PT-2026-25891 · Apache · Apache Airflow

Pierre Jeambrun · CVE-2026-26929 · Published 2026-03-17 · Updated 2026-03-18

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 3.0.0 through 3.1.7

Description The FastAPI DagVersion listing API in Apache Airflow does not enforce per-DAG authorization filtering when a request is made with the dag id parameter set to '~' (wildcard for all DAGs). This allows the retrieval of version metadata for DAGs that the requesting user is not authorized to access.

Recommendations Upgrade to Apache Airflow version 3.1.8 or later.

Exploit

Fix

DoS

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2026-05612

BIT-AIRFLOW-2026-26929

CVE-2026-26929

ECHO-5261-4F07-492A

GHSA-4M3H-WP5W-5HQH

PYSEC-2026-14

Affected Products

Apache Airflow

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26929.json · Exploit
• https://github.com/apache/airflow/pull/61675 · Patch
• https://osv.dev/vulnerability/PYSEC-2026-14 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05612 · Security Note
• https://lists.apache.org/thread/g5o6khx83jwqvdyn0mlyb0krt35cs9ss · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4m3h-wp5w-5hqh · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2026-26929 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26929 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26929 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-14.yaml · Note
• https://twitter.com/oss_security/status/2033945933558251651 · Twitter Post
• https://github.com/advisories/GHSA-4m3h-wp5w-5hqh · Note
• https://twitter.com/CVEarity/status/2033955099220054313 · Twitter Post
• https://pypi.python.org · Note