Jarek Potiuk

Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions

Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access

Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity

Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT

Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated

Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection

Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI

Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext

Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)