CVE-2026-40690Medium· 4.3▾ SunlitApache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment and learn the existence and names of DAGs and assets outside their authorized scope.
Users are recommended to upgrade to version 3.2.1, which fixes this issue.
apache-airflow < 3.2.1rc1Upgrade to a patched release:
apache-airflow 3.2.1rc1Connected by shared product, vendor, weakness, or advisory.
CVE-2024-41937Medium· 6.1Apache Airflow Cross-site Scripting Vulnerability
CVE-2026-34538Medium· 6.5Apache Airflow has an authorization bypass in DagRun wait endpoint
CVE-2026-22922Medium· 6.5Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access
CVE-2025-66236High· 7.5Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI
CVE-2024-39863Medium· 5.4Apache Airflow Potential Cross-site Scripting Vulnerability
CVE-2024-39877High· 8.8Apache Airflow has DAG Author Code Execution possibility in airflow-scheduler