CVE-2026-26929: Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata
Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dagid set to "~" (wildcard for all DAGs). As a result, version metadata of DAGs that the requester is not authorized to access is returned.
Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26929?
CVE-2026-26929 is considered a medium severity vulnerability due to its potential for unauthorized data exposure.
How do I fix CVE-2026-26929?
To fix CVE-2026-26929, upgrade Apache Airflow to version 3.1.8 or later, which includes the necessary authorization fixes.
What impact does CVE-2026-26929 have on my Apache Airflow deployment?
CVE-2026-26929 allows unauthorized users to list all DAG versions, bypassing per-DAG Role-Based Access Control (RBAC), which can lead to metadata leakage.
Which versions of Apache Airflow are affected by CVE-2026-26929?
Apache Airflow versions 3.0.0 through 3.1.7 are affected by CVE-2026-26929.
Is CVE-2026-26929 being actively exploited?
As of the latest information, there are no known active exploits for CVE-2026-26929, but it is recommended to apply the patch to mitigate risks.