← All credits
Jarek Potiuk
57 vulnerability records and advisories credit this contributor.
CVE-2026-42358
Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets
CVE-2026-41017
Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy
CVE-2026-49267
Apache Airflow: No certificate validation on SMTP STARTTLS connections
CVE-2026-41014
Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints
CVE-2026-40861
Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler
CVE-2026-45360
Apache Airflow: Arbitrary import in custom deadline-reference deserialization
CVE-2026-42359
Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator
CVE-2026-45361
Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)
CVE-2026-40963
Apache Airflow: DAG authorization bypass on /ui/structure/structure_data
CVE-2026-42360
Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking