PT-2026-34877 · Apache+3 · Apache Airflow+1

Jarek Potiuk + 1 · Published 2026-04-24 · Updated 2026-04-28 · CVE-2026-40690

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions The product name cannot be determined versions prior to 3.2.1

Description The asset dependency graph fails to restrict nodes based on the viewer's DAG read permissions. This allows a user with read access to at least one DAG to browse the asset graph for any other asset in the deployment, enabling them to discover the existence and names of DAGs and assets outside their authorized scope.

Recommendations Upgrade to version 3.2.1.

Fix

Weakness Enumeration

CWE-1220

Related Identifiers

BIT-AIRFLOW-2026-40690

CVE-2026-40690

GHSA-W7RC-Q6CM-F5GM

Affected Products

Apache Airflow

Airflow

References · 10

• https://github.com/apache/airflow/pull/65273 · Patch
• https://osv.dev/vulnerability/BIT-airflow-2026-40690 · Vendor Advisory
• https://lists.apache.org/thread/bqt7y4g2cpj396b0sd20lv510ff19ndl · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40690 · Security Note
• https://osv.dev/vulnerability/GHSA-w7rc-q6cm-f5gm · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/cf3452d76e2ef5a8bae247f9fc90c759ff9df02f · Note
• https://twitter.com/oss_security/status/2048945869764935967 · Twitter Post
• https://twitter.com/CVEnew/status/2048099291781099930 · Twitter Post
• http://openwall.com/lists/oss-security/2026/04/24/4 · Note