PT-2026-25891 · Apache · Apache Airflow

Pierre Jeambrun · Publicado 2026-03-17 · Atualizado 2026-03-18 · CVE-2026-26929

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 3.0.0 through 3.1.7

Description The FastAPI DagVersion listing API in Apache Airflow does not enforce per-DAG authorization filtering when a request is made with the dag id parameter set to '~' (wildcard for all DAGs). This allows the retrieval of version metadata for DAGs that the requesting user is not authorized to access.

Recommendations Upgrade to Apache Airflow version 3.1.8 or later.

Correção

DoS

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

BDU:2026-05612

BIT-AIRFLOW-2026-26929

CVE-2026-26929

GHSA-4M3H-WP5W-5HQH

PYSEC-2026-14

Produtos afetados

Apache Airflow

Referências · 16

• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/pull/61675 · Correção
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-14.yaml · Nota
• https://twitter.com/CVEarity/status/2033955099220054313 · Publicação no Twitter
• https://twitter.com/oss_security/status/2033945933558251651 · Publicação no Twitter
• https://osv.dev/vulnerability/PYSEC-2026-14 · Aviso do Fabricante
• https://github.com/advisories/GHSA-4m3h-wp5w-5hqh · Nota
• https://lists.apache.org/thread/g5o6khx83jwqvdyn0mlyb0krt35cs9ss · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2033994282437382184 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-26929 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2026/03/17/4 · Nota
• https://twitter.com/cyberbivash/status/2033894170226573344 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2026-05612 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-4m3h-wp5w-5hqh · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-airflow-2026-26929 · Aviso do Fabricante