PUBLISHED
2026-03-17 11:16
MODIFIED
2026-03-17 11:16
EPSS (Prob. Exploit)
0.70%
Top 47.4%
> DESCRIPTION
Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authorized to view.
Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-732: Incorrect Permission Assignment for Critical Resource - The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
> GITHUB SECURITY ADVISORY
GHSA-x3fv-96qh-67m7
MODERATE
Apache Airflow: DAG authorization bypass
AFFECTED PACKAGES:
PIP / apache-airflow
>= 3.0.0, < 3.1.8
Fixed in: 3.1.8
> HISTORIQUE DES MODIFICATIONS
Première apparition
17/03/2026 11:16
Source: NVD
📊
ENRICHISSEMENT
01/04/2026 06:02
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-732: Incorrect Permission Assignment for Critical Resource - The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by uninten...
Total des modifications: 1
Dernière mise à jour: 7 months ago