Apache Airflow 1.10 lifecycle
Current status
Apache Airflow 1.10 is currently in standard support.
Security: 15 tracked advisories affecting this line · 2 in CISA KEV. Details below — lifecycle and vulnerability status are separate.
Official lifecycle source: Apache Airflow GitHub Releases
- Support phase
- standard support
- End of life
- Not officially published
- Latest release
- 1.10.15
- Released
- 17 Mar 2021
At a glance
- Version line
- 1.10
- Initial release
- 17 Jul 2019
- Lifecycle phase
- standard support
- Latest stable
- 1.10.15
- Latest release date
- 17 Mar 2021
- EOL
- Not officially published
- Risk
- low
- Releases tracked
- 11
Lifecycle timeline
Phases from published LifecyclePeriod records. Missing phases are not inferred.
Release
17 Jul 2019
standard supportcurrent
17 Jul 2019 → —
Source: Apache Airflow GitHub Releases
Apache Airflow 1.10 is currently in standard support.
Upgrade options
Newer supported Apache Airflow version lines from CompatHub lifecycle data. Compatibility and security context use existing evidence only.
You are on Apache Airflow 1.10
Supported
Supported upgrade options
- Apache Airflow 3.3Upgrade planner →Supported· 2 major versions newer
- Apache Airflow 2.11Upgrade planner →Supported· 1 major version newer
Known exploited vulnerabilities
CVE entries that CISA lists in the Known Exploited Vulnerabilities catalogue, including due dates and ransomware use when published. CVSS shown when NVD enrichment is available.
- CVE-2020-13927Known exploited
Apache Airflow's Experimental API Authentication Bypass
- CISA KEV:
- listed · added 2022-01-18 · due 2022-07-18
- Required action:
- Apply updates per vendor instructions.
- CVSS:
- 9.8 (critical) · NVD
- CWE:
- CWE-1056, CWE-1188, CWE-306
- Affected:
- <1.10.11
- Fixed in:
- 1.10.11
- CVE-2020-11978Known exploited
Apache Airflow Command Injection
- CISA KEV:
- listed · added 2022-01-18 · due 2022-07-18
- Required action:
- Apply updates per vendor instructions.
- CVSS:
- 8.8 (high) · NVD
- CWE:
- CWE-78
- Affected:
- <1.10.11
- Fixed in:
- 1.10.11
Security
Advisories affecting Apache Airflow 1.10 (OSV.dev evidence). Known exploited status, due dates, and ransomware use from CISA KEV when matched.
- Known vulnerabilities
- 15
- Known exploited
- 2
- Highest CVSS
- 9.8
- CVE-2020-13927Known exploited
Apache Airflow's Experimental API Authentication Bypass
- CISA KEV:
- listed · added 2022-01-18 · due 2022-07-18
- Required action:
- Apply updates per vendor instructions.
- CVSS:
- 9.8 (critical) · NVD
- CWE:
- CWE-1056, CWE-1188, CWE-306
- Affected:
- <1.10.11
- Fixed in:
- 1.10.11
- CVE-2020-11978Known exploited
Apache Airflow Command Injection
- CISA KEV:
- listed · added 2022-01-18 · due 2022-07-18
- Required action:
- Apply updates per vendor instructions.
- CVSS:
- 8.8 (high) · NVD
- CWE:
- CWE-78
- Affected:
- <1.10.11
- Fixed in:
- 1.10.11
- CVE-2026-59244
Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI
- Affected:
- <3.3.1
- Fixed in:
- 3.3.1
- Source:
- OSV source · Advisory
- CVE-2026-59242
Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint
- Affected:
- <3.3.1
- Fixed in:
- 3.3.1
- Source:
- OSV source · Advisory
- CVE-2026-54183
Apache Airflow: Airflow Variables were not masked in the UI for authenticated users
- Affected:
- <3.3.1
- Fixed in:
- 3.3.1
- Source:
- OSV source · Advisory
- CVE-2026-68968
Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id
- Affected:
- <3.3.1
- Fixed in:
- 3.3.1
- Source:
- OSV source · Advisory
- CVE-2026-68969
Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext
- Affected:
- <3.3.1
- Fixed in:
- 3.3.1
- Source:
- OSV source · Advisory
- CVE-2026-68970
Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI
- Affected:
- <3.3.1
- Fixed in:
- 3.3.1
- Source:
- OSV source · Advisory
- CVE-2026-68971
Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints
- Affected:
- <3.3.1
- Fixed in:
- 3.3.1
- Source:
- OSV source · Advisory
- CVE-2026-68076
Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection
- Affected:
- <3.3.1
- Fixed in:
- 3.3.1
- Source:
- OSV source · Advisory
- CVE-2026-68868
Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables
- Affected:
- <22.3.0
- Fixed in:
- 22.3.0
- Source:
- OSV source · Advisory
- CVE-2026-68872
Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable
- Affected:
- <9.34.0
- Fixed in:
- 9.34.0
- Source:
- OSV source · Advisory
- CVE-2026-68871
Apache Airflow Yandex provider: yandex Lockbox backend: team-scope guard bypass resolves another team's Connection or Variable
- Affected:
- <4.5.1
- Fixed in:
- 4.5.1
- Source:
- OSV source · Advisory
- CVE-2026-68870
Apache Airflow Microsoft Azure provider: microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's Connection or Variable
- Affected:
- <14.1.0
- Fixed in:
- 14.1.0
- Source:
- OSV source · Advisory
- CVE-2026-59243
Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)
- Affected:
- <3.7.3
- Fixed in:
- 3.7.3
- Source:
- OSV source · Advisory
Latest release
Previous releases
1.10.14
10 Dec 2020
1.10.13
25 Nov 2020
1.10.12
25 Aug 2020
Release history
11 concrete releases tracked for this line.
| Version | Release date | Channel | Source |
|---|---|---|---|
| 1.10.15 | 17 Mar 2021 | stable | Source |
| 1.10.14 | 10 Dec 2020 | stable | Source |
| 1.10.13 | 25 Nov 2020 | stable | Source |
| 1.10.12 | 25 Aug 2020 | stable | Source |
| 1.10.11 | 10 Jul 2020 | stable | Source |
| 1.10.10 | 9 Apr 2020 | stable | Source |
| 1.10.9 | 19 Feb 2020 | stable | Source |
| 1.10.8 | 7 Feb 2020 | stable | Source |
| 1.10.7 | 24 Dec 2019 | stable | Source |
| 1.10.5 | 4 Sept 2019 | stable | Source |
| 1.10.3 | 17 Jul 2019 | stable | Source |
Release activity
- Total releases
- 11
- Last 30 days
- 0
- Last 90 days
- 0
- Avg. interval
- ~61 days
- Most recent
- 17 Mar 2021
Should I use this version?
Suitable for new deployments
Apache Airflow 1.10 is currently supported (standard support).
Version comparison
Compact comparison against the nearest relevant release lines.
Compatibility
Evidence-backed compatibility results involving Apache Airflow 1.10. Only combinations CompatHub can evaluate from upstream sources are listed.
Compatible targets
Sources
Where this information comes from.
Lifecycle sources
- Apache Airflow GitHub Releasesfirst party · high confidence
Official source: https://github.com/apache/airflow/releases
Last verified 2 Sept 2026
- Apache Airflow Installation Prerequisitesfirst party
Official source: https://airflow.apache.org/docs/apache-airflow/stable/installation/prerequisites.html
Verification time not recorded
- OSV.devfirst party
Official source: https://osv.dev
Verification time not recorded
- NVD (NIST)first party
Official source: https://nvd.nist.gov
Verification time not recorded
- CISA Known Exploited Vulnerabilitiesfirst party
Official source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Verification time not recorded
Release sources
- Apache Airflow GitHub Releasesfirst party · high confidence
Official source: https://github.com/apache/airflow/releases
Last verified 2 Sept 2026
- Apache Airflow Release Processfirst party
Official source: https://airflow.apache.org/docs/apache-airflow/stable/release-process.html
Verification time not recorded
Data coverage
Last checked = last successful upstream check. Latest source update = when upstream content last changed.
- Releases tracked
- 11
- Lifecycle periods
- 1
- EOL
- Not officially published
- Provenance records
- 2
- Data last checked
- 2 Sept 2026
- Latest source update
- 2 Sept 2026
EOL: Not officially published