[<prev] [next>] [day] [month] [year] [list]
Message-ID: <c57d505b-6033-7f6e-9bca-455d006c68ee@apache.org>
Date: Mon, 09 Feb 2026 09:49:08 +0000
From: Ephraim Anierobi <ephraimanierobi@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-24098: Apache Airflow: Assigning single DAG permission
leaked all DAGs Import Errors
Severity: low
Affected versions:
- Apache Airflow (apache-airflow) before 3.1.7
Description:
Apache Airflow versions before 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to.
Users are advised to upgrade to 3.1.7 or later, which resolves this issue
Credit:
Saurabh (finder)
References:
https://github.com/apache/airflow/pull/60801
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-24098
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
