CVE-2026-28563 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows…
Medium CVSS: 4.3

CVE-2026-28563

Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authorized to view.


Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
Vendor
Apache
Product
Airflow
CWE
CWE-732
Yayın Tarihi
2026-03-17 11:16:11
Güncelleme
2026-03-17 17:42:05
Source Identifier
security@apache.org
KEV Date Added
-

Kategoriler

CWE-732 Airflow MEDIUM Apache 2026

Referanslar

https://github.com/apache/airflow/pull/62046 https://lists.apache.org/thread/dwzf62qg9z8wvfsjknpfd8bvtwghd49s http://www.openwall.com/lists/oss-security/2026/03/17/5