Information Disclosure in Apache Airflow's Import Errors API

CVE-2026-40913

What is CVE-2026-40913?

The Import Errors API in Apache Airflow is susceptible to an information disclosure vulnerability. It may reveal detailed stack traces to users possessing the ImportError.can_read permission, even for files lacking a registered Directed Acyclic Graph (DAG). This can occur with files that fail to parse prior to any DAG configuration or when registered DAGs are removed, leaving the parse error unaddressed. Such stack traces may inadvertently expose sensitive file paths and code that should remain hidden from unauthorized users. It is recommended to upgrade to Apache Airflow version 3.4.0 or newer, which introduces a new permission model, restricting stack trace visibility to those with the IMPORT_ERRORS_ALL permission.

References