EUVD-2026-25418
GHSA-p3v3-229h-mc63
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
7Blast Radius
ecosystem impact- 1 pypi packages depend on apache-airflow (0 direct, 1 indirect)
Ecosystem-wide dependent count for version 3.2.1rc1.
DescriptionCVE.org
The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance records: a logged-in Airflow user with read access to at least one DAG could retrieve HITL prompts (including their request parameters) and full TaskInstance details for DAGs outside their authorized scope. Because HITL prompts and TaskInstance fields routinely carry operator parameters and free-form context attached to a task, the leak widens visibility of DAG-run data beyond the intended per-DAG RBAC boundary for every authenticated user.
Users are recommended to upgrade to version 3.2.1 , which fixes this issue.
AnalysisAI
Apache Airflow versions prior to 3.2.1 fail to enforce per-DAG access control on the /ui/dags endpoint, allowing authenticated users with read access to at least one DAG to retrieve Human-in-the-Loop prompts and full TaskInstance details for DAGs outside their authorized scope. This information disclosure bypasses the intended per-DAG RBAC boundary, exposing operator parameters and task context data to all authenticated users regardless of their assigned DAG permissions.
Technical ContextAI
Apache Airflow is a workflow orchestration platform using role-based access control (RBAC) to enforce per-DAG authorization boundaries. The vulnerability resides in the /ui/dags API endpoint, which retrieves embedded Human-in-the-Loop (HITL) prompt objects and TaskInstance records without validating that the authenticated user has explicit read access to the specific DAG being queried. The root cause is inadequate authorization checking (CWE-1220: Improper Restriction of Rendered UI Layers or Frames) in the API layer. The HITL feature allows tasks to pause and request human intervention with attached parameters; TaskInstance records contain execution metadata including operator configurations. Both data types may contain sensitive information (credentials, API keys, query parameters) that should be restricted by DAG-level RBAC policies. An authenticated user can enumerate and access all HITL prompts and TaskInstance metadata across the entire Airflow deployment by making requests to /ui/dags for DAGs to which they lack explicit permissions.
RemediationAI
Upgrade Apache Airflow to version 3.2.1 or later immediately. This is the primary and only vendor-released fix; patch availability confirmed via Apache security advisory. For organizations unable to upgrade immediately, implement compensating controls: restrict the /ui/dags endpoint at the API gateway or reverse proxy layer (e.g., nginx, AWS API Gateway) to allow access only from whitelisted IP ranges or via a VPN, accepting potential user experience degradation for remote access. Alternatively, enforce network segmentation to limit authentication to trusted internal networks, reducing the pool of users who can authenticate to Airflow. Audit Airflow authentication logs and TaskInstance access logs (if available) to identify whether unprivileged users have accessed DAGs outside their RBAC scope prior to patching; this requires manual log analysis as Airflow's RBAC logging may not capture unauthorized /ui/dags endpoint hits. These workarounds do not fix the underlying authorization flaw and should be temporary; upgrading to 3.2.1 is mandatory for proper remediation. Monitor Apache Airflow release notes at https://github.com/apache/airflow for patch deployment confirmation.
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but th
An issue was found in Apache Airflow versions 1.10.10 and below. Rated high severity (CVSS 8.8), this vulnerability is r
The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. Rated critical severity (CV
An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability
A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arb
In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them
Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a maliciou
Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.6.0. Rated critical severit
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Fou
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airfl
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airfl
In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixa
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today