CVE-2026-24098CWE-200

Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors

Medium · published February 9, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
57.0
In the wild
Unconfirmed
What it is

Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to.

Users are advised to upgrade to 3.1.7 or later, which resolves this issue

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00827 · 57.0th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-02-09T10:32Z
EPSS history
Timeline
  • 09 FEB 10:32Z
    Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors
    cvelistv5