CVE-2026-49296 Details
Description
Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. `GET /api/v2/dagSources/{dag_id}` — and the equivalent Dag-source view in the UI — returned the entire source file without redacting Dags the caller was not authorized to read, bypassing per-DAG read authorization. Deployments that co-locate multiple Dags in a single file and rely on per-DAG access control to limit source visibility are affected; single-Dag-per-file deployments are not. Upgrade to apache-airflow 3.3.0 or later.
A vulnerability exists in Apache Airflow versions prior to 3.3.0, where a user authorized to read one Directed Acyclic Graph (DAG) could inadvertently disclose the source of other DAGs located in the same source file. The issue arises because the 'GET /api/v2/dagSources/{dag_id}' endpoint, along with the corresponding DAG-source view in the user interface, delivers the entire source file without redacting DAGs that the user is not authorized to read. This behavior bypasses the intended per-DAG read authorization. The vulnerability affects deployments that combine multiple DAGs in a single file and depend on per-DAG access control to manage source visibility. In contrast, deployments with a single DAG per file are not impacted.
Users are advised to upgrade to Apache Airflow version 3.3.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/07/07/5 | CVE | Mailing ListThird Party Advisory |
| https://github.com/apache/airflow/pull/67662 | [email protected] | Issue TrackingPatch |
| https://lists.apache.org/thread/qqv41t3oydkn9o14r2rfz1wkdrsp5jzn | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache airflow | < 3.3.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | [email protected] |
| Sep 16, 2026 | CVE Modified | CVE |
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | CVE Modified | CVE |
| Jul 7, 2026 | New CVE Received | [email protected] |