Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

cleanstart/airflow-3 can be tricked by forged tokens

published 26 days ago
Summary

The PyJWT component used in cleanstart/airflow-3 can be fooled into accepting fake authentication tokens, which could let an attacker act as an authorized user. This may lead to unauthorized access to your system. Update the PyJWT library to the latest version or apply the vendor’s recommended fix as soon as possible.

What to do
  • Update cleanstart airflow-3 to version 3.1.8-r13.
  • Update cleanstart airflow-3 to version 3.2.1-r11.
  • Update cleanstart airflow-3 to version 3.0.6-r9.
  • Update cleanstart airflow-3 to version 3.2.2-r8.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart airflow-3 < 3.1.8-r13
< 3.2.1-r11
< 3.0.6-r9
< 3.2.2-r8
Fix: upgrade to 3.1.8-r13
Original advisory text
PyJWT is a Python implementation of JSON Web Token standards
CVE-2026-101917 affects multiple packages. PyJWT is a Python implementation of JSON Web Token standards. See references for individual vulnerability details.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Timeline
Published10 Oct 2026
Updated10 Oct 2026
First seen10 Oct 2026
Sources
CLEANSTART-2026-UK80240 · OSV
Track software like this
Free during beta