Data Management and Analytics

In Apache Airflow versions 3.0.0 before 3.2.0 medium severity vulnerability CVE-2025-57735 was detected. This vulnerability allows attackers to reuse intercepted JWT tokens because the system failed to invalidate them after a user logged out. To address this issue users must upgrade to 3.2.0 version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-57735.

In Apache Airflow versions prior to 3.2.0 medium severity vulnerability CVE-2025-66236 was detected. This vulnerability allows attackers to view secrets from the Airflow configuration file which were logged in plain text within the DAG run logs UI due to insufficient security model clarity and workload isolation. To address this issue users must upgrade to 3.2.0 version and follow the updated security model guidelines. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-66236.

In LiteLLM versions prior to 1.83.0 high severity vulnerability CVE-2026-35030 was detected. This vulnerability allows attackers to bypass authentication via an OIDC userinfo cache key collision by crafting a token whose first 20 characters match a legitimate user’s cached token. To address this issue users must upgrade to the 1.83.0 version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-35030.

In LiteLLM versions prior to 1.83.0 critical severity vulnerability CVE-2026-35029 was detected. This vulnerability allows attackers to use the /config/update endpoint to modify proxy configurations, achieve remote code execution through custom handlers, read arbitrary server files, and take over privileged accounts by overwriting environment variables. To address this issue users must upgrade to the 1.83.0 version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-35029.

In MariaDB Server versions prior to 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2 high severity vulnerability CVE-2026-35549 was detected. This vulnerability allows attackers to crash the server using a large packet when the caching_sha2_password authentication plugin is in use. To address this issue users must upgrade to 11.4.10, 11.8.6, or 12.2.2 version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-35549.

In Logstash versions 8.0.0 – 8.19.13, 9.0.0 – 9.2.7, and 9.3.0 – 9.3.2 high severity vulnerability CVE-2026-33466 was detected. This vulnerability allows attackers to write arbitrary files to the host filesystem and potentially achieve remote code execution via relative path traversal by serving a specially crafted compressed archive through a compromised update endpoint. To address this issue users must upgrade to 8.19.14, 9.2.8, or 9.3.3 versions. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33466.

In Kibana all versions from 8.0.0 up to and including 8.19.13, all versions from 9.0.0 up to and including 9.2.7 and all versions from 9.3.0 up to and including 9.3.2 a high severity vulnerability CVE-2026-33461 was detected. This vulnerability allows attackers with limited Fleet privileges to access sensitive configuration data, including private keys and authentication tokens, by exploiting an internal API endpoint that bypasses proper authorization checks. To address this issue, users should upgrade Kibana to versions 8.19.14, 9.2.8, or 9.3.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33461.

In Kibana all versions from 8.0.0 up to and including 8.19.13, all versions from 9.0.0 up to and including 9.2.7 and all versions from 9.3.0 up to and including 9.3.2 a medium severity vulnerability CVE-2026-33460 was detected. This vulnerability allows attackers with Fleet agent management privileges to access Fleet Server policy details from other spaces by exploiting an internal enrollment endpoint that bypasses space-scoped authorization controls. To address this issue, users should upgrade Kibana to versions 8.19.14, 9.2.8, or 9.3.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33460.

In Kibana all versions from 8.0.0 up to and including 8.19.13, all versions from 9.0.0 up to and including 9.2.7 and all versions from 9.3.0 up to and including 9.3.2 a high severity vulnerability CVE-2026-33459 was detected. This vulnerability allows authenticated users to cause denial of service (DoS) by submitting specially crafted requests with excessively large input values to the automatic import feature, leading to excessive resource consumption and service disruption. To address this issue, users should upgrade Kibana to versions 8.19.14, 9.2.8, or 9.3.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33459.