Apache Airflow 1.5 lifecycle

At a glance

Version line

1.5

Initial release

4 Sept 2015

Lifecycle phase

end of life

Latest stable

1.5.2

Latest release date

23 Oct 2015

EOL

13 Nov 2015

Risk

high

Releases tracked

3

1. Release

   4 Sept 2015

2. standard support

   4 Sept 2015 → 13 Nov 2015

   Source: Apache Airflow GitHub Releases

3. end of lifecurrent

   13 Nov 2015 → —

   Source: Apache Airflow GitHub Releases

Apache Airflow 1.5 reached end of life on 13 Nov 2015. Security and bug fixes are no longer provided by the project according to published lifecycle data.

• CVE-2020-13927Known exploited

  Apache Airflow's Experimental API Authentication Bypass

  CISA KEV:

  listed · added 2022-01-18 · due 2022-07-18

  Required action:

  Apply updates per vendor instructions.

  CVSS:

  9.8 (critical) · NVD

  CWE:

  CWE-1056, CWE-1188, CWE-306

  Affected:

  <1.10.11

  Fixed in:

  1.10.11

  Source:

  CISA KEV · Advisory

• CVE-2020-11978Known exploited

  Apache Airflow Command Injection

  CISA KEV:

  listed · added 2022-01-18 · due 2022-07-18

  Required action:

  Apply updates per vendor instructions.

  CVSS:

  8.8 (high) · NVD

  CWE:

  CWE-78

  Affected:

  <1.10.11

  Fixed in:

  1.10.11

  Source:

  CISA KEV · Advisory

Known vulnerabilities

15

Known exploited

2

Highest CVSS

9.8

• CVE-2020-13927Known exploited

  Apache Airflow's Experimental API Authentication Bypass

  CISA KEV:

  listed · added 2022-01-18 · due 2022-07-18

  Required action:

  Apply updates per vendor instructions.

  CVSS:

  9.8 (critical) · NVD

  CWE:

  CWE-1056, CWE-1188, CWE-306

  Affected:

  <1.10.11

  Fixed in:

  1.10.11

  Source:

  CISA KEV · Advisory

• CVE-2020-11978Known exploited

  Apache Airflow Command Injection

  CISA KEV:

  listed · added 2022-01-18 · due 2022-07-18

  Required action:

  Apply updates per vendor instructions.

  CVSS:

  8.8 (high) · NVD

  CWE:

  CWE-78

  Affected:

  <1.10.11

  Fixed in:

  1.10.11

  Source:

  CISA KEV · Advisory

• CVE-2026-59244

  Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-59242

  Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-54183

  Apache Airflow: Airflow Variables were not masked in the UI for authenticated users

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-68968

  Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-68969

  Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-68970

  Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-68971

  Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-68076

  Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-68868

  Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables

  Affected:

  <22.3.0

  Fixed in:

  22.3.0

  Source:

  OSV source · Advisory

• CVE-2026-68872

  Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable

  Affected:

  <9.34.0

  Fixed in:

  9.34.0

  Source:

  OSV source · Advisory

• CVE-2026-68871

  Apache Airflow Yandex provider: yandex Lockbox backend: team-scope guard bypass resolves another team's Connection or Variable

  Affected:

  <4.5.1

  Fixed in:

  4.5.1

  Source:

  OSV source · Advisory

• CVE-2026-68870

  Apache Airflow Microsoft Azure provider: microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's Connection or Variable

  Affected:

  <14.1.0

  Fixed in:

  14.1.0

  Source:

  OSV source · Advisory

• CVE-2026-59243

  Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)

  Affected:

  <3.7.3

  Fixed in:

  3.7.3

  Source:

  OSV source · Advisory

Total releases

3

Last 30 days

0

Last 90 days

0

Avg. interval

~24 days

Most recent

23 Oct 2015

Releases tracked

3

Lifecycle periods

2

EOL

Known

Provenance records

3

Data last checked

2 Sept 2026

Latest source update

2 Sept 2026

• Previous

  Apache Airflow 1.4

  end of life · EOL 4 Sept 2015

• Next

  Apache Airflow 1.6

  end of life · EOL 28 Mar 2016

• Newest supported

  Apache Airflow 3.3

  standard support