CVE-2026-40913: Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcement

Q: Which users can retrieve the exposed stack traces?

Any user granted the ImportError.can_read permission can retrieve raw parse-failure stack traces for an affected file when that file has no registered DAG. In affected releases, access is not further restricted based on per-file DAG permissions.

Q: When is a file affected by the missing per-file authorization check?

The issue applies when a file fails to parse before defining any DAG, or when all DAGs previously registered from that file have been removed while its parse error remains. Files with no registered DAG are the condition that causes the incomplete authorization enforcement.

Q: What information could be disclosed?

The Import Errors API returns the raw parse-failure stack trace. These traces may reveal file paths and source-code details to users who should not be able to view the failing file's details.

Q: What remediation is available?

Upgrade to Apache Airflow 3.4.0 or later. That version restricts these stack traces to users with the new IMPORT_ERRORS_ALL permission.

Published Nov 9, 2026

Updated

Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the ImportError.canread permission when the failing file has no registered DAG. This happens when a file fails to parse before any DAG is defined, or when all of its previously registered DAGs are removed but the parse error remains. Users who should not see that file's details can read stack traces that may expose file paths and code.

Users are advised to upgrade to Apache Airflow 3.4.0 or later, which restricts these stack traces to users with the new IMPORTERRORSALL permission.

Affected Software

1 affected component

Apache Airflow<3.4.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Airflow to a version that resolves this vulnerability.
Fixed in 3.4.0

Event History

Nov 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

DescriptionWeakness

Data Sourced

via NVD·10:17 AM

DescriptionWeakness

Frequently Asked Questions

Which users can retrieve the exposed stack traces?

Any user granted the ImportError.can_read permission can retrieve raw parse-failure stack traces for an affected file when that file has no registered DAG. In affected releases, access is not further restricted based on per-file DAG permissions.

When is a file affected by the missing per-file authorization check?

The issue applies when a file fails to parse before defining any DAG, or when all DAGs previously registered from that file have been removed while its parse error remains. Files with no registered DAG are the condition that causes the incomplete authorization enforcement.

What information could be disclosed?

The Import Errors API returns the raw parse-failure stack trace. These traces may reveal file paths and source-code details to users who should not be able to view the failing file's details.

What remediation is available?

Upgrade to Apache Airflow 3.4.0 or later. That version restricts these stack traces to users with the new IMPORT_ERRORS_ALL permission.

CVE-2026-40913: Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcement

Affected Software

Remediation

Event History

Frequently Asked Questions

Which users can retrieve the exposed stack traces?

When is a file affected by the missing per-file authorization check?

What information could be disclosed?

What remediation is available?

Company

Resources

Contact

Frequently Asked Questions

Which users can retrieve the exposed stack traces?

When is a file affected by the missing per-file authorization check?

What information could be disclosed?

What remediation is available?