CVE-2026-28563
MEDIUM
MEDIUM
Priority: 0.02
BB Relevance:
59/100
Published: 2026-03-17
Modified: 2026-11-03
First seen: 2026-11-03
Status: active
Attack Surface
Network
Low Complexity
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
Low
I:
None
A:
None
Description
Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authorized to view. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
Weakness Classification (1)
Affected Software (3)
| Vendor | Product | Version |
|---|---|---|
| Apache Software Foundation | Apache Airflow | 3.0.0 < 3.1.8 |
| Apache Software Foundation | Apache Airflow | 3.0.0 < 3.1.8 |
| apache | airflow | 3.0.0 – 3.1.8 |
References & Advisories (3)
vendor-advisory
patch
Mailing List
Third Party Advisory