CVE-2026-34538 Details
Description
Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security model documentation that defines the Viewer role as read-only. Airflow uses the FAB Auth Manager to manage access control on a per-resource basis. The Viewer role is intended to be read-only by default, and the security model documentation defines Viewer users as those who can inspect DAGs without accessing sensitive execution results. Users are recommended to upgrade to Apache Airflow 3.2.0 which resolves this issue.
A vulnerability in Apache Airflow versions 3.0.0 prior to 3.2.0 allows an authorization bypass in the DagRun wait endpoint, where XCom result values are exposed to users with only DAG Run read permissions, such as those in the Viewer role. This issue contradicts the FAB RBAC model, which considers XCom a separate protected resource, and the security model documentation that designates the Viewer role as read-only. The vulnerability arises because Airflow's access control, managed by the FAB Auth Manager, fails to properly restrict XCom access for users with limited permissions.
Users are advised to upgrade to Apache Airflow 3.2.0, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/04/09/9 | CVE | Mailing ListThird Party Advisory |
| https://github.com/apache/airflow/pull/64415 | [email protected] | Broken LinkIssue Tracking |
| https://lists.apache.org/thread/9mq3msqhmgjwdzbr6bgthj4brb3oz9fl | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-668 | Exposure of Resource to Wrong Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache airflow | >= 3.0.0, < 3.2.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 15, 2026 | Initial Analysis | [email protected] |
| Apr 9, 2026 | CVE Modified | CISA-ADP |
| Apr 9, 2026 | CVE Modified | CVE |
| Apr 9, 2026 | New CVE Received | [email protected] |