← All credits

Michael Lip (theluckystrike)

2 vulnerability records and advisories credit this contributor.

CVE-2026-111421
Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow.* classes on the API server
CVE-2026-45426
Apache Airflow: Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access