PT-2026-56179 · Apache · Apache Airflow

Jarek Potiuk · Published 2026-07-07 · Updated 2026-07-07 · CVE-2026-49296

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions apache-airflow versions prior to 3.3.0

Description An authorization bypass occurs when a user with permission to read a specific Dag can disclose the source code of other Dags located within the same source file. This issue affects deployments that co-locate multiple Dags in a single file and rely on per-DAG access control. The flaw exists in the GET /api/v2/dagSources/{dag id} endpoint and the corresponding Dag-source view in the UI, which return the entire source file without redacting unauthorized Dags. The dag id variable is used to identify the requested Dag.

Recommendations Upgrade to apache-airflow version 3.3.0 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-49296

Affected Products

Apache Airflow

References · 6

• https://github.com/apache/airflow/pull/67662 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-49296 · Security Note
• https://lists.apache.org/thread/qqv41t3oydkn9o14r2rfz1wkdrsp5jzn · Vendor Advisory
• http://openwall.com/lists/oss-security/2026/07/07/5 · Note
• https://twitter.com/CVEnew/status/2074459521204789445 · Twitter Post
• https://twitter.com/infoflowcloud/status/2074460022227063150 · Twitter Post