Jarek Potiuk

Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server

Apache Airflow: Airflow Variables were not masked in the UI for authenticated users

Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id}

Apache Airflow: No certificate validation on SMTP STARTTLS connections

Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options

Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target

Apache Airflow: Arbitrary import in custom deadline-reference deserialization

Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking

Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator

Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets