Skip to content
OpenAdvisories
Low WID-SEC-2026-1277 2 CVEs

Apache Airflow: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Published Apr 26, 2026 · Updated Apr 26, 2026 · de-DE

Vendor: Apache Product: Airflow Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um Informationen offenzulegen.

Product

Apache Airflow ist eine Plattform zur programmatischen Erstellung, Planung und Überwachung von Workflows.

Vulnerabilities 2

  • Medium 4.3
    CVE-2026-38743

    Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities

    The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance records: a logged-in Airflow user with read access to at least one DAG could retrieve HITL prompts (including their request parame…

    Apache Software Foundation Apache Airflow apache-airflow PyPI
  • Medium 4.3
    CVE-2026-40690

    Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated topologies and all DAGs names to unauthorized users

    The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment and learn the existence and names of DAGs and assets outside…

    Apache Software Foundation Apache Airflow apache-airflow PyPI

Revision history

  1. #1

    Initiale Fassung

References