PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-41014 Apache Software Foundation CVE debrief

CVE-2026-41014 is an authorization bypass in Apache Airflow's partitioned_dag_runs endpoints, published 2026-06-01. The Airflow UI endpoints enforced only asset-level access control rather than per-DAG authorization. An authenticated UI/API user with global Asset:read permission could enumerate partition run state, schedule configuration, and asset wiring for DAGs they were not authorized to read. This affects deployments that rely on per-DAG read scoping while granting users broader Asset access. The weakness is categorized as CWE-862 (Missing Authorization). Users are advised to upgrade to apache-airflow 3.2.2 or later.

Vendor
Apache Software Foundation
Product
Apache Airflow
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-06-01
Advisory published
2026-06-01
Advisory updated
2026-06-01

Who should care

Apache Airflow administrators using per-DAG access controls with broader Asset permissions, security teams managing data pipeline access governance, and compliance officers responsible for least-privilege enforcement in orchestration platforms.

Technical summary

The partitioned_dag_runs endpoints in Apache Airflow's UI/API failed to enforce per-DAG read authorization, relying solely on asset-level access control. Authenticated users with global Asset:read permission could access partition run state, schedule configuration, and asset wiring for DAGs outside their authorized scope. This represents a missing authorization control (CWE-862) in deployments using per-DAG access scoping. The vulnerability was addressed in apache-airflow 3.2.2.

Defensive priority

medium

Recommended defensive actions

  • Upgrade to apache-airflow 3.2.2 or later to obtain the authorization fix for partitioned_dag_runs endpoints.
  • Review access control policies to ensure Asset:read permissions are not granted more broadly than intended when per-DAG scoping is required.
  • Audit user access logs for unauthorized enumeration of partition run state, schedule configuration, or asset wiring via partitioned_dag_runs endpoints prior to patching.
  • Validate that partitioned_dag_runs endpoints enforce both asset-level and per-DAG authorization after upgrading.

Evidence notes

CVE description states the partitioned_dag_runs endpoints enforced only asset-level access control, not per-DAG authorization. NVD source lists CWE-862. Apache security advisory references confirm fix in pull request and mailing list discussion.

Official resources

2026-06-01