Количество 3
Количество 3
CVE-2026-41014
The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization. An authenticated UI/API user with global Asset:read permission could enumerate partition run state, schedule configuration, and asset wiring for Dags they were not authorized to read. Affects deployments that rely on per-Dag read scoping while granting users broader Asset access. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.
CVE-2026-41014
The partitioned_dag_runs endpoints in the Airflow UI enforced only ass ...
GHSA-x2x7-p37c-43cr
Apache Airflow has a Missing Authorization issue
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-41014 The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization. An authenticated UI/API user with global Asset:read permission could enumerate partition run state, schedule configuration, and asset wiring for Dags they were not authorized to read. Affects deployments that rely on per-Dag read scoping while granting users broader Asset access. Users are advised to upgrade to `apache-airflow` 3.2.2 or later. | CVSS3: 4.3 | 0% Низкий | 3 месяца назад |
| CVE-2026-41014 The partitioned_dag_runs endpoints in the Airflow UI enforced only ass ... | CVSS3: 4.3 | 0% Низкий | 3 месяца назад |
| GHSA-x2x7-p37c-43cr Apache Airflow has a Missing Authorization issue | CVSS3: 4.3 | 0% Низкий | 3 месяца назад |
Уязвимостей на страницу