CVE-2026-40963: CWE-285: Improper Authorization in Apache Software Foundation Apache Airflow
Apache Airflow version 3.0.0 has an improper authorization vulnerability in the structure_data endpoint of its UI. This flaw allows authenticated users with read access to one DAG to enumerate linked DAG IDs and dependency metadata for other DAGs they are not authorized to access. This issue affects deployments that rely on per-DAG read scoping to maintain privacy of DAG dependency topology across teams. Users are advised to upgrade to Apache Airflow 3.2.2 or later to address this issue.
AI Analysis
Technical Summary
CVE-2026-40963 is an improper authorization vulnerability (CWE-285) in Apache Airflow 3.0.0 where the structure_data endpoint in the Airflow UI returns external dependency graph nodes for linked DAGs without verifying if the caller has read permission on those linked DAGs. As a result, an authenticated user authorized to read one DAG can enumerate linked DAG IDs and dependency metadata for other DAGs they lack authorization to view. This compromises the confidentiality of DAG dependency topology in environments that enforce per-DAG read access controls. The vulnerability has a CVSS v3.1 base score of 3.1 (low severity).
Potential Impact
An authenticated user with read access to a single DAG can gain unauthorized visibility into the existence and dependency metadata of other DAGs they are not permitted to access. This may lead to information disclosure about DAG relationships and topology, potentially exposing sensitive operational details across teams. There is no indication of impact on integrity or availability.
Mitigation Recommendations
A fix is available in Apache Airflow version 3.2.2 and later. Users should upgrade to version 3.2.2 or newer to remediate this vulnerability. No other mitigation or temporary workaround is indicated.
CVE-2026-40963: CWE-285: Improper Authorization in Apache Software Foundation Apache Airflow
Description
Apache Airflow version 3.0.0 has an improper authorization vulnerability in the structure_data endpoint of its UI. This flaw allows authenticated users with read access to one DAG to enumerate linked DAG IDs and dependency metadata for other DAGs they are not authorized to access. This issue affects deployments that rely on per-DAG read scoping to maintain privacy of DAG dependency topology across teams. Users are advised to upgrade to Apache Airflow 3.2.2 or later to address this issue.
CVSS v3.1
Score 3.1low
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-40963 is an improper authorization vulnerability (CWE-285) in Apache Airflow 3.0.0 where the structure_data endpoint in the Airflow UI returns external dependency graph nodes for linked DAGs without verifying if the caller has read permission on those linked DAGs. As a result, an authenticated user authorized to read one DAG can enumerate linked DAG IDs and dependency metadata for other DAGs they lack authorization to view. This compromises the confidentiality of DAG dependency topology in environments that enforce per-DAG read access controls. The vulnerability has a CVSS v3.1 base score of 3.1 (low severity).
Potential Impact
An authenticated user with read access to a single DAG can gain unauthorized visibility into the existence and dependency metadata of other DAGs they are not permitted to access. This may lead to information disclosure about DAG relationships and topology, potentially exposing sensitive operational details across teams. There is no indication of impact on integrity or availability.
Mitigation Recommendations
A fix is available in Apache Airflow version 3.2.2 and later. Users should upgrade to version 3.2.2 or newer to remediate this vulnerability. No other mitigation or temporary workaround is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-04-16T01:56:58.354Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a1d4e71e29bf47b50cd4967
Added to database: 06/01/2026, 09:18:41 UTC
Last enriched: 07/10/2026, 09:59:41 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 68
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.