dagster-io CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH dagster-io CVE published 2026-05-07

CVE-2026-41490

CVE-2026-41490 is a high-severity vulnerability in the Dagster orchestration platform that allows for SQL injection attacks. A user with the Add Dynamic Partitions permission can create a partition key that injects arbitrary SQL, which would execute against the target database backend under the I/O manager's credentials. This issue has been patched in Dagster Core version 1.13.1 and Dagster libraries version 0.29.1.