CVE-2026-41014: Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints
The partitioneddagruns endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization. An authenticated UI/API user with global Asset:read permission could enumerate partition run state, schedule configuration, and asset wiring for Dags they were not authorized to read. Affects deployments that rely on per-Dag read scoping while granting users broader Asset access. Users are advised to upgrade to apache-airflow 3.2.2 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache-airflowto a version that resolves this vulnerability.Fixed in 3.2.2Patch CVE-2026-41014
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41014?
The severity of CVE-2026-41014 is medium with a CVSS score of 4.3.
What does CVE-2026-41014 affect?
CVE-2026-41014 affects the Apache Airflow application specifically related to per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints.
How do I fix CVE-2026-41014?
To fix CVE-2026-41014, apply the available patch provided by Apache for Airflow.
What type of vulnerability is CVE-2026-41014?
CVE-2026-41014 is a bypass vulnerability that allows unauthorized access to partition run state and configurations.
Who is affected by CVE-2026-41014?
Authenticated users with global Asset:read permission in Apache Airflow may be affected by CVE-2026-41014.