PT-2026-25891

CVE-2026-26929

Published

2026-03-17

Updated

2026-03-18

Description by

CVSS 2.0

6.8

Medium

MetricsAV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 3.0.0 through 3.1.7

Description The FastAPI DagVersion listing API in Apache Airflow does not enforce per-DAG authorization filtering when a request is made with the dag id parameter set to '~' (wildcard for all DAGs). This allows the retrieval of version metadata for DAGs that the requesting user is not authorized to access.

Recommendations Upgrade to Apache Airflow version 3.1.8 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Pierre Jeambrun

Vendors

Affected products

Weakness enumeration

CWE-732: Incorrect Permission Assignment for Critical Resource

Related identifiers