Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authorized to view.
Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 17 Mar 2026 11:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authorized to view. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue. | |
| Title | Apache Airflow: DAG authorization bypass | |
| Weaknesses | CWE-732 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: apache
Published:
Updated: 2026-03-17T10:54:57.439Z
Reserved: 2026-03-01T12:53:02.570Z
Link: CVE-2026-28563
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-03-17T11:16:11.647
Modified: 2026-03-17T11:16:11.647
Link: CVE-2026-28563
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses