Apache Airflow 3.1 lifecycle

At a glance

Version line

3.1

Initial release

25 Sept 2025

Lifecycle phase

end of life

Latest stable

3.1.8

Latest release date

11 Mar 2026

EOL

7 Apr 2026

Risk

high

Releases tracked

8

1. Release

   25 Sept 2025

2. standard support

   25 Sept 2025 → 7 Apr 2026

   Source: Apache Airflow GitHub Releases

3. end of lifecurrent

   7 Apr 2026 → —

   Source: Apache Airflow GitHub Releases

Apache Airflow 3.1 reached end of life on 7 Apr 2026. Security and bug fixes are no longer provided by the project according to published lifecycle data.

Known vulnerabilities

15

Known exploited

0

Highest CVSS

—

• CVE-2026-59244

  Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-59242

  Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-54183

  Apache Airflow: Airflow Variables were not masked in the UI for authenticated users

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-68968

  Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-68969

  Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-68970

  Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-68971

  Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-68076

  Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection

  Affected:

  <3.3.1

  Fixed in:

  3.3.1

  Source:

  OSV source · Advisory

• CVE-2026-68868

  Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables

  Affected:

  <22.3.0

  Fixed in:

  22.3.0

  Source:

  OSV source · Advisory

• CVE-2026-68872

  Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable

  Affected:

  <9.34.0

  Fixed in:

  9.34.0

  Source:

  OSV source · Advisory

• CVE-2026-68871

  Apache Airflow Yandex provider: yandex Lockbox backend: team-scope guard bypass resolves another team's Connection or Variable

  Affected:

  <4.5.1

  Fixed in:

  4.5.1

  Source:

  OSV source · Advisory

• CVE-2026-68870

  Apache Airflow Microsoft Azure provider: microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's Connection or Variable

  Affected:

  <14.1.0

  Fixed in:

  14.1.0

  Source:

  OSV source · Advisory

• CVE-2026-59243

  Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)

  Affected:

  <3.7.3

  Fixed in:

  3.7.3

  Source:

  OSV source · Advisory

• CVE-2026-59245

  Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision)

  Affected:

  <3.7.2

  Fixed in:

  3.7.2

  Source:

  OSV source · Advisory

• CVE-2026-33264

  Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()

  Affected:

  <3.3.0

  Fixed in:

  3.3.0

  Source:

  OSV source · Advisory

Total releases

8

Last 30 days

0

Last 90 days

0

Avg. interval

~24 days

Most recent

11 Mar 2026

Releases tracked

8

Lifecycle periods

2

EOL

Known

Provenance records

3

Data last checked

2 Sept 2026

Latest source update

2 Sept 2026

• Previous

  Apache Airflow 3.0

  end of life · EOL 25 Sept 2025

• Next

  Apache Airflow 3.2

  end of life · EOL 6 Jul 2026

• Newest supported

  Apache Airflow 3.3

  standard support