Jarek Potiuk

Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options

Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target

Apache Airflow Samba provider: Path traversal in GCSToSambaOperator via GCS object names

Apache Airflow: No certificate validation on SMTP STARTTLS connections

Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)

Apache Airflow: Arbitrary import in custom deadline-reference deserialization

Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking

Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator

Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets

Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy