What’s Vulnerable › Vulnerabilities

CVE-2026-26929: Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-17 · updated 2026-06-17
• Weakness: CWE-732

Description

Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). As a result, version metadata of DAGs that the requester is not authorized to access is returned. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

Affected products

• Apache Airflow: from 3.0.0 before 3.1.8 — fixed in 3.1.8

How to fix

Upgrade to a fixed version: Apache Airflow 3.1.8. Check the vendor advisory for mitigations.

References

• https://github.com/apache/airflow/pull/61675
• https://lists.apache.org/thread/g5o6khx83jwqvdyn0mlyb0krt35cs9ss
• http://www.openwall.com/lists/oss-security/2026/03/17/4

Get alerted when CVE-2026-26929 or the next vulnerability affects your stack