Dashboard / CVE-2026-26929

CVE-2026-26929

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 63/100
Published: 2026-03-17 Modified: 2026-11-03 First seen: 2026-11-03 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: High
I: None
A: None

Description

Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). As a result, version metadata of DAGs that the requester is not authorized to access is returned. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

Weakness Classification (1)

Affected Software (3)

VendorProductVersion
Apache Software Foundation Apache Airflow 3.0.0 < 3.1.8
Apache Software Foundation Apache Airflow 3.0.0 < 3.1.8
apache airflow 3.0.0 – 3.1.8

References & Advisories (3)

Bug Bounty Relevance

63 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS — Exploitation Probability

0.42%
Raw Score 0.004220
Percentile 36.5%
Date 2026-11-02

Intelligence Sources

mitre ref →
nvd ref →

External Links