Apache Airflow 2.11 lifecycle

At a glance

Version line

2.11

Initial release

20 May 2025

Lifecycle phase

standard support

Latest stable

2.11.0

Latest release date

20 May 2025

EOL

Not officially published

Risk

low

Releases tracked

1

1. Release

   20 May 2025

2. standard supportcurrent

   20 May 2025 → —

   Source: Apache Airflow GitHub Releases

Apache Airflow 2.11 is currently in standard support.

Known vulnerabilities

15

Known exploited

0

Highest CVSS

—

• CVE-2026-59244

  Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-59242

  Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-54183

  Apache Airflow: Airflow Variables were not masked in the UI for authenticated users

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-68968

  Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-68969

  Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-68970

  Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-68971

  Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-68076

  Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-68868

  Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables

  Affected:

  <22.3.0

  Fixed in:

  22.3.0

  Source:

  OSV source · Advisory

• CVE-2026-68872

  Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable

  Affected:

  <9.34.0

  Fixed in:

  9.34.0

  Source:

  OSV source · Advisory

• CVE-2026-68871

  Apache Airflow Yandex provider: yandex Lockbox backend: team-scope guard bypass resolves another team's Connection or Variable

  Affected:

  <4.5.1

  Fixed in:

  4.5.1

  Source:

  OSV source · Advisory

• CVE-2026-68870

  Apache Airflow Microsoft Azure provider: microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's Connection or Variable

  Affected:

  <14.1.0

  Fixed in:

  14.1.0

  Source:

  OSV source · Advisory

• CVE-2026-59243

  Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)

  Affected:

  <3.7.3

  Fixed in:

  3.7.3

  Source:

  OSV source · Advisory

• CVE-2026-59245

  Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision)

  Affected:

  <3.7.2

  Fixed in:

  3.7.2

  Source:

  OSV source · Advisory

• CVE-2026-33264

  Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()

  Affected:

  <3.3.0

  Fixed in:

  3.3.0

  Source:

  OSV source · Advisory

Total releases

1

Last 30 days

0

Last 90 days

0

Most recent

20 May 2025

Releases tracked

1

Lifecycle periods

1

EOL

Not officially published

Provenance records

2

Data last checked

2 Sept 2026

Latest source update

2 Sept 2026

EOL: Not officially published

• Previous

  Apache Airflow 2.10

  end of life · EOL 20 May 2025

• Next

  Apache Airflow 3.0

  end of life · EOL 25 Sept 2025

• Newest supported

  Apache Airflow 3.3

  standard support