CVE-2026-24098

MEDIUM6.5EPSS 0.01%

Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors

Published: 2/9/2026Modified: 5/20/2026

Also known as:GHSA-5g2w-9f8g-g5q7BIT-airflow-2026-24098PYSEC-2026-12

Description

Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. Users are advised to upgrade to 3.1.7 or later, which resolves this issue

Affected packages (3)

Bitnami/airflowfrom 0, < 3.1.7
PyPI/apache-airflowfrom 0, < 3.1.7
PyPI/apache-airflow>= 3.0.0, < 3.1.7

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References (5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-24098
PATCHhttps://github.com/apache/airflow
WEBhttps://github.com/apache/airflow/pull/60801
WEBhttps://lists.apache.org/thread/nx96435v77xdst7ls5lk57kqvqyj095x
WEBhttp://www.openwall.com/lists/oss-security/2026/02/09/3