---
id: CVE-2026-40690
aliases:
  - GHSA-w7rc-q6cm-f5gm
  - BIT-airflow-2026-40690
  - PYSEC-2026-2356
title: >-
  Apache Airflow's asset dependency graph did not restrict nodes by the viewer's
  DAG read permissions
summary: >-
  Apache Airflow's asset dependency graph did not restrict nodes by the viewer's
  DAG read permissions
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
vendor: apache-airflow
product: apache-airflow
ecosystem: pip
affected:
  - apache-airflow < 3.2.1rc1
patched:
  - apache-airflow 3.2.1rc1
published: '2026-04-24'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-w7rc-q6cm-f5gm'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-40690'
  - url: 'https://github.com/apache/airflow/pull/65273'
  - url: >-
      https://github.com/apache/airflow/commit/cf3452d76e2ef5a8bae247f9fc90c759ff9df02f
  - url: 'https://github.com/apache/airflow'
  - url: 'https://lists.apache.org/thread/bqt7y4g2cpj396b0sd20lv510ff19ndl'
  - url: 'http://www.openwall.com/lists/oss-security/2026/04/24/4'
tags:
  - osv
  - pip
epss: 0.00571
epssPercentile: 0.44819
ingestedAt: '2026-07-13T18:58:04.214Z'
---

## Overview

The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment and learn the existence and names of DAGs and assets outside their authorized scope.

Users are recommended to upgrade to version 3.2.1, which fixes this issue.

## Affected packages

- `apache-airflow < 3.2.1rc1`

## Remediation

Upgrade to a patched release:

- `apache-airflow 3.2.1rc1`