Jarek Potiuk

Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints

Apache Airflow: DAG authorization bypass on /ui/structure/structure_data

Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler

Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()

Apache Airflow Google provider: Path traversal via GCS object names → local/SFTP filesystem (GCSToSFTPOperator + GCSTimeSpanFileTransformOperator)

Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory allows local file write outside the destination directory via malicious server-supplied directory-entry names

Apache Airflow Providers OpenSearch: OpenSearch task-log handler leaks credentials embedded in the host URL

Apache Airflow Providers Elasticsearch: Elasticsearch task-log handler leaks credentials embedded in the host URL

Apache Airflow Providers SMTP: No certificate validation on SMTP STARTTLS connections in SMTP provider

Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated topologies and all DAGs names to unauthorized users