Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Airflow packages could let attackers run code

published 1 month ago
Summary

Versions of Airflow 2 and Airflow 3 listed in the update may allow an attacker to execute unauthorized code. This risk is fixed in newer releases. Upgrade the affected Airflow packages to the latest versions as soon as possible.

What to do
  • Update cleanstart airflow-2 to version 2.10.3-r2.
  • Update cleanstart airflow-3 to version 3.1.8-r0.
  • Update cleanstart airflow-3 to version 3.2.0-r0.
  • Update airflow-2 to version 2.10.3-r2.
  • Update airflow-3 to version 3.1.8-r0.
  • Update airflow-3 to version 3.2.0-r0.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart airflow-2 < 2.10.3-r2
Fix: upgrade to 2.10.3-r2
CleanStart cleanstart airflow-3 < 3.1.8-r0
< 3.2.0-r0
Fix: upgrade to 3.1.8-r0
CleanStart – airflow-2 < 2.10.3-r2
Fix: upgrade to 2.10.3-r2
CleanStart – airflow-3 < 3.1.8-r0
< 3.2.0-r0
Fix: upgrade to 3.1.8-r0
Original advisory text
Security fix for GHSA-3wq7-rqq7-wx6j applied in: airflow-2 2.10.3-r2, airflow-3 3.1.8-r0, airflow-3 3.2.0-r0
GHSA-3wq7-rqq7-wx6j affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
References
Severity
7.8 High
Timeline
Published18 Sep 2026
Updated15 Oct 2026
First seen18 Sep 2026
Sources
CLEANSTART-2026-FL05460 · OSV
Track software like this
Free during beta