CVE-2026-28563

Published: Mar 17, 2026Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authorized to view. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

Affected (1)

Products: Apache: Airflow

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Airflow	From 3.0.0 to 3.1.8

Related CWEs

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (3)

https://github.com/apache/airflow/pull/62046

Source: security@apache.org

Issue TrackingPatch

https://lists.apache.org/thread/dwzf62qg9z8wvfsjknpfd8bvtwghd49s

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2026/03/17/5

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.