PatchSiren cyber security CVE debrief
CVE-2026-40963 Apache Software Foundation CVE debrief
An authorization bypass in Apache Airflow's structure_data endpoint allows authenticated users to enumerate linked DAG IDs and dependency metadata for DAGs they lack read permission to access. The endpoint returns external dependency graph nodes without verifying read permissions on linked DAGs, undermining per-DAG access controls in multi-team deployments.
- Vendor
- Apache Software Foundation
- Product
- Apache Airflow
- CVSS
- LOW 3.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-01
- Original CVE updated
- 2026-07-21
- Advisory published
- 2026-06-01
- Advisory updated
- 2026-07-21
Who should care
Organizations running Apache Airflow with multi-team deployments using per-DAG access controls to protect DAG dependency topology confidentiality
Technical summary
The structure_data endpoint in the Airflow UI constructs dependency graphs that include external nodes representing linked DAGs. The endpoint fails to check whether the authenticated caller possesses read permission on those linked DAGs before returning their identifiers and dependency metadata. An attacker with legitimate access to at least one DAG can therefore enumerate the existence and relationships of other DAGs in the deployment. This vulnerability specifically affects organizations that rely on per-DAG read scoping to isolate DAG dependency topology between teams. The weakness is classified as CWE-285 (Improper Authorization). Remediation is available in apache-airflow version 3.2.2 and later.
Defensive priority
medium
Recommended defensive actions
- Upgrade to apache-airflow 3.2.2 or later
- Review Airflow deployment access logs for unauthorized structure_data endpoint queries accessing linked DAG dependency graphs
- Validate that per-DAG read scoping controls are enforced across all UI/API endpoints that return cross-DAG metadata
- Audit DAG dependency topology exposure for sensitive workflow relationships in multi-team environments
Evidence notes
CWE-285 (Improper Authorization) assigned by [email protected]. Fix pull request and Apache security mailing list discussion referenced in NVD record. Vendor attribution to Apache based on reference_domain_candidate evidence with low confidence; needs review.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-40963 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-40963
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-40963 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-40963
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://github.com/apache/airflow/pull/65342
-
Source reference
Unverified legacy reference
URL: https://lists.apache.org/thread/s907bhsksc37m59f0loqjcp1ryobrr60
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.