PT-2026-45365 · Apache · Apache Airflow

Jarek Potiuk · CVE-2026-40963 · Published 2026-06-01 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions apache-airflow versions prior to 3.2.2

Description The 'structure data' endpoint in the Airflow UI fails to verify if the caller has read permissions for linked DAGs (Directed Acyclic Graphs, which are collections of all the tasks you want to run, organized in a way that reflects their relationships and dependencies). Consequently, an authenticated UI or API user with authorization for one DAG can enumerate linked DAG IDs and dependency metadata for other DAGs they are not authorized to access. This issue impacts deployments using per-DAG read scoping to maintain the privacy of DAG dependency topology across different teams.

Recommendations Upgrade to version 3.2.2 or later.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BIT-AIRFLOW-2026-40963

CVE-2026-40963

ECHO-583E-AD50-6EE4

GHSA-GPRJ-XVQ8-W53Q

PYSEC-2026-2349

Affected Products

Apache Airflow

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40963.json · Exploit
• https://github.com/apache/airflow/pull/65342 · Patch
• https://lists.apache.org/thread/s907bhsksc37m59f0loqjcp1ryobrr60 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gprj-xvq8-w53q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-40963 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-2349 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2026-40963 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40963 · Security Note
• https://github.com/apache/airflow · Note
• https://pypi.org/project/apache-airflow · Note
• http://openwall.com/lists/oss-security/2026/05/31/3 · Note
• https://pypi.python.org · Note
• https://github.com/advisories/GHSA-gprj-xvq8-w53q · Note
• https://t.me/cveNotify/165434 · Telegram Post