CVE-2026-40690

The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment and learn the existence and names of DAGs and assets outside their authorized scope. Users are recommended to upgrade to version 3.2.1, which fixes this issue.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/apache/airflow/pull/65273	Issue Tracking Patch
https://lists.apache.org/thread/bqt7y4g2cpj396b0sd20lv510ff19ndl	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/24/4	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) El grafo de dependencia de activos no restringía los nodos por los permisos de lectura de DAG del espectador: un usuario con acceso de lectura a al menos un DAG podía navegar por el grafo de activos para cualquier otro activo en la implementación y conocer la existencia y los nombres de DAGs y activos fuera de su ámbito autorizado. Se recomienda a los usuarios actualizar a la versión 3.2.1, que corrige este problema.

Information

Published : 2026-04-24 13:16

Updated : 2026-11-03 07:19

NVD link : CVE-2026-40690

Mitre link : CVE-2026-40690

CVE.ORG link : CVE-2026-40690

JSON object : View

Products Affected

apache

airflow

CWE

CWE-1220

Insufficient Granularity of Access Control

{"id": "CVE-2026-40690", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40690", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-24T14:54:08.675198Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.0", "versionType": "semver"}], "packageURL": "pkg:pypi/apache-airflow", "packageName": "apache-airflow", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache Airflow", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "3.2.1", "versionType": "semver"}], "packageURL": "pkg:pypi/apache-airflow-core", "packageName": "apache-airflow-core", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}]}], "published": "2026-04-24T13:16:21.443", "references": [{"url": "https://github.com/apache/airflow/pull/65273", "tags": ["Issue Tracking", "Patch"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/bqt7y4g2cpj396b0sd20lv510ff19ndl", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/24/4", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-1220"}]}], "descriptions": [{"lang": "en", "value": "The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment and learn the existence and names of DAGs and assets outside their authorized scope.\n\nUsers are recommended to upgrade to version 3.2.1, which fixes this issue."}, {"lang": "es", "value": "El grafo de dependencia de activos no restring\u00eda los nodos por los permisos de lectura de DAG del espectador: un usuario con acceso de lectura a al menos un DAG pod\u00eda navegar por el grafo de activos para cualquier otro activo en la implementaci\u00f3n y conocer la existencia y los nombres de DAGs y activos fuera de su \u00e1mbito autorizado.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 3.2.1, que corrige este problema."}], "lastModified": "2026-11-03T07:19:49.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EF856E9C-C3C2-44F3-B2B4-0DD0791C512C", "versionEndExcluding": "3.2.1"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}