https://seclists.org/oss-sec/2026/q3/79: CVE-2026-49296: Apache Airflow: Per-DAG ad bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id}
Published Jul 7, 2026
·Updated
Affected Software
1 affected component
Apache Airflow<3.3.0
Frequently Asked Questions
1
What is the severity of CVE-2026-49296?
The severity of CVE-2026-49296 is low.
2
Which versions of Apache Airflow are affected by CVE-2026-49296?
CVE-2026-49296 affects Apache Airflow versions from 3.0.0 before 3.3.0.
3
What does CVE-2026-49296 allow a user to do?
CVE-2026-49296 allows a user authorized to read one DAG to disclose the source of other co-located DAGs.
4
How do I fix CVE-2026-49296?
To fix CVE-2026-49296, upgrade Apache Airflow to version 3.3.0 or later.
5
What API endpoint is involved in CVE-2026-49296?
The API endpoint involved in CVE-2026-49296 is GET /api/v2/dagSources/{dag_id}.