PT-2026-45365 · Apache · Apache Airflow

Jarek Potiuk · Published 2026-06-01 · Updated 2026-06-05 · CVE-2026-40963

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions apache-airflow versions prior to 3.2.2

Description The 'structure data' endpoint in the Airflow UI fails to verify if the caller has read permissions for linked DAGs (Directed Acyclic Graphs, which are collections of all the tasks you want to run, organized in a way that reflects their relationships and dependencies). Consequently, an authenticated UI or API user with authorization for one DAG can enumerate linked DAG IDs and dependency metadata for other DAGs they are not authorized to access. This issue impacts deployments using per-DAG read scoping to maintain the privacy of DAG dependency topology across different teams.

Recommendations Upgrade to version 3.2.2 or later.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BIT-AIRFLOW-2026-40963

CVE-2026-40963

Affected Products

Apache Airflow

References · 6

• https://github.com/apache/airflow/pull/65342 · Patch
• https://osv.dev/vulnerability/BIT-airflow-2026-40963 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40963 · Security Note
• https://lists.apache.org/thread/s907bhsksc37m59f0loqjcp1ryobrr60 · Vendor Advisory
• https://t.me/cveNotify/165434 · Telegram Post
• http://openwall.com/lists/oss-security/2026/05/31/3 · Note