What is the CVSS score of CVE-2026-40690?

CVE-2026-40690 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-40690?

Yes, a patch is available for CVE-2026-40690. Update the affected software to the latest version immediately.

Apache Airflow CVE-2026-40690

EUVD-2026-25419 MEDIUM

Insufficient Granularity of Access Control (CWE-1220)

2026-04-24 security@apache.org

GHSA-w7rc-q6cm-f5gm

Information Disclosure Airflow

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 27, 2026 - 12:24 nvd

Patch available

Analysis Generated

Apr 24, 2026 - 16:22 vuln.today

CVSS changed

Apr 24, 2026 - 16:22 NVD

4.3 (None) 4.3 (MEDIUM)

Patch available

Apr 24, 2026 - 15:01 EUVD

EUVD ID Assigned

Apr 24, 2026 - 13:22 euvd

EUVD-2026-25419

Analysis Generated

Apr 24, 2026 - 13:22 vuln.today

CVE Published

Apr 24, 2026 - 13:16 nvd

MEDIUM 4.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on apache-airflow (0 direct, 1 indirect)

Ecosystem-wide dependent count for version 3.2.1rc1.

DescriptionCVE.org

The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment and learn the existence and names of DAGs and assets outside their authorized scope.

Users are recommended to upgrade to version 3.2.1, which fixes this issue.

AnalysisAI

Apache Airflow versions prior to 3.2.1 allow authenticated users with read access to at least one directed acyclic graph (DAG) to enumerate and discover the names and existence of all other DAGs and assets in the deployment, regardless of their assigned permissions. This information disclosure vulnerability enables privilege escalation reconnaissance by revealing the complete asset topology to users with limited scope authorization. The vulnerability requires valid user credentials but no elevated privileges, and has no known public exploit code at time of analysis.

Technical ContextAI

Apache Airflow's asset dependency graph feature provides visibility into DAG relationships and resource dependencies. The vulnerability stems from insufficient access control checks (CWE-1220: Improper Restriction of Rendered UI Layers or Frames) in the graph rendering logic. The graph visualization endpoint fails to filter nodes based on the authenticated user's role-based access control (RBAC) permissions, instead returning all assets regardless of the viewer's authorization scope. This affects Airflow's core DAG management and asset discovery mechanisms, impacting any deployment where users are expected to have isolated access scopes.

RemediationAI

Upgrade Apache Airflow to version 3.2.1 or later, which implements proper access control checks in the asset dependency graph rendering logic. This patch ensures that graph nodes are filtered according to the authenticated user's DAG read permissions. Organizations unable to immediately upgrade should implement compensating controls: restrict access to the asset graph endpoint at the reverse proxy or load balancer level using authentication headers or IP allowlists, limiting graph visibility to users with administrative roles; or disable the asset dependency graph feature entirely via Airflow configuration if the feature is not operationally required. Note that network-level restrictions may impact legitimate operational visibility for privileged users, so coordinate with platform teams before implementation. Refer to the upstream fix in GitHub pull request #65273 and the Apache Airflow security mailing list thread for additional technical details.