CVE-2026-28563CWE-732

Apache Airflow: DAG authorization bypass

Medium · published March 17, 2026

CVSS v3.1
4.3
EPSS
1%
Percentile
52.5
In the wild
Unconfirmed
What it is

Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authorized to view.

Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00697 · 52.5th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-03-17T10:54Z
EPSS history
Timeline
  • 17 MAR 10:54Z
    Apache Airflow: DAG authorization bypass
    cvelistv5