CVE-2026-28563 Apache CVE debrief

Who should care

Defenders responsible for Apache Airflow deployments should assess exposure and prioritize upgrading to version 3.1.8 or later to prevent unauthorized DAG enumeration. Security teams and operators managing Apache Airflow instances need to verify their deployments' exposure to this vulnerability and plan for necessary upgrades or mitigations. Additionally, teams responsible for monitoring and incident response should be aware of potential exploitation and做好

Why it matters

CVE-2026-28563 allows authenticated users with DAG Dependencies permission to enumerate DAGs they are not authorized to view in Apache Airflow versions 3.1.0 through 3.1.7. Defenders should verify exposure and prioritize upgrading to version 3.1.8 or later.

• Potential enumeration of unauthorized DAGs by authenticated users with DAG Dependencies permission
• Verification of Apache Airflow deployments for exposure to this vulnerability
• Upgrade to Apache Airflow 3.1.8 or later to resolve the issue

Technical summary

The /ui/dependencies endpoint in Apache Airflow versions 3.1.0 through 3.1.7 returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authorized to view. The vulnerability arises from insufficient filtering of DAGs based on user permissions, potentially leading to unauthorized information disclosure. Affected deployments should assess their exposure and consider upgrading to Apache Airflow 3.1.8 or later.

Defensive priority

Defenders should prioritize verifying exposure of Apache Airflow deployments to unauthorized DAG enumeration and upgrading to version 3.1.8 or later.

Recommended defensive actions

• Verify Apache Airflow deployments for exposure to unauthorized DAG enumeration
• Upgrade to Apache Airflow 3.1.8 or later
• Monitor for authenticated users with DAG Dependencies permission
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Apache Airflow versions 3.1.0 through 3.1.7. The /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs, allowing authenticated users with DAG Dependencies permission to enumerate DAGs they are not authorized to view.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.