2 |
| CVE-2026-30912 | Affected versions of the apache-airflow-core package are vulnerable to Information Disclosure due to the api/expose_stack_traces configuration setting being ignored when SQL errors occur. When a SQL e… | High | – | – | <3.2.0 |
| CVE-2026-25917 | Affected versions of the apache-airflow-core package are vulnerable to Remote Code Execution due to unsafe deserialisation or evaluation of XCom payloads when rendered in the webserver context. A DAG … | High | – | – | <3.2.0 |
| CVE-2026-32228 | Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions | High | – | – | >= 3.0.0, < 3.2.0 |
| CVE-2026-32690 | apache-airflow-core – Exposure of Resource to Wrong Sphere | Low | – | – | >=3.0.0,<3.2.0 |
Safety Discovered Vulnerabilities
Additional security issues found by Safety, exclusive to our platform.