What is the CVSS score of CVE-2026-49296?

CVE-2026-49296 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-49296?

Yes, a patch is available for CVE-2026-49296. Update the affected software to the latest version immediately.

Apache Airflow CVE-2026-49296

EUVD-2026-42027 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-07 apache

GHSA-4fh7-7jx4-8f6c

Authentication Bypass Apache Apache Airflow

6.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

6.5 LOW

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Authenticated remote attacker (PR:L), no user interaction, high confidentiality impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 27, 2026 - 10:47 vuln.today

CVSS changed

Jul 07, 2026 - 14:22 NVD

6.5 (MEDIUM)

Analysis Generated

Jul 07, 2026 - 10:41 vuln.today

CVE Published

Jul 07, 2026 - 09:18 cve.org

MEDIUM 6.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 pypi packages depend on apache-airflow (2 direct, 2 indirect)

Ecosystem-wide dependent count for version 3.3.0.

DescriptionCVE.org

Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. GET /api/v2/dagSources/{dag_id} - and the equivalent Dag-source view in the UI - returned the entire source file without redacting Dags the caller was not authorized to read, bypassing per-DAG read authorization. Deployments that co-locate multiple Dags in a single file and rely on per-DAG access control to limit source visibility are affected; single-Dag-per-file deployments are not. Upgrade to apache-airflow 3.3.0 or later.

AnalysisAI

Unauthorized source code disclosure in Apache Airflow before 3.3.0 allows authenticated users to read the source of DAGs they are not authorized to, when multiple DAGs are co-located in a single source file. This bypasses per-DAG access control via the REST API endpoint GET /api/v2/dagSources/{dag_id} and the equivalent UI view. No public exploit identified, and EPSS probability is low (0.20%), mitigating immediate risk for most deployments.

Technical ContextAI

Apache Airflow implements per-DAG read authorization through its security model, but the dagSources endpoint retrieved the entire source file content without verifying whether the requester had read permission for every DAG defined in that file. The root cause is an authorization bypass (CWE-639) at the file level vs. the individual DAG level. Deployments that store multiple DAGs in a single Python file (co-location) and rely on per-DAG access control are vulnerable; single-DAG-per-file deployments are not affected. The fix introduces a redaction mechanism that replaces the source with a placeholder when the caller lacks read access to all DAGs sharing the file.

RemediationAI

Upgrade to Apache Airflow 3.3.0 or later, which implements proper redaction of co-located DAG source code. For deployments that cannot immediately upgrade, apply compensating controls: ensure each DAG is stored in its own source file (one file per DAG), or restrict the DagAccessEntity.CODE permission to roles that are trusted to read every DAG that has ever co-existed in any source file. The side effect of the latter is that it may grant broader access than intended. The patch commit is available at https://github.com/apache/airflow/pull/67662.