Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Apache Airflow, Apache Airflow 3.0.0, 3.2.1 Clear all filters
TI-2026-28200 CVE-2026-38743 · GHSA-p3v3-229h-mc63

Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities

Priority LOW 20

The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance records: a logged-in Airflow user with read access to at least one DAG could retrieve HITL…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00352 Published 2026-04-24 Fixed in 3.0.0, 3.2.1 +1 CWE-1220
TI-2026-29374 CVE-2026-40690 · GHSA-w7rc-q6cm-f5gm

Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated…

Priority LOW 20

The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment and learn the existen…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00352 Published 2026-04-24 Fixed in 3.0.0, 3.2.1 +1 CWE-1220