CVE-2026-26929

Опубликовано: 17 мар. 2026

Источник: nvd

CVSS3: 6.5

EPSS Низкий

Описание

Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). As a result, version metadata of DAGs that the requester is not authorized to access is returned.

Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

Ссылки

https://github.com/apache/airflow/pull/61675
Issue Tracking
https://lists.apache.org/thread/g5o6khx83jwqvdyn0mlyb0krt35cs9ss
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/03/17/4
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*

Версия от 3.0.0 (включая) до 3.1.8 (исключая)

EPSS

Процентиль: 17%

0.00054

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-732

Связанные уязвимости

CVE-2026-26929

CVSS3: 6.5

debian

14 дней назад

Apache Airflow versions 3.0.0 through 3.1.7FastAPI DagVersion listing ...

GHSA-4m3h-wp5w-5hqh

CVSS3: 7.5

github