Claude Security Scans

Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation

Apache Airflow: Logout token revocation fails open; errors silently swallowed

Apache Airflow: DeadlineAlert fields bypass plugin-registration gate for scheduler-side deserialization

Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default

Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default

Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs

Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names

Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain

Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration