CVE-2026-38743: Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities
The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance records: a logged-in Airflow user with read access to at least one DAG could retrieve HITL prompts (including their request parameters) and full TaskInstance details for DAGs outside their authorized scope. Because HITL prompts and TaskInstance fields routinely carry operator parameters and free-form context attached to a task, the leak widens visibility of DAG-run data beyond the intended per-DAG RBAC boundary for every authenticated user.
Users are recommended to upgrade to version 3.2.1 , which fixes this issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-38743?
The severity of CVE-2026-38743 is currently classified as medium due to the potential unauthorized access to sensitive data.
How do I fix CVE-2026-38743?
To fix CVE-2026-38743, upgrade to Apache Airflow version 3.2.1 or later where the access control has been properly enforced.
What are the potential impacts of CVE-2026-38743?
CVE-2026-38743 may allow an unauthorized user to access internal task details and Human-in-the-Loop records, compromising data confidentiality.
Who is affected by CVE-2026-38743?
Users of Apache Airflow versions below 3.2.1 who have read access to at least one DAG are susceptible to CVE-2026-38743.
What steps should be taken if I cannot upgrade to fix CVE-2026-38743?
If upgrading is not possible, implement strict user access policies and monitor user activities to mitigate risks associated with CVE-2026-38743.