Apache Airflow CVE-2026-41014

Exploitation requires a valid authenticated Airflow session (PR:L - unauthenticated access is not possible). The vulnerability is only meaningful when the Airflow deployment enforces per-DAG RBAC to restrict specific users or roles to specific DAG subsets; in environments where all authenticated users hold global DAG read access, there is no authorization boundary to bypass and no additional information is disclosed. The /ui/partitioned_dag_runs endpoint must be network-reachable by the attacker's session. No special attacker-controlled configuration, non-default Airflow settings, or specific operating system is required. Limiting factors: valid credentials are mandatory; impact is read-only DAG run metadata disclosure with no code execution or data modification possible; only relevant in multi-tenant or team-partitioned Airflow deployments using DAG-level RBAC.

CVSS 4.3 Medium (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) is consistent with the actual impact: the endpoint is network-reachable with no complexity barrier, but PR:L confirms a valid authenticated session is required. Scope is unchanged (S:U) and the only impact is a partial confidentiality disclosure (C:L) - no integrity or availability impact is possible. EPSS at 0.01% (4th percentile) reinforces that mass exploitation is not occurring and is unlikely given the authentication prerequisite. This CVE is not listed in CISA KEV, and no POC code was identified. Real-world priority is driven almost entirely by deployment context: organizations running Airflow 3.2.0-3.2.1 with per-DAG RBAC to enforce team or tenant isolation face a genuine authorization boundary breach; single-tenant or fully-trusted-user deployments have negligible practical risk from this issue. The low EPSS and absence from KEV suggest patching can proceed through normal vulnerability management cadence rather than emergency response.

An authenticated Airflow user whose role grants access to only a subset of DAGs (e.g., team-A DAGs) sends a standard GET request to /ui/partitioned_dag_runs?has_created_dag_run_id=false without any crafting or special tooling. The endpoint returns AssetPartitionDagRun records including target_dag_id values for DAGs the user is not permitted to see, leaking DAG names, partition keys, and run metadata belonging to other teams. No proof-of-concept code is publicly identified; the attack is reproducible by any valid Airflow session against a 3.2.0-3.2.1 instance with per-DAG RBAC active.