CVE-2026-49296: Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id}
Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. GET /api/v2/dagSources/{dagid} — and the equivalent Dag-source view in the UI — returned the entire source file without redacting Dags the caller was not authorized to read, bypassing per-DAG read authorization. Deployments that co-locate multiple Dags in a single file and rely on per-DAG access control to limit source visibility are affected; single-Dag-per-file deployments are not. Upgrade to apache-airflow 3.3.0 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache-airflowto a version that resolves this vulnerability.Fixed in 3.3.0 - Compensating control
If multiple DAGs are co-located in a single source file and rely on per-DAG access control to limit source visibility, avoid using per-DAG access control as a sole protection until upgraded; co-locate fewer DAGs per file (e.g., single-DAG-per-file) to prevent disclosure via GET /api/v2/dagSources/{dag_id} (and the equivalent UI dag-source view).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49296?
CVE-2026-49296 has a medium severity rating of 6.5 according to the CVSS 3.1 metrics.
How do I fix CVE-2026-49296?
To mitigate CVE-2026-49296, upgrade to Apache Airflow version 3.3.0 or later.
What does CVE-2026-49296 affect?
CVE-2026-49296 affects the Apache Airflow software, specifically prior to version 3.3.0.
What type of vulnerability is CVE-2026-49296?
CVE-2026-49296 is a read bypass vulnerability that allows unauthorized data disclosure.
What impact does CVE-2026-49296 have on users?
CVE-2026-49296 allows users authorized to read one DAG to access the source of other co-located DAGs, potentially exposing sensitive information.