Jarek Potiuk

Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcement

Apache Airflow: Logout token revocation fails open; errors silently swallowed

Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline callbacks

Apache Airflow: DeadlineAlert fields bypass plugin-registration gate for scheduler-side deserialization

Apache Airflow: Scheduler: next_kwargs deserialized before the dict check, so resume data still invokes constructors

Apache Airflow: Shell command injection in the example_dag_decorator example Dag via an IPv6 zone identifier

Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit

Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter