Threats affecting pkg:github/apache/airflow

CVE-2026-40690 is a medium severity vulnerability in Apache Airflow where the asset dependency graph does not properly restrict visibility based on a user's DAG read permissions. This allows a user with read access to at least one DAG to view the existence and names of other DAGs and assets outside their authorized scope. The issue does not allow modification or denial of service, only limited information disclosure. Users are recommended to upgrade to Apache Airflow version 3.2.1, which addresses this issue.

Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked. If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to Apache Airflow 3.2.0 that has the fix implemented

Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url. This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itself. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.