CGA-XJWQ-GMV4-JM7W: airflow-3
CVSS: UnknownUnknown
Published Date unknownLast modified Date unknown
Status not reported
The data service did not report a status for this record. Only the available sections are shown.Vulnerability summary
CGA-XJWQ-GMV4-JM7W is a vulnerability in airflow-3 with no CVSS score yet.
CVSS score
Not scored
010
No CVSS score recordedEPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
No timeline events recorded.
Description
No description has been published for this record.
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Chainguard124 products
- airflow-2< 2.11.2-r5
- airflow-3< 3.1.8-r10
- airflow-core-2< 2.11.2-r3
- airflow-core-3< 3.1.8-r3
- ansible-operator< 1.42.2-r2
- ansible-operator-fips< 1.42.2-r2
- apache-beam-python-3.11-sdk< 2.71.0-r8
- apache-beam-python-3.12-sdk< 2.71.0-r2
- apache-beam-python-3.13-sdk< 2.71.0-r2
- awx< 24.6.1-r33
- az< 2.84.0-r4
- azure-functions-host-python3.11-worker< 4.1048.200-r1
- azure-functions-host-python3.12-worker< 4.1048.200-r1
- azure-functions-host-python3.13-worker< 4.1048.200-r1
- barman-cloudnative-pg< 3.18.0-r1
- checkov< 3.2.511-r0
- confluent-docker-utils< 0.0.169-r1
- dask-kubernetes< 2026.3.0-r2
- datadog-agent-7.71< 7.71.2-r17
- datadog-agent-7.71-core-integrations< 7.71.2-r17
- datadog-agent-7.72< 7.72.4-r22
- datadog-agent-7.73< 7.73.3-r13
- datadog-agent-7.74< 7.74.1-r11
- datadog-agent-7.74-core-integrations< 7.74.1-r11
- datadog-agent-7.75< 7.75.4-r7
- datadog-agent-7.76< 7.76.3-r15
- datadog-agent-7.76-core-integrations< 7.76.3-r15
- datadog-agent-7.77< 7.77.3-r6
- datadog-agent-7.77-core-integrations< 7.77.3-r6
- datadog-agent-fips-7.71< 7.71.2-r10
- datadog-agent-fips-7.71-core-integrations< 7.71.2-r10
- datadog-agent-fips-7.72< 7.72.4-r15
- datadog-agent-fips-7.73< 7.73.3-r7
- datadog-agent-fips-7.73-core-integrations< 7.73.3-r7
- datadog-agent-fips-7.74< 7.74.1-r7
- datadog-agent-fips-7.74-core-integrations< 7.74.1-r7
- datadog-agent-fips-7.75< 7.75.4-r5
- datadog-agent-fips-7.76< 7.76.3-r6
- datadog-agent-fips-7.76-core-integrations< 7.76.3-r6
- datadog-agent-fips-7.77< 7.77.3-r7
- datadog-agent-fips-7.77-core-integrations< 7.77.3-r7
- datahub-ingestion< 1.5.0.1-r0
- datahub-ingestion-fips< 1.5.0.1-r0
- dbt-bigquery< 1.10.3-r1
- dbt-core< 1.11.8-r0
- dbt-snowflake< 1.10.4-r2
- ggshield< 1.51.0-r3
- gitlab-toolbox-ce-18.9< 18.9.3-r1
- gitlab-toolbox-ce-fips-18.9< 18.9.3-r1
- graalvm-25-graalpy-venv< 25.0.2-r10
- jupyter-base-notebook< 7.5.5-r1
- jwt-tool< 2.3.0-r5
- k8s-sidecar< 2.5.1-r3
- katib-earlystopping< 0.19.0-r13
- katib-suggestion-hyperband< 0.19.0-r14
- katib-suggestion-hyperopt< 0.19.0-r14
- katib-suggestion-nas-darts< 0.19.0-r14
- katib-suggestion-optuna-enas< 0.19.0-r14
- katib-suggestion-pbt-enas< 0.19.0-r13
- katib-suggestion-skopt-enas< 0.19.0-r13
- keep-api< 0.51.0-r2
- keep-api-fips< 0.51.0-r2
- kserve-storage-controller< 0.16.0-r24
- kubeflow-jupyter-web-app< 1.10.0-r13
- kubeflow-pipelines-apiserver< 2.16.0-r12
- kubeflow-volumes-web-app< 1.10.0-r12
- label-studio< 1.23.0-r1
- litellm< 1.82.3.0-r2
- localstack< 4.14.0-r6
- metaflow-service< 2.5.0-r7
- metaflow-service-fips< 2.5.0-r1
- mlflow< 3.10.1-r1
- mlflow-iamguarded-compat< 3.10.1-r1
- nemo< 2.7.3-r2
- nvidia-nsight-compute-13.1< 2025.4.1.2-r2
- nvidia-nsight-compute-13.2< 2026.1.1.2-r2
- nvidia-nsight-compute-13.3< 2026.2.1.5-r1
- opal< 0.9.4-r0
- open-webui< 0.9.2-r0
- openstack-kolla-toolbox-2025.1< 20.4.0-r11
- openstack-kolla-toolbox-2025.1-fips< 20.4.0-r9
- openstack-kolla-toolbox-2025.2< 21.1.0-r8
- openstack-kolla-toolbox-2025.2-fips< 21.1.0-r7
- openstack-kolla-toolbox-2026.1< 22.0.0-r5
- openstack-kolla-toolbox-2026.1-fips< 22.0.0-r5
- opentelemetry-python-instrumentation< 0.60.1-r3
- pgadmin4< 9.13-r3
- pgadmin4-fips< 9.13-r2
- py3-cassandra-medusa< 0.28.0-r1
- py3-hashin< 1.0.5-r5
- py3.10-ambassador< 3.10.0-r26
- py3.10-pip-base< 26.1.1-r0
- py3.10-pipenv< 2026.6.0-r0
- py3.11-ambassador< 3.10.0-r26
- py3.11-pip-base< 26.1.1-r0
- py3.11-pipenv< 2026.6.0-r0
- py3.11-prefect< 3.6.23-r0
- py3.11-prefect-fips< 3.6.23-r0
- py3.12-ambassador< 3.10.0-r26
- py3.12-pip-base< 26.1.1-r0
- py3.12-pipenv< 2026.6.0-r0
- py3.12-prefect< 3.6.23-r0
- py3.12-prefect-fips< 3.6.23-r0
- py3.13-ambassador< 3.10.0-r26
- py3.13-pip-base< 26.1.1-r0
- py3.13-pipenv< 2026.6.0-r0
- py3.13-prefect< 3.6.23-r0
- py3.13-prefect-fips< 3.6.23-r0
- py3.14-pip-base< 26.1.1-r0
- py3.14-prefect< 3.6.23-r0
- pypy-3.10< 7.3.19-r16
- pypy-3.11< 7.3.22-r0
- request-1276< 0.27.1-r1
- semgrep< 1.157.0-r1
- spamcheck< 3.5.3-r8
- superset-5.0< 5.0.0-r22
- superset-6.0< 6.0.0-r7
- synapse< 1.151.0-r0
- tensorflow-cpu-jupyter< 2.21.0-r2
- tensorflow-gpu-jupyter< 2.21.0-r2
- text-generation-inference< 3.3.7-r9
- tritonserver-backend-vllm-cuda-12.9< 25.9.0_git20260318-r0
- vllm-openai-cuda-12.9< 0.17.1-r1
- wazuh-manager-framework< 4.14.4-r1
Wolfi50 products
- airflow-3< 3.1.8-r10
- az< 2.84.0-r4
- checkov< 3.2.511-r0
- confluent-docker-utils< 0.0.169-r1
- dask-kubernetes< 2026.3.0-r2
- datadog-agent-7.72< 7.72.4-r22
- datadog-agent-7.73< 7.73.3-r13
- datadog-agent-7.74< 7.74.1-r11
- datadog-agent-7.74-core-integrations< 7.74.1-r11
- datadog-agent-7.75< 7.75.4-r7
- datadog-agent-7.76< 7.76.3-r15
- datadog-agent-7.76-core-integrations< 7.76.3-r15
- datadog-agent-7.77< 7.77.3-r6
- datadog-agent-7.77-core-integrations< 7.77.3-r6
- ggshield< 1.51.0-r3
- jupyter-base-notebook< 7.5.5-r1
- jwt-tool< 2.3.0-r5
- k8s-sidecar< 2.5.1-r3
- katib-earlystopping< 0.19.0-r13
- katib-suggestion-hyperband< 0.19.0-r14
- katib-suggestion-hyperopt< 0.19.0-r14
- katib-suggestion-nas-darts< 0.19.0-r14
- katib-suggestion-optuna-enas< 0.19.0-r14
- katib-suggestion-pbt-enas< 0.19.0-r13
- katib-suggestion-skopt-enas< 0.19.0-r13
- kserve-storage-controller< 0.16.0-r24
- kubeflow-jupyter-web-app< 1.10.0-r13
- kubeflow-pipelines-apiserver< 2.16.0-r12
- kubeflow-volumes-web-app< 1.10.0-r12
- mlflow< 3.10.1-r1
- mlflow-iamguarded-compat< 3.10.1-r1
- open-webui< 0.9.2-r0
- py3-cassandra-medusa< 0.28.0-r1
- py3.10-ambassador< 3.10.0-r26
- py3.10-pip-base< 26.1.1-r0
- py3.10-pipenv< 2026.6.0-r0
- py3.11-ambassador< 3.10.0-r26
- py3.11-pip-base< 26.1.1-r0
- py3.11-pipenv< 2026.6.0-r0
- py3.12-ambassador< 3.10.0-r26
- py3.12-pip-base< 26.1.1-r0
- py3.12-pipenv< 2026.6.0-r0
- py3.13-ambassador< 3.10.0-r26
- py3.13-pip-base< 26.1.1-r0
- py3.13-pipenv< 2026.6.0-r0
- py3.14-pip-base< 26.1.1-r0
- pypy-3.10< 7.3.19-r16
- pypy-3.11< 7.3.22-r0
- semgrep< 1.157.0-r1
- superset-6.0< 6.0.0-r7
2 vendors · 174 products
References
0 linksNo references have been published for this record.
Related vulnerabilities
CVE-2015-7764chainguardairflow-2+21.51%Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.CVE-2025-54121chainguardairflow-3+490.61%Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python. In versions 0.47.1 and below, when parsing a multi-part form with large files (greater than the default max spool size) starlette will block the main thread to roll the file over to disk. This blocks the event thread which means the application can't accept new connections. The UploadFile code has a minor bug where instead of just checking for self._in_memory, the logic should also check if the additional bytes will cause a rollover. The vulnerability is fixed in version 0.47.2.CVE-2025-65995apache software foundationapache airflow+40.89%When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG.
The issue has been fixed in Airflow 3.1.4 and 2.11.1, and users are strongly advised to upgrade to prevent potential disclosure of sensitive information.CVE-2025-62611aio-libsaiomysql+150.39%aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server. It is possible to create a rogue MySQL server that emulates authorization, ignores client flags and requests arbitrary files from the client by sending a LOAD_LOCAL instruction packet. This issue has been patched in version 0.3.0.CVE-2025-68675apache software foundationapache airflow+71.88%In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result, when such connections are rendered or printed to logs, proxy credentials embedded in these fields could be exposed.
Users are recommended to upgrade to 3.1.6 or later for Airflow 3, and 2.11.1 or later for Airflow 2 which fixes this issueCVE-2025-68146chainguardairflow-2+630.20%filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check-Time-of-Use (TOCTOU) race condition allows local attackers to corrupt or truncate arbitrary user files through symlink attacks. The vulnerability exists in both Unix and Windows lock file creation where filelock checks if a file exists before opening it with O_TRUNC. An attacker can create a symlink pointing to a victim file in the time gap between the check and open, causing os.open() to follow the symlink and truncate the target file. All users of filelock on Unix, Linux, macOS, and Windows systems are impacted. The vulnerability cascades to dependent libraries. The attack requires local filesystem access and ability to create symlinks (standard user permissions on Unix; Developer Mode on Windows 10+). Exploitation succeeds within 1-3 attempts when lock file paths are predictable. The issue is fixed in version 3.20.1. If immediate upgrade is not possible, use SoftFileLock instead of UnixFileLock/WindowsFileLock (note: different locking semantics, may not be suitable for all use cases); ensure lock file directories have restrictive permissions (chmod 0700) to prevent untrusted users from creating symlinks; and/or monitor lock file directories for suspicious symlinks before running trusted applications. These workarounds provide only partial mitigation. The race condition remains exploitable. Upgrading to version 3.20.1 is strongly recommended.