https://seclists.org/oss-sec/2026/q2/62: CVE-2026-34538: Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposu)
Published Apr 9, 2026
·Updated
Affected Software
1 affected component
Apache Apache Airflow>=3.0.0<=3.1.8
Frequently Asked Questions
1
What is the severity of CVE-2026-34538?
The severity of CVE-2026-34538 is classified as low.
2
Which versions of Apache Airflow are affected by CVE-2026-34538?
Apache Airflow versions 3.0.0 through 3.1.8 are affected by CVE-2026-34538.
3
What vulnerability does CVE-2026-34538 describe?
CVE-2026-34538 describes an authorization bypass in the DagRun wait endpoint that exposes XCom result values improperly to users with limited permissions.
4
How do I fix CVE-2026-34538?
To mitigate CVE-2026-34538, upgrade Apache Airflow to version 3.2.0 or later.
5
What is the impact of CVE-2026-34538 on user roles in Apache Airflow?
CVR-2026-34538 allows users with only DAG Run read permissions, such as the Viewer role, to access XCom result values they should not have access to.