Data Exposure in Apache Airflow UI due to Permission Check Flaw

CVE-2026-40963

What is CVE-2026-40963?

A flaw in the structure_data endpoint of the Apache Airflow UI permits authenticated users to access external dependency graph nodes for linked Directed Acyclic Graphs (DAGs). This occurs without verifying if the user has permission to view those linked DAGs. Consequently, a user authorized for one DAG can enumerate linked DAG IDs along with their dependency metadata from other DAGs they are not permitted to access. This poses significant risks for organizations relying on stringent per-DAG read permissions to maintain the confidentiality of their DAG dependency architecture across different teams. Users should upgrade to Apache Airflow version 3.2.2 or later to mitigate this vulnerability.

References