PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-40963 Apache Software Foundation CVE debrief

An authorization bypass in Apache Airflow's structure_data endpoint allows authenticated users to enumerate linked DAG IDs and dependency metadata for DAGs they lack read permission to access. The endpoint returns external dependency graph nodes without verifying read permissions on linked DAGs, undermining per-DAG access controls in multi-team deployments.

Vendor
Apache Software Foundation
Product
Apache Airflow
CVSS
LOW 3.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-07-21
Advisory published
2026-06-01
Advisory updated
2026-07-21

Who should care

Organizations running Apache Airflow with multi-team deployments using per-DAG access controls to protect DAG dependency topology confidentiality

Technical summary

The structure_data endpoint in the Airflow UI constructs dependency graphs that include external nodes representing linked DAGs. The endpoint fails to check whether the authenticated caller possesses read permission on those linked DAGs before returning their identifiers and dependency metadata. An attacker with legitimate access to at least one DAG can therefore enumerate the existence and relationships of other DAGs in the deployment. This vulnerability specifically affects organizations that rely on per-DAG read scoping to isolate DAG dependency topology between teams. The weakness is classified as CWE-285 (Improper Authorization). Remediation is available in apache-airflow version 3.2.2 and later.

Defensive priority

medium

Recommended defensive actions

  • Upgrade to apache-airflow 3.2.2 or later
  • Review Airflow deployment access logs for unauthorized structure_data endpoint queries accessing linked DAG dependency graphs
  • Validate that per-DAG read scoping controls are enforced across all UI/API endpoints that return cross-DAG metadata
  • Audit DAG dependency topology exposure for sensitive workflow relationships in multi-team environments

Evidence notes

CWE-285 (Improper Authorization) assigned by [email protected]. Fix pull request and Apache security mailing list discussion referenced in NVD record. Vendor attribution to Apache based on reference_domain_candidate evidence with low confidence; needs review.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-40963 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-40963

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-40963 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-40963

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.