PT-2026-56177 · Apache · Apache Airflow

Jarek Potiuk · Published 2026-07-07 · Updated 2026-07-07 · CVE-2026-48891

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.0

Description A bug in the /ui/dependencies scheduling graph endpoint allows an authenticated UI user with read permissions on some Dags to enumerate identifiers of other Dags they are not authorized to read. While the system applies a readable-Dag filter to the top-level serialized Dag key, it fails to propagate this filter to the dep.source and dep.target fields of trigger and sensor dependency entries. This issue affects deployments that use per-Dag read scoping to maintain privacy of Dag identifiers across teams.

Recommendations Update to version 3.3.0 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-48891

Affected Products

Apache Airflow

References · 6

• https://github.com/apache/airflow/pull/67627 · Patch
• https://lists.apache.org/thread/wzc8nflg94rq6w8f5tvtlo0o3g4wjrfl · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-28563 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-48891 · Security Note
• https://twitter.com/infoflowcloud/status/2074460061296964087 · Twitter Post
• https://twitter.com/CVEnew/status/2074459524186939680 · Twitter Post