Unauthorized Access Vulnerability in Apache Airflow Asset Graph

CVE-2026-40690

What is CVE-2026-40690?

An access control issue in Apache Airflow allows a user with read access to at least one Directed Acyclic Graph (DAG) to view the asset dependency graph of any other asset within the deployment. This flaw can lead to information disclosure, enabling unauthorized users to learn the existence and names of other DAGs and associated assets beyond their intended permissions. It is paramount for users to upgrade to version 3.2.1 to mitigate this vulnerability and secure their installations.

References