CGA-5662-R5JM-85PR: airflow-3
Unknown
Published Date unknownLast modified Date unknown
Status not reported
The data service did not report a status for this record. Only the available sections are shown.Vulnerability summary
CGA-5662-R5JM-85PR is a vulnerability in airflow-3 with no CVSS score yet.
Priority
Insufficient evidence
No CVSS vector published; no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
Not scored
010
No CVSS score recordedEPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
No timeline events recorded.
Description
No description has been published for this record.
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in the CISA KEV catalog.
Not in the ENISA CNW catalog.
Not in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Version check
Known conditions: not stated in public data.
Chainguard127 products
- airflow-2< 2.11.0-r5
- airflow-2-bitnami-compat< 2.11.0-r5
- airflow-2-compat< 2.11.0-r5
- airflow-2-iamguarded-compat< 2.11.0-r5
- airflow-3< 3.0.2-r2
- airflow-3-bitnami-compat< 3.0.2-r2
- airflow-3-compat< 3.0.2-r2
- airflow-3-iamguarded-compat< 3.0.2-r2
- airflow-core-2< 2.11.0-r3
- airflow-core-2-compat< 2.11.0-r3
- airflow-core-2-oci-entrypoint< 2.11.0-r3
- ansible-operatorAll versions (No fix recorded)
- ansible-operator-compatAll versions (No fix recorded)
- apache-beam-python-3.11-sdk< 2.65.0-r2
- az< 2.74.0-r3
- az-iamguarded-compat< 2.74.0-r3
- barman< 3.14.1-r0
- barman-cloudnative-pg< 3.14.1-r0
- confluent-docker-utils< 0.0.162-r1
- dask-gateway< 2025.4.0-r1
- dask-gateway-server< 2025.4.0-r1
- dask-kubernetes< 2025.4.3-r4
- datadog-agent< 7.71.2-r3
- datadog-agent-core-integrations< 7.72.2-r0
- datadog-agent-core-integrations-fips< 7.72.1-r0
- datadog-agent-fips< 7.72.0-r0
- emissary< 3.10.0-r6
- emissary-apiext< 3.10.0-r6
- emissary-oci-entrypoint< 3.10.0-r6
- ggshield< 1.43.0-r0
- grafana-oncall< 1.16.3-r0
- grafana-oncall-compat< 1.16.3-r0
- jupyter-base-notebook< 7.4.3-r2
- jwt-tool< 2.3.0-r2
- k8s-sidecar< 1.30.5-r0
- katib-earlystopping< 0.19.0-r3
- kserve< 0.16.0-r6
- kserve-agent< 0.16.0-r6
- kserve-agent-compat< 0.16.0-r6
- kserve-manager< 0.16.0-r6
- kserve-manager-compat< 0.16.0-r6
- kserve-qpext< 0.16.0-r6
- kserve-qpext-compat< 0.16.0-r6
- kserve-router< 0.16.0-r6
- kserve-router-compat< 0.16.0-r6
- kserve-storage-controller< 0.16.0-r6
- kubeflow-jupyter-web-app< 1.10.0-r5
- kubeflow-pipelines< 2.5.0-r4
- kubeflow-pipelines-apiserver< 2.5.0-r4
- kubeflow-pipelines-cache_server< 2.5.0-r4
- kubeflow-pipelines-cache-deployer< 2.5.0-r4
- kubeflow-pipelines-cache-deployer-compat< 2.5.0-r4
- kubeflow-pipelines-frontend< 2.5.0-r4
- kubeflow-pipelines-metadata-envoy-config< 2.5.0-r4
- kubeflow-pipelines-metadata-writer< 2.5.0-r4
- kubeflow-pipelines-metadata-writer-compat< 2.5.0-r4
- kubeflow-pipelines-persistence_agent< 2.5.0-r4
- kubeflow-pipelines-scheduledworkflow< 2.5.0-r4
- kubeflow-pipelines-viewer-crd-controller< 2.5.0-r4
- mlflow< 3.1.0-r3
- mlflow-bitnami< 3.1.0-r3
- mlflow-iamguarded-compat< 3.1.0-r3
- nemo< 2.3.1-r4
- pgadmin4< 9.4-r2
- pgadmin4-oci-entrypoint< 9.4-r2
- py3-cassandra-medusa< 0.26.0-r0
- py3-hashin< 1.0.5-r1
- py3-pipenv< 2025.0.3-r0
- py3-supported-pipenv< 2025.0.3-r0
- py3.10-ambassador< 3.10.0-r6
- py3.10-pip-base< 25.3-r1
- py3.10-pipenv< 2025.0.3-r0
- py3.10-pipenv-bin< 2025.0.3-r0
- py3.10-pytorch-cuda-11.8< 2.3.1-r6
- py3.10-pytorch-cuda-12.3< 2.3.1-r7
- py3.10-torchvision-cuda-12.3< 0.18.1-r6
- py3.10-vllm-cuda-11.8< 0.9.1-r1
- py3.10-wheels-torch-cuda-11.8< 2.3.1-r6
- py3.10-wheels-torch-cuda-12.3< 2.3.1-r7
- py3.10-wheels-torchvision-cuda-12.3< 0.18.1-r6
- py3.10-wheels-vllm-cuda-11.8< 0.9.1-r1
- py3.11-ambassador< 3.10.0-r6
- py3.11-pipenv< 2025.0.3-r0
- py3.11-pipenv-bin< 2025.0.3-r0
- py3.11-pytorch-cuda-11.8< 2.3.1-r7
- py3.11-pytorch-cuda-12.3< 2.3.1-r10
- py3.11-torchaudio-cuda-12.3< 2.3.1-r1
- py3.11-torchvision-cuda-12.3< 0.18.1-r7
- py3.11-wheels-torch-cuda-11.8< 2.3.1-r7
- py3.11-wheels-torch-cuda-12.3< 2.3.1-r10
- py3.11-wheels-torchaudio-cuda-12.3< 2.3.1-r1
- py3.11-wheels-torchvision-cuda-12.3< 0.18.1-r7
- py3.12-ambassador< 3.10.0-r6
- py3.12-pipenv< 2025.0.3-r0
- py3.12-pipenv-bin< 2025.0.3-r0
- py3.12-pytorch-cuda-11.8< 2.3.1-r4
- py3.12-pytorch-cuda-12.3< 2.3.1-r4
- py3.12-torchvision-cuda-12.3< 0.18.1-r2
- py3.12-wheels-torch-cuda-11.8< 2.3.1-r4
- py3.12-wheels-torch-cuda-12.3< 2.3.1-r4
- py3.12-wheels-torchvision-cuda-12.3< 0.18.1-r2
- py3.13-ambassador< 3.10.0-r6
- py3.13-pipenv< 2025.0.3-r0
- py3.13-pipenv-bin< 2025.0.3-r0
- py3.9-pip< 25.1.1-r0
- py3.9-pytorch-cuda-11.8< 2.3.1-r3
- py3.9-pytorch-cuda-12.3< 2.3.1-r4
- py3.9-torchvision-cuda-11.8< 0.18.1-r3
- py3.9-torchvision-cuda-12.3< 0.18.1-r1
- py3.9-wheels-torch-cuda-11.8< 2.3.1-r3
- py3.9-wheels-torch-cuda-12.3< 2.3.1-r4
- py3.9-wheels-torchvision-cuda-11.8< 0.18.1-r3
- py3.9-wheels-torchvision-cuda-12.3< 0.18.1-r1
- pypy-3.10< 7.3.19-r10
- pypy-3.10-compat< 7.3.19-r10
- pypy-3.11< 7.3.19-r37
- pypy-3.11-compat< 7.3.19-r37
- reflex< 0.8.0-r0
- spamcheck< 3.5.3-r3
- spamcheck-compat< 3.5.3-r3
- superset< 4.1.2-r6
- superset-entrypoint< 4.1.2-r6
- superset-iamguarded-compat< 4.1.2-r6
- tensorflow-cpu-jupyter< 2.20.0-r4
- tensorflow-gpu-jupyter< 2.20.0-r3
- text-generation-inference< 3.3.6-r3
- text-generation-inference-compat< 3.3.6-r3
Wolfi73 products
- airflow-3< 3.0.2-r2
- airflow-3-bitnami-compat< 3.0.2-r2
- airflow-3-compat< 3.0.2-r2
- airflow-3-iamguarded-compat< 3.0.2-r2
- az< 2.74.0-r3
- az-iamguarded-compat< 2.74.0-r3
- confluent-docker-utils< 0.0.162-r1
- dask-gateway< 2025.4.0-r1
- dask-gateway-server< 2025.4.0-r1
- dask-kubernetes< 2025.4.3-r4
- datadog-agent< 7.71.2-r3
- datadog-agent-core-integrations< 7.72.2-r0
- emissary< 3.10.0-r6
- emissary-apiext< 3.10.0-r6
- emissary-oci-entrypoint< 3.10.0-r6
- ggshield< 1.43.0-r0
- grafana-oncall< 1.16.3-r0
- grafana-oncall-compat< 1.16.3-r0
- jupyter-base-notebook< 7.4.3-r2
- jwt-tool< 2.3.0-r2
- k8s-sidecar< 1.30.5-r0
- katib-earlystopping< 0.19.0-r3
- kserve< 0.16.0-r6
- kserve-agent< 0.16.0-r6
- kserve-agent-compat< 0.16.0-r6
- kserve-manager< 0.16.0-r6
- kserve-manager-compat< 0.16.0-r6
- kserve-qpext< 0.16.0-r6
- kserve-qpext-compat< 0.16.0-r6
- kserve-router< 0.16.0-r6
- kserve-router-compat< 0.16.0-r6
- kserve-storage-controller< 0.16.0-r6
- kubeflow-jupyter-web-app< 1.10.0-r5
- kubeflow-pipelines< 2.5.0-r4
- kubeflow-pipelines-apiserver< 2.5.0-r4
- kubeflow-pipelines-cache_server< 2.5.0-r4
- kubeflow-pipelines-cache-deployer< 2.5.0-r4
- kubeflow-pipelines-cache-deployer-compat< 2.5.0-r4
- kubeflow-pipelines-frontend< 2.5.0-r4
- kubeflow-pipelines-metadata-envoy-config< 2.5.0-r4
- kubeflow-pipelines-metadata-writer< 2.5.0-r4
- kubeflow-pipelines-metadata-writer-compat< 2.5.0-r4
- kubeflow-pipelines-persistence_agent< 2.5.0-r4
- kubeflow-pipelines-scheduledworkflow< 2.5.0-r4
- kubeflow-pipelines-viewer-crd-controller< 2.5.0-r4
- mlflow< 3.1.0-r3
- mlflow-bitnami< 3.1.0-r3
- mlflow-iamguarded-compat< 3.1.0-r3
- py3-cassandra-medusa< 0.26.0-r0
- py3-pipenv< 2025.0.3-r0
- py3-supported-pipenv< 2025.0.3-r0
- py3.10-ambassador< 3.10.0-r6
- py3.10-pip-base< 25.3-r1
- py3.10-pipenv< 2025.0.3-r0
- py3.10-pipenv-bin< 2025.0.3-r0
- py3.11-ambassador< 3.10.0-r6
- py3.11-pipenv< 2025.0.3-r0
- py3.11-pipenv-bin< 2025.0.3-r0
- py3.12-ambassador< 3.10.0-r6
- py3.12-pipenv< 2025.0.3-r0
- py3.12-pipenv-bin< 2025.0.3-r0
- py3.13-ambassador< 3.10.0-r6
- py3.13-pipenv< 2025.0.3-r0
- py3.13-pipenv-bin< 2025.0.3-r0
- pypy-3.10< 7.3.19-r10
- pypy-3.10-compat< 7.3.19-r10
- pypy-3.11< 7.3.19-r37
- pypy-3.11-compat< 7.3.19-r37
- reflex< 0.8.0-r0
- superset< 4.1.2-r6
- superset-entrypoint< 4.1.2-r6
- superset-iamguarded-compat< 4.1.2-r6
- tensorflow-cpu-jupyter< 2.20.0-r4
2 vendors · 200 products
References
0 linksNo references have been published for this record.
Related vulnerabilities
RoutineCVE-2026-102274jpadilla · pyjwt +95 morePyJWT: Malformed RSA JWK aborts parsing of an entire JWK SetPyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.CVSS7.5HighEPSS0.55%PrioritiseCVE-2026-102271jpadilla · pyjwt +95 morePyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guardPyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.CVSS7.4HighEPSS0.21%RoutineCVE-2026-102269jpadilla · pyjwt +95 morePyJWT: Non-canonical signature segments enable raw-token revocation bypassPyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS signature segment. As a result, base64url_decode produces the same signature bytes for different serialized segments. Consequently, raw-token revocation checks can fail to recognize an equivalent modified token. This issue is fixed in version 2.14.0.CVSS5.4MediumEPSS0.22%PrioritiseCVE-2026-102268jpadilla · pyjwt +95 morePyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guardPyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.CVSS9.1CriticalEPSS0.24%PrioritiseCVE-2026-102267jpadilla · pyjwt +95 morePyJWT: PyJWKClient follows redirects when fetching JWKSPyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.CVSS9.1CriticalEPSS0.16%RoutineCVE-2026-101917jpadilla · pyjwt +95 morePyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.CVSS7.5HighEPSS0.43%