CVE-2026-24098 — MEDIUM (6.5)

Q: How severe is CVE-2026-24098?

CVE-2026-24098 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-24098?

Check the references section above for vendor advisories and patch information. Affected products include: Apache Airflow.

Vulnerability Description

Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. Users are advised to upgrade to 3.1.7 or later, which resolves this issue

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Apache	Airflow	>= 3.0.0, < 3.1.7

Related Weaknesses (CWE)

CWE-200

References

https://github.com/apache/airflow/pull/60801Issue TrackingPatch
https://lists.apache.org/thread/nx96435v77xdst7ls5lk57kqvqyj095xMailing ListVendor Advisory
http://www.openwall.com/lists/oss-security/2026/02/09/3Mailing ListThird Party Advisory

FAQ

What is CVE-2026-24098?

CVE-2026-24098 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have...

How severe is CVE-2026-24098?

CVE-2026-24098 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-24098?

Check the references section above for vendor advisories and patch information. Affected products include: Apache Airflow.