CVE-2026-26929CWE-732

Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata

Medium · published March 17, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
50.2
In the wild
Unconfirmed
What it is

Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). As a result, version metadata of DAGs that the requester is not authorized to access is returned.

Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00644 · 50.2th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-03-17T10:54Z
EPSS history
Timeline
  • 17 MAR 10:54Z
    Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata
    cvelistv5