Access Control Vulnerability in Apache Airflow Product

CVE-2026-38743

What is CVE-2026-38743?

The Apache Airflow product contains a vulnerability in the authenticated /ui/dags endpoint, which fails to enforce strict per-DAG access controls on Human-in-the-Loop (HITL) prompts and TaskInstance records. This oversight allows authenticated users with read access to at least one DAG to inadvertently access HITL prompts and full TaskInstance details from other DAGs for which they do not have authorization. Consequently, sensitive parameters and task-related context can be exposed, compromising the integrity of data visibility across DAG runs. It is crucial for users to update to version 3.2.1 or later to mitigate this risk.

References