EUVD-2026-42027
GHSA-4fh7-7jx4-8f6c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Airflow
-
DeliveryIdentify a DAG in a multi-DAG source file
-
ExploitSend GET request to /api/v2/dagSources/{dag_id}
-
ExecutionServer returns full file without redaction
-
ImpactAttacker reads unauthorized DAG source
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | The attacker must be an authenticated Airflow user with at least read (CODE) permission on one DAG. The vulnerable deployment must have multiple DAGs defined in a single source file, and the attacker must lack read permission for at least one of those co-located DAGs. Single-DAG-per-file deployments are not exploitable. Authentication is required (CVSS PR:L), and the attack can be performed over the network without user interaction. |
| Impact | CVSS 6.5 (Medium) with AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates a relatively straightforward attack requiring only low-privilege authentication, but EPSS scores (0.20%, percentile 10%) and CISA's SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial) collectively suggest very low real-world exploitation likelihood. No KEV listing or public exploit code exists. The risk is elevated only for organizations that co-locate DAGs under different authorization levels; otherwise, the vulnerability is not exploitable. The CVSS vector is consistent with the description and is not overstated. |
| Exploit ScenarioDerived | An authenticated Airflow user with read access to DAG 'alpha', which is defined in the same source file as DAG 'beta' (to which they have no read permission), sends a GET request to /api/v2/dagSources/alpha. The endpoint returns the full source file, including the source of 'beta', leaking sensitive DAG logic. No public exploit code is known, but the attack is straightforward for any authenticated user in a multi-DAG file environment. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
Unauthorized source code disclosure in Apache Airflow before 3.3.0 allows authenticated users to read the source of DAGs they are not authorized to, when multiple DAGs are co-located in a single source file. This bypasses per-DAG access control via the REST API endpoint GET /api/v2/dagSources/{dag_id} and the equivalent UI view. No public exploit identified, and EPSS probability is low (0.20%), mitigating immediate risk for most deployments.
RemediationAI
Upgrade to Apache Airflow 3.3.0 or later, which implements proper redaction of co-located DAG source code. For deployments that cannot immediately upgrade, apply compensating controls: ensure each DAG is stored in its own source file (one file per DAG), or restrict the DagAccessEntity.CODE permission to roles that are trusted to read every DAG that has ever co-existed in any source file. The side effect of the latter is that it may grant broader access than intended. The patch commit is available at https://github.com/apache/airflow/pull/67662.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Airflow implements per-DAG read authorization through its security model, but the dagSources endpoint retrieved the entire source file content without verifying whether the requester had read permission for every DAG defined in that file. The root cause is an authorization bypass (CWE-639) at the file level vs. the individual DAG level. Deployments that store multiple DAGs in a single Python file (co-location) and rely on per-DAG access control are vulnerable; single-DAG-per-file deployments are not affected. The fix introduces a redaction mechanism that replaces the source with a placeholder when the caller lacks read access to all DAGs sharing the file.
Know when Apache Airflow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Authenticated remote attacker (PR:L), no user interaction, high confidentiality impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. GET /api/v2/dagSources/{dag_id} - and the equivalent Dag-source view in the UI - returned the entire source file without redacting Dags the caller was not authorized to read, bypassing per-DAG read authorization. Deployments that co-locate multiple Dags in a single file and rely on per-DAG access control to limit source visibility are affected; single-Dag-per-file deployments are not. Upgrade to apache-airflow 3.3.0 or later.
Blast Radius
ecosystem impact- 4 pypi packages depend on apache-airflow (2 direct, 2 indirect)
Ecosystem-wide dependent count for version 3.3.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Apache Airflow
View allRemote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controll
Unsafe deserialization in Apache Airflow 3.3.0's Task SDK allows an authenticated DAG author to cause arbitrary module i
Unsafe deserialization in Apache Airflow 3.0.0 through 3.3.0 allows any DAG author to achieve arbitrary code execution i
Remote code execution in Apache Airflow 3.1.x allows authenticated DAG Authors to execute arbitrary code in the webserve
Command injection in Apache Airflow's BashOperator documentation example allows authenticated attackers to escalate priv
Unsafe XCom templating in Apache Airflow's documented example DAG (`example_xcom.py`) allowed an authenticated UI user w
CVE-2026-30911 is a security vulnerability (CVSS 8.1) that allows any authenticated task instance. High severity vulnera
Authorization bypass in Apache Airflow's Backfill API (all versions prior to 3.3.1) allows any authenticated user holdin
Information disclosure in Apache Airflow 3.0.0 through 3.1.x stems from incomplete secret masking and under-documented w
Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI
CVE-2026-28779 is a security vulnerability (CVSS 7.5) that allows any application co-hosted under the same domain. High
Apache Airflow before 3.2.0 exposes SQL exception stack traces through API responses despite api/expose_stack_traces=fal
Exploit-DB