Vulnerability Description
The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment and learn the existence and names of DAGs and assets outside their authorized scope. Users are recommended to upgrade to version 3.2.1, which fixes this issue.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Airflow | < 3.2.1 |
Related Weaknesses (CWE)
References
- https://github.com/apache/airflow/pull/65273Issue TrackingPatch
- https://lists.apache.org/thread/bqt7y4g2cpj396b0sd20lv510ff19ndlMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/04/24/4Mailing ListThird Party Advisory
FAQ
What is CVE-2026-40690?
CVE-2026-40690 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment a...
How severe is CVE-2026-40690?
CVE-2026-40690 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-40690?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Airflow.