Apache Airflow 3.0 lifecycle

At a glance

Version line

3.0

Initial release

22 Apr 2025

Lifecycle phase

end of life

Latest stable

3.0.6

Latest release date

29 Aug 2025

EOL

25 Sept 2025

Risk

high

Releases tracked

7

1. Release

   22 Apr 2025

2. standard support

   22 Apr 2025 → 25 Sept 2025

   Source: Apache Airflow GitHub Releases

3. end of lifecurrent

   25 Sept 2025 → —

   Source: Apache Airflow GitHub Releases

Apache Airflow 3.0 reached end of life on 25 Sept 2025. Security and bug fixes are no longer provided by the project according to published lifecycle data.

Known vulnerabilities

15

Known exploited

0

Highest CVSS

—

• CVE-2026-59244

  Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-59242

  Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-54183

  Apache Airflow: Airflow Variables were not masked in the UI for authenticated users

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-68968

  Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-68969

  Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-68970

  Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-68971

  Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-68076

  Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-68868

  Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables

  Affected:

  <22.3.0

  Fixed in:

  22.3.0

  Source:

  OSV source · Advisory

• CVE-2026-68872

  Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable

  Affected:

  <9.34.0

  Fixed in:

  9.34.0

  Source:

  OSV source · Advisory

• CVE-2026-68871

  Apache Airflow Yandex provider: yandex Lockbox backend: team-scope guard bypass resolves another team's Connection or Variable

  Affected:

  <4.5.1

  Fixed in:

  4.5.1

  Source:

  OSV source · Advisory

• CVE-2026-68870

  Apache Airflow Microsoft Azure provider: microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's Connection or Variable

  Affected:

  <14.1.0

  Fixed in:

  14.1.0

  Source:

  OSV source · Advisory

• CVE-2026-59243

  Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)

  Affected:

  <3.7.3

  Fixed in:

  3.7.3

  Source:

  OSV source · Advisory

• CVE-2026-59245

  Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision)

  Affected:

  <3.7.2

  Fixed in:

  3.7.2

  Source:

  OSV source · Advisory

• CVE-2026-33264

  Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()

  Affected:

  <3.3.0

  Fixed in:

  3.3.0

  Source:

  OSV source · Advisory

Total releases

7

Last 30 days

0

Last 90 days

0

Avg. interval

~22 days

Most recent

29 Aug 2025

Releases tracked

7

Lifecycle periods

2

EOL

Known

Provenance records

3

Data last checked

2 Sept 2026

Latest source update

2 Sept 2026

• Previous

  Apache Airflow 2.11

  standard support

• Next

  Apache Airflow 3.1

  end of life · EOL 7 Apr 2026

• Newest supported

  Apache Airflow 3.3

  standard support