Vulnerability Description
Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). As a result, version metadata of DAGs that the requester is not authorized to access is returned. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Airflow | >= 3.0.0, < 3.1.8 |
Related Weaknesses (CWE)
References
- https://github.com/apache/airflow/pull/61675Issue Tracking
- https://lists.apache.org/thread/g5o6khx83jwqvdyn0mlyb0krt35cs9ssMailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2026/03/17/4Mailing ListThird Party Advisory
FAQ
What is CVE-2026-26929?
CVE-2026-26929 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). As a ...
How severe is CVE-2026-26929?
CVE-2026-26929 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-26929?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Airflow.