CVE-2026-26929 Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata
Attackers can bypass per-DAG RBAC to view unauthorized DAG version metadata via the FastAPI listing endpoint.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-26929?
CVE-2026-26929 is a medium-severity missing authorization vulnerability in Apache Airflow, published on 17 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). As a result, version metadata of DAGs that the requester is not authorized to access is returned.
Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
Weakness: CWE-732
Which versions are affected by CVE-2026-26929?
4 open source packages ship an affected version, including apache-airflow and airflow. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apache-airflow PyPI | From 3.0.0 | 3.1.8 |
apache-airflow PyPI | From 3.0.0 | 3.1.8 |
apache-airflow PyPI | From 3.0.0 | 3.1.8 |
airflow Bitnami | From 3.0.0 | 3.1.8 |
Products include Apache Airflow.
How do I fix CVE-2026-26929?
Upgrade apache-airflow to 3.1.8 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-26929 being exploited?
There is no known exploitation of CVE-2026-26929 in the wild and no public exploit code.
Other vulnerabilities in Apache Airflow
- CVE-2020-13927 Apache Airflow's Experimental API Authentication Bypass
- CVE-2020-11978 Apache Airflow Command Injection
- CVE-2026-33264 Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()
- CVE-2023-25754 Apache Airflow: Privilege escalation using airflow logs
- CVE-2023-22884 Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow
Sources
Also known as BIT-airflow-2026-26929, ECHO-5261-4f07-492a, GHSA-4m3h-wp5w-5hqh, MINI-vx26-p683-cjgp, PYSEC-2026-14.