Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Airflow 2 and 3 releases contain a security weakness

published 1 month ago
Summary

Versions of Airflow 2 (2.10.3‑r3, 2.11.2‑r4) and Airflow 3 (3.1.8‑r4, 3.2.1‑r4) are affected by a security issue. The problem is fixed in newer releases, so updating to the latest version of each product eliminates the risk. Apply the vendor’s recommended update as soon as possible.

What to do
  • Update cleanstart airflow-2 to version 2.10.3-r3.
  • Update cleanstart airflow-2 to version 2.11.2-r4.
  • Update cleanstart airflow-3 to version 3.1.8-r4.
  • Update cleanstart airflow-3 to version 3.2.1-r4.
  • Update airflow-2 to version 2.10.3-r3.
  • Update airflow-2 to version 2.11.2-r4.
  • Update airflow-3 to version 3.1.8-r4.
  • Update airflow-3 to version 3.2.1-r4.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart airflow-2 < 2.10.3-r3
< 2.11.2-r4
Fix: upgrade to 2.10.3-r3
CleanStart cleanstart airflow-3 < 3.1.8-r4
< 3.2.1-r4
Fix: upgrade to 3.1.8-r4
CleanStart – airflow-2 < 2.10.3-r3
< 2.11.2-r4
Fix: upgrade to 2.10.3-r3
CleanStart – airflow-3 < 3.1.8-r4
< 3.2.1-r4
Fix: upgrade to 3.1.8-r4
Original advisory text
Security fix for GHSA-5rvq-cxj2-64vf applied in: airflow-2 2.10.3-r3, airflow-2 2.11.2-r4, airflow-3 3.1.8-r4, airflow-3 3.2.1-r4
GHSA-5rvq-cxj2-64vf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
References
Severity
7.5 High
Timeline
Published18 Sep 2026
Updated15 Oct 2026
First seen18 Sep 2026
Sources
CLEANSTART-2026-SR16406 · OSV
Track software like this
Free during beta