PUBLISHED
2026-02-09 11:16
MODIFIED
2026-02-09 11:16
EPSS (Prob. Exploit)
0.83%
Top 42.9%
> DESCRIPTION
Apache Airflow versions before 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to.
Users are advised to upgrade to 3.1.7 or later, which resolves this issue
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor - The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
> GITHUB SECURITY ADVISORY
GHSA-5g2w-9f8g-g5q7
MODERATE
Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated Users
AFFECTED PACKAGES:
PIP / apache-airflow
< 3.1.7
Fixed in: 3.1.7
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
AFFECTED PACKAGES:
Unknown / Unknown
34 versions affected
ALIASES:
BIT-airflow-2026-24098, GHSA-5g2w-9f8g-g5q7
> HISTORIQUE DES MODIFICATIONS
Première apparition
09/02/2026 11:16
Source: NVD
📊
ENRICHISSEMENT
01/03/2026 06:46
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor - The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Total des modifications: 1
Dernière mise à jour: 8 months ago