CVE-2026-34538: Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure)
Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security model documentation that defines the Viewer role as read-only.
Airflow uses the FAB Auth Manager to manage access control on a per-resource basis. The Viewer role is intended to be read-only by default, and the security model documentation defines Viewer users as those who can inspect DAGs without accessing sensitive execution results.
Users are recommended to upgrade to Apache Airflow 3.2.0 which resolves this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34538?
The severity of CVE-2026-34538 is classified as high due to the potential for unauthorized access to sensitive XCom result values.
How do I fix CVE-2026-34538?
To fix CVE-2026-34538, upgrade to Apache Airflow version 3.1.9 or later, which addresses the authorization bypass issue.
What are the affected versions of CVE-2026-34538?
Affected versions for CVE-2026-34538 include Apache Airflow versions 3.0.0 through 3.1.8.
What is the impact of CVE-2026-34538 on user roles?
CVE-2026-34538 allows users with only DAG Run read permissions, such as the Viewer role, to access XCom results, which violates RBAC policies.
Is CVE-2026-34538 related to user permissions in Apache Airflow?
Yes, CVE-2026-34538 is directly related to user permissions as it enables an authorization bypass specifically affecting users with limited access.