PT-2026-34876 · Airflow · Airflow

Jed Cunningham + 1 · Published 2026-04-24 · Updated 2026-04-28 · CVE-2026-38743

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Airflow versions prior to 3.2.1

Description The authenticated '/ui/dags' endpoint fails to enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance records. This allows a logged-in user with read access to at least one DAG to retrieve HITL prompts, including their request parameters, and full TaskInstance details for DAGs outside their authorized scope. Since HITL prompts and TaskInstance fields often contain operator parameters and free-form context, this issue expands the visibility of DAG-run data beyond the intended Role-Based Access Control (RBAC) boundaries for all authenticated users.

Recommendations Upgrade to version 3.2.1.

Fix

DoS

Weakness Enumeration

CWE-1220

Related Identifiers

BIT-AIRFLOW-2026-38743

CVE-2026-38743

GHSA-P3V3-229H-MC63

Affected Products

Airflow

References · 11

• https://github.com/apache/airflow/pull/64822 · Patch
• https://osv.dev/vulnerability/GHSA-p3v3-229h-mc63 · Vendor Advisory
• https://lists.apache.org/thread/sk2wj0x48o8qb4p7c47gvnhjbm0mg396 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-38743 · Security Note
• https://osv.dev/vulnerability/BIT-airflow-2026-38743 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/fed4921098d51fd3ec17b7f5cff80f6c36fd05e2 · Note
• https://t.me/cveNotify/161058 · Telegram Post
• https://twitter.com/oss_security/status/2048945869764935967 · Twitter Post
• http://openwall.com/lists/oss-security/2026/04/24/3 · Note
• https://twitter.com/CVEnew/status/2048099290824814600 · Twitter Post