Improper access control in Apache Airflow - CVE-2026-34538
Published: August 25, 2026
Vulnerability identifier: #VU145311
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-34538
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the DagRun wait endpoint when handling requests for DagRun wait results. A remote user can retrieve XCom result values to disclose sensitive information.
The issue affects users with DAG Run read permissions, such as the Viewer role, who should not be able to access XCom as a separate protected resource.
Affected software
Apache Airflow
How to mitigate CVE-2026-34538
Install security update from vendor's website.
Apache Airflow - update to 3.2.0