Andrew Rukin

Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded `next kwargs` value is a dictionary, but performs that check only after deserializing the whole stored payload. Deserialization reconstructs nested objects of classes permitted by the deserialization allow-list — which by default includes Airflow's own classes — and runs their constructors inside the scheduler process before the check can reject the value. A Dag author, who controls a task's `next kwargs` through the task execution API, can therefore still trigger constructor execution in the scheduler when the `awaiting input` timeout sweep processes the task, and in the API server when the task instance is served to a worker using an older Execution API version; no non-default configuration is required. Versions before 3.3.0 are not affected. This is an incomplete fix for CVE-2026-67260: deployments that upgraded to 3.3.1 for that issue must also upgrade to apache-airflow 3.4.0 or later.

The `example dag decorator` example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Python's `ipaddress` module and then placed it into a shell command. `ipaddress` accepts IPv6 zone identifiers containing arbitrary characters, so when example Dags are loaded (`load examples` enabled), a user who can trigger that Dag with a custom `url` parameter could point it at a server whose response injects shell commands run on the worker. This is an incomplete fix for CVE-2025-54941; users who upgraded for CVE-2025-54941 should upgrade again. Users are advised to upgrade to apache-airflow 3.4.0 or later, or to disable example Dags (`load examples = False`), which is recommended for production.

The AWS auth manager's SAML login flow fails to bind the authentication response to the browser that initiated the request. The login handler discards the `AuthnRequest` ID, and the callback validates the assertion without requiring a matching `InResponseTo`. This allows an unauthenticated attacker to trick a victim into loading a page, completing a SAML login in the victim's browser using the attacker's own assertion. Consequently, the victim is silently logged into the attacker's Airflow account, and any subsequent actions performed by the victim occur within a session controlled by the attacker.

Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens.  Bearer token (JWT) signatures are not validated resulting in the webserver accepting any valid JWT. Users are recommended to either disable JWT/OAuth auth for Impala executors or upgrade to version 4.5.3, which fixes this issue.

A path traversal issue exists in the `trusted jar paths` startup flag, which is used to reference URIs for loading files from local or remote filesystems. This allows an attacker to load a controlled JAR file via a relative path, provided the prefix matches a path already specified in `trusted jar paths`. While the schema cannot be overridden, this can lead to the execution of a JAR previously uploaded to a different location on the filesystem using Impala DDLs, such as `CREATE DATA SOURCE` and `CREATE TABLE`. This issue requires the `trusted jar paths` flag to be configured with a non-empty value by an administrator.

A stored Cross-Site Scripting (XSS) issue exists where an SQL user with only SELECT permissions can inject JavaScript into a table alias. This script executes in the browser of another user when they view the query plan through the Impala Web UI.

The compute-cluster example Dag in the Apache Airflow Teradata provider declares Dag Params as unconstrained free text. These values are templated directly into compute-cluster operators, which interpolate them into Teradata DDL (Data Definition Language). A user with permissions to trigger the Dag can provide SQL fragments that execute using the task's connection. Additionally, because the connection ID is a free-text Param, the user can redirect the task to any other connection defined in the deployment.

In the `hs2-http` interface, the signature of the Bearer token is not verified during the final step of SAML2 authentication. This flaw allows an attacker to alter the user name and forge identities to act as another user without requiring prior authentication.

Improper authentication occurs during SAML bearer-token validation in HiveServer2 on deployments using HTTP transport with `hive.server2.authentication=SAML`. An unauthenticated network attacker can authenticate as an arbitrary Hive user and obtain an authenticated HiveServer2 session by sending a forged Authorization: Bearer token to the `/cliservice` HTTP endpoint. This exploit requires no Hive credentials, SAML Identity Provider (IdP) login, or knowledge of the server signing secret, requiring only network reachability to the HiveServer2 HTTP port.

The environment-variable secrets backend incorrectly resolves team-scoped Connections or Variables from the wrong team's scope. This occurs because the security guard intended to prevent this behavior only executes when no team scope is provided and fails to match team names containing underscores. Consequently, the system performs an unconditional global read of the `AIRFLOW CONN <TEAM> <ID>` variable, regardless of the requesting team. In multi-team mode, an authenticated user can use the `POST /api/v2/connections/test` endpoint to resolve another team's Connection and authenticate outward using those credentials. Exploitation requires the `[core] multi team` setting to be enabled, `[core] test connection` to be set to `Enabled`, team-scoped secrets to be provisioned as environment variables in the API-server process, and knowledge of the encoded identifier.

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets masker matched only base section and option names and did not normalize team-prefixed sections before the sensitivity check (CWE-200). This is a distinct masker bypass from CVE-2026-48828 and CVE-2026-48892: deployments that upgraded to apache-airflow 3.3.0 to address those issues remain affected by this team-scoped variant. Users are advised to upgrade to apache-airflow 3.3.1 or later, which normalizes team-scoped sections before masking.

An issue exists where the `trust-fetch-domains` command is restricted by a read-only permission on the trust object instead of a trust-administration permission. This allows an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh by providing an attacker-supplied server and credentials. This can lead to unauthorized modification of trusted-domain and ID-range identity data within the IPA LDAP directory.

Remote Code Execution is possible through JDBC URL Injection. This occurs when an application fails to properly sanitize the JDBC URL, allowing an attacker to inject malicious parameters that can lead to the execution of arbitrary code on the server.

Remote Code Execution is possible through arbitrary class instantiation within the `plugin-schema-registry` component. Arbitrary class instantiation occurs when an application creates an instance of a class specified by user-supplied input, which can lead to the execution of unauthorized code.

Authentication is missing in the Download APIs, which could allow unauthorized access to resources.

An issue exists in the client code where TLS hostname verification is not properly performed. TLS (Transport Layer Security) hostname verification is a process that ensures the server the client is connecting to is actually the server it claims to be by verifying the hostname in the certificate.

Logs contain replayable JSON Web Tokens (JWT), which are compact, URL-safe means of representing claims to be transferred between two parties.

The UnixAuth component lacks protection against brute-force attacks. UnixAuth is a method used for user authentication against Unix system accounts.

An issue allows for privilege escalation through the manipulation of a URL parameter.

The REST API task-instance detail and list endpoints return a deferred task's trigger kwargs without masking. This allows any authenticated user with DAG-scoped task-instance read access to view sensitive information, such as provider API keys, in clear text while the task is deferred.