wid-sec-w-2026-0636
·
Published 2026-03-08
·
View on BSI CERT-Bund ↗
Apache Airflow: Vulnerability allows Code execution
CVSS 8.8
HIGH
Risk Summary
A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same permissions as Dag Author. Since direct DB access is not usual and recommended for Airflow, the likelihood of it making any damage is low. You should upgrade to version 6.0.0 of the provider to avoid even that risk.
CVEs (1)
Affected Vendors
Apache
Affected Products (2)
Apache
·
Airflow
Providers Http <6.0.0
Apache
·
Airflow
Providers Http 6.0.0
Get alerted to advisories like this
OTWarden monitors CISA, BSI, Siemens, Rockwell and more — and emails you within 2 hours when your vendors are affected.
Start free trial Learn more