SB20260825108 - Multiple vulnerabilities in Apache Airflow

Description

This security bulletin contains information about 2 vulnerabilities.

1) Improper access control (CVE-ID: CVE-2026-38743)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the /ui/dags endpoint when handling authenticated requests that embed Human-in-the-Loop and TaskInstance records. A remote user can retrieve DAG-related records outside their authorized scope to disclose sensitive information.

The exposed data may include HITL prompts with request parameters and full TaskInstance details.

2) Improper access control (CVE-ID: CVE-2026-40690)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the asset dependency graph view when handling asset graph browsing requests. A remote user can browse the graph for unauthorized assets to disclose the existence and names of DAGs and assets outside their authorized scope.

Exploitation requires read access to at least one DAG.

Remediation

Install update from vendor's website.

References

• https://lists.apache.org/api/email.lua?id=fvhljv1szfk4tr6yxkbk2y19l57k8wb2
• https://github.com/apache/airflow/pull/64822
• https://lists.apache.org/api/email.lua?id=vm1z1l2z5sgksc3fkcrbwdntrjoo0wmg
• https://github.com/apache/airflow/pull/65273