Apache Airflow 2 end-of-life and support dates

Lifecycle timeline

• 2020-12-17 — Release date · General availability
• 2025-10-22 — End of active support · End of maintenance
• 2026-04-22 — End of support · End of standard support

Why this status?

“End of active support” (end-of-maintenance, 2025-10-22, confirmed) has passed and no later support phase is published.

Evidence

• Apache Airflow version lifecycle Official · checked 2026-11-10
• endoflife.date product data independent-open · checked 2026-11-10

Related

• All Apache Airflow lifecycle dates· 10 tracked releases
• Apache Airflow security advisories· 114 tracked
  • CVE-2026-68982: Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workload's authentication token
  • CVE-2026-76185: Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped `_` delimiters, so different (team, secret id) pairs could collide
  • CVE-2026-86829: Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies
  • CVE-2026-107474: Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext
  • CVE-2026-111421: Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied elsewhere, so a Dag author's task could write an XCom that, when a user later viewed it through the API with deserialization enabled, made the API server instantiate classes from the `airflow.*` namespace with arguments the Dag author chose
• CVE email alerts for Apache