Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-24098

Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors

Description

Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. Users are advised to upgrade to 3.1.7 or later, which resolves this issue

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Airflow

Default version status: unaffected

  • 3.0.0 to < 3.1.7affected

References