Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN736 _____________________________________________________________________ DATE : 09/07/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Apache Airflow versions prior to 3.3.0. ===================================================================== https://lists.apache.org/thread/xnxcz9262vyjs2h4ghqys1sx74h1sy3r https://lists.apache.org/thread/g4tqnrjr7t52p7yod979rg5s0k33bryp https://lists.apache.org/thread/n7odn2f1shzdpkrt5hrv8wg5xgbypo39 https://lists.apache.org/thread/tz7gq97p83639f9fog0lb0dynogcolt2 https://lists.apache.org/thread/5s7z5314j9p7ho5tmxvmhbmpo4nz4gh7 https://lists.apache.org/thread/vh5bqng9rqplbhz8xyltvw7ntw7v5px8 _____________________________________________________________________ CVE-2026-33264: Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize() Severity: important Affected versions: - Apache Airflow (apache-airflow) before 3.3.0 Description: A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Users are advised to upgrade to `apache-airflow` 3.3.0 or later. As a defense-in-depth mitigation, deployments where DAG-author trust is limited can restrict the `[core] allowed_deserialization_classes` config to a narrow allowlist. Credit: Ziyu Lin (finder) bugbunny.ai (tool) intadd (GitHub handle: @intadd) (finder) K (finder) Amogh Desai (@amoghrajesh) (remediation developer) Jarek Potiuk (remediation developer) References: https://github.com/apache/airflow/pull/66002 https://github.com/apache/airflow/pull/68528 https://airflow.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-33264 _____________________________________________________________________ CVE-2026-49487: Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs Severity: moderate Affected versions: - Apache Airflow (apache-airflow) before 3.3.0 Description: In Apache Airflow before 3.3.0, the REST API task-instance detail and list endpoints returned a deferred task's trigger kwargs without masking. When a deferred operator passed a secret (for example a provider API key) into its trigger, any authenticated user with DAG-scoped task-instance read access for that DAG could read that secret in clear text while the task was deferred. Users should upgrade to apache-airflow 3.3.0 or later, which masks sensitive values in trigger kwargs returned by the API. Credit: Andrew Rukin (Arenadata) (finder) Jarek Potiuk (@potiuk) (remediation developer) References: https://github.com/apache/airflow/pull/67868 https://airflow.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-49487 _____________________________________________________________________ CVE-2026-48828: Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key Severity: moderate Affected versions: - Apache Airflow (apache-airflow) before 3.3.0 Description: The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based `should_hide_value_for_key` check (which triggers on secret-suffixed key names like `*_password` / `*_token` / `*_secret`) could not fire for JSON-decodable variable values. An authenticated UI/API user with bulk Variable read permission could retrieve plaintext values from JSON variables whose key would otherwise trigger redaction. Affects deployments that store sensitive values in JSON-typed Airflow Variables under secret-suffixed key names. Users are advised to upgrade to `apache-airflow` 3.3.0 or later (the fix landed on `main` after 3.2.2; no 3.2.x backport). Credit: Omkhar Arasaratnam (@omkhar) (finder) Shubham Raj (@shubhamraj-git) (remediation developer) References: https://github.com/apache/airflow/pull/67495 https://airflow.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-48828 _____________________________________________________________________ CVE-2026-49296: Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id} Severity: low Affected versions: - Apache Airflow (apache-airflow) 3.0.0 before 3.3.0 Description: Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. `GET /api/v2/dagSources/{dag_id}` — and the equivalent Dag-source view in the UI — returned the entire source file without redacting Dags the caller was not authorized to read, bypassing per-DAG read authorization. Deployments that co-locate multiple Dags in a single file and rely on per-DAG access control to limit source visibility are affected; single-Dag-per-file deployments are not. Upgrade to apache-airflow 3.3.0 or later. Credit: Matteo Panzeri (Università di Pavia), GitHub @matte1782 (finder) Jarek Potiuk (remediation developer) References: https://github.com/apache/airflow/pull/67662 https://airflow.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-49296 _____________________________________________________________________ CVE-2026-48891: Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigge /sensor dep.source/dep.target Severity: low Affected versions: - Apache Airflow (apache-airflow) before 3.3.0 Description: A bug in Apache Airflow's `/ui/dependencies` scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the `dep.source` and `dep.target` fields of trigger / sensor dependency entries. An authenticated UI user with read permission on some Dags could enumerate the identifiers of other Dags they were not authorized to read by inspecting the dependency graph for trigger / sensor references. Affects deployments that rely on per-Dag read scoping to keep Dag identifiers private across teams. This is a residual gap in the fix for CVE-2026-28563, which filtered the top-level Dag key but did not propagate the filter into the trigger / sensor dep-source / dep-target fields. Users who already upgraded for CVE-2026-28563 should additionally upgrade to `apache-airflow` 3.3.0 or later to cover the residual trigger / sensor dependency leak. Credit: Mitchell Benjamin / Revamp Studio (finder) Jarek Potiuk (remediation developer) References: https://github.com/apache/airflow/pull/67627 https://www.cve.org/CVERecord?id=CVE-2026-28563 https://airflow.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-48891 _____________________________________________________________________ CVE-2026-48892: Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options Severity: moderate Affected versions: - Apache Airflow (apache-airflow) before 3.3.0 Description: The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables like `AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and `AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID`) as synthetic config options whose option names were not in `sensitive_config_values`, so the masker did not redact them. An authenticated UI/API user with Config read permission could retrieve plaintext secrets-backend credentials (Vault `role_id` / `secret_id`, etc.) from the Config API output. Affects deployments that configure secrets backends via per-key environment overrides. Users are advised to upgrade to `apache-airflow` 3.3.0 or later. Credit: Omkhar Arasaratnam (@omkhar) (finder) Jarek Potiuk (remediation developer) References: https://github.com/apache/airflow/pull/67622 https://airflow.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-48892 ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================