CVE-2026-26929 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache Airflow deployments should assess exposure and prioritize upgrading to Apache Airflow 3.1.8 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify current Apache Airflow version and exposure, and adjust authorization settings for DAGs accordingly.

Why it matters

CVE-2026-26929 is a vulnerability in Apache Airflow's FastAPI DagVersion listing API that allows unauthorized access to DAG version metadata. Defenders should verify exposure, prioritize upgrades, and adjust authorization settings.

• Potential unauthorized access to DAG version metadata
• Possible exposure of sensitive information in DAGs
• Need for verification of current Apache Airflow version and exposure
• Prioritization of upgrades to Apache Airflow 3.1.8 or later

Technical summary

Apache Airflow versions 3.0.0 through 3.1.7 have a vulnerability in the FastAPI DagVersion listing API. When a request is made with dag_id set to '~' (wildcard for all DAGs), the API does not apply per-DAG authorization filtering. As a result, version metadata of DAGs that the requester is not authorized to access is returned. This vulnerability allows unauthorized access to DAG version metadata, potentially exposing sensitive information in DAGs. Defenders should prioritize verifying exposure and upgrading to Apache Airflow 3.1.8 or later.

Defensive priority

Defenders should prioritize verifying exposure and upgrading to Apache Airflow 3.1.8 or later.

Recommended defensive actions

• Verify Apache Airflow version and exposure to the vulnerability
• Upgrade to Apache Airflow 3.1.8 or later
• Review and adjust authorization settings for DAGs
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Apache Airflow versions 3.0.0 through 3.1.7. The FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to '~' (wildcard for all DAGs). This allows unauthorized access to version metadata of DAGs that the requester is not authorized to access. Defenders should verify exposure and prioritize upgrades to Apache Airflow 3.1.8 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.