← All credits
Amogh Desai
10 vulnerability records and advisories credit this contributor.
CVE-2026-25917
Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)
CVE-2025-66236
Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI
CVE-2026-33858
Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API
CVE-2025-68438
Apache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated
CVE-2025-66388
Apache Airflow: Secrets in rendered templates not redacted properly and exposed in the UI
CVE-2024-41937
Apache Airflow: Stored XSS Vulnerability on provider link
CVE-2024-45784
Apache Airflow: Sensitive configuration values are not masked in the logs by default
CVE-2024-45498
Apache Airflow: Command Injection in an example DAG
CVE-2024-39863
Apache Airflow: Potential XSS Vulnerability
CVE-2024-45034
Apache Airflow: Authenticated DAG authors could execute code on scheduler nodes