What is the CVSS score of CVE-2026-48891?

CVE-2026-48891 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-48891?

Yes, a patch is available for CVE-2026-48891. Update the affected software to the latest version immediately.

Apache Airflow CVE-2026-48891

Q: Which versions of Apache Airflow are affected by CVE-2026-48891?

Incomplete authorization filtering in Apache Airflow's `/ui/dependencies` scheduling graph endpoint exposes restricted DAG identifiers to authenticated users who lack read permission on those DAGs.. A patch is available.

EUVD-2026-42025 MEDIUM

Information Exposure (CWE-200)

2026-07-07 apache

GHSA-3322-mjxh-9mp5

Apache Information Disclosure Apache Airflow Apache Software Foundation

4.3

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

4.3 LOW

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible endpoint requires authenticated partial DAG read access (PR:L); impact is confined to DAG identifier disclosure only (C:L), with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Jul 07, 2026 - 14:22 NVD

4.3 (MEDIUM)

Analysis Generated

Jul 07, 2026 - 10:40 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 pypi packages depend on apache-airflow (2 direct, 2 indirect)

Ecosystem-wide dependent count for version 3.3.0.

DescriptionCVE.org

A bug in Apache Airflow's /ui/dependencies scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the dep.source and dep.target fields of trigger / sensor dependency entries. An authenticated UI user with read permission on some Dags could enumerate the identifiers of other Dags they were not authorized to read by inspecting the dependency graph for trigger / sensor references. Affects deployments that rely on per-Dag read scoping to keep Dag identifiers private across teams. This is a residual gap in the fix for CVE-2026-28563, which filtered the top-level Dag key but did not propagate the filter into the trigger / sensor dep-source / dep-target fields. Users who already upgraded for CVE-2026-28563 should additionally upgrade to apache-airflow 3.3.0 or later to cover the residual trigger / sensor dependency leak.

AnalysisAI

Incomplete authorization filtering in Apache Airflow's /ui/dependencies scheduling graph endpoint exposes restricted DAG identifiers to authenticated users who lack read permission on those DAGs. The endpoint correctly filters top-level serialized DAG keys against the caller's ACL but leaks referenced DAG IDs through dep.source and dep.target fields of trigger and sensor dependency entries, enabling cross-team DAG enumeration in multi-tenant deployments. This is a residual gap from an incomplete fix for CVE-2026-28563; no public exploit has been identified at time of analysis, and a vendor patch is available in apache-airflow 3.3.0.

Technical ContextAI

Apache Airflow's web UI exposes a /ui/dependencies endpoint that renders the scheduling dependency graph, including trigger and sensor inter-DAG relationships serialized as dependency objects with dep.source and dep.target fields. The fix for CVE-2026-28563 applied per-DAG read ACL filtering to the top-level DAG key in the serialized response but did not propagate that filter into the dep-object fields, creating a filter bypass at the nested dependency layer. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) describes this root cause class precisely: an authorization control is present and partially applied but does not cover all code paths through which restricted data flows. The affected product is identified by CPE cpe:2.3:a:apache_software_foundation:apache_airflow:*:*:*:*:*:*:*:* across all versions prior to 3.3.0. Airflow's DAG-level RBAC scoping, intended to isolate teams within shared Airflow deployments, is the security boundary being bypassed.

RemediationAI

Upgrade to apache-airflow 3.3.0 or later, which extends the CVE-2026-28563 filter to cover dep.source and dep.target fields in trigger and sensor dependency entries. The upstream fix is merged in GitHub PR https://github.com/apache/airflow/pull/67627. For deployments unable to upgrade immediately, a targeted compensating control is to restrict access to the /ui/dependencies endpoint at the reverse proxy layer (e.g., Nginx deny directive or Apache Require directive scoped to privileged roles only); this disables the dependency graph UI for all users and may impact operational visibility. A lower-impact alternative is to audit DAG naming conventions and remove sensitive information from DAG identifiers themselves, which reduces the value of enumeration without disrupting UI functionality. Vendor advisory: https://lists.apache.org/thread/wzc8nflg94rq6w8f5tvtlo0o3g4wjrfl.