GitHub Advisoryadvisory · PyPI

GHSA-w7rc-q6cm-f5gm Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions

MEDIUM Published 2026-04-24 Modified 2026-05-05 Official page ↗
Aliases
CVE-2026-40690
Ecosystem
PyPI
Packages
apache-airflow
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-1220
Reviewed
2026-05-05

Affected packages

• PyPI apache-airflow: < 3.2.1rc1 → fixed in 3.2.1rc1

Description

The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment and learn the existence and names of DAGs and assets outside their authorized scope. Users are recommended to upgrade to version 3.2.1, which fixes this issue.

Related

Alias · CVE (1)

  • CVE-2026-40690 The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could… vulnerability

Weakness · CWE (1)

  • CWE-1220 Insufficient Granularity of Access Control weakness

References