GitHub Advisoryadvisory · PyPI

GHSA-x3fv-96qh-67m7 Apache Airflow: DAG authorization bypass

MEDIUM Published 2026-03-17 Modified 2026-06-05 Official page ↗
Aliases
CVE-2026-28563
Ecosystem
PyPI
Packages
apache-airflow
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-732
Reviewed
2026-03-18

Affected packages

• PyPI apache-airflow: >= 3.0.0, < 3.1.8 → fixed in 3.1.8

Description

Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authorized to view. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

Related

Alias · CVE (1)

  • CVE-2026-28563 Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized… vulnerability

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References