CVE-2026-26929

Katalog CVE

CVSS 6.5 · Medium EPSS 0,62%

Kerentanan Incorrect Permission Assignment for Critical Resource pada apache airflow. Skor CVSS 3.1 6.5 (Medium) menurut CISA ADP.

Deskripsi (NVD)

Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). As a result, version metadata of DAGs that the requester is not authorized to access is returned. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

Rincian

Terbit di NVD

17 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

0,62% peluang dieksploitasi; lebih tinggi dari 48,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/g5o6khx83jwqvdyn0mlyb0krt35cs9ss mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2026/03/17/4 mailing list · advisory pihak ketiga
• https://github.com/apache/airflow/pull/61675 issue tracking