Jarek Potiuk

Apache Airflow: CLI argv masking misses Variable values and --conn-extra, persisting secrets in audit logs

Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext

Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcement

Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline callbacks

Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit

Apache Airflow: Shell command injection in the example_dag_decorator example Dag via an IPv6 zone identifier

Apache Airflow Task SDK: SecretCache: non-injective team cache key enables cross-team secret disclosure in multi-team mode

Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter