CVE-2026-26929: Apache Airflow Wildcard DAG Authorization Bypass Vulnerability
Summary
CVE-2026-26929: Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). Affects apache-airflow versions >= 3.0.0, < 3.1.8. Fixed in 3.1.8. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2026-26929 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. It is widely used for orchestrating complex data pipelines and managing task dependencies. The platform supports various integrations and provides a rich user interface for monitoring and managing workflows. However, certain versions of Apache Airflow are vulnerable to a security issue that affects the authorization mechanism for accessing DAG version metadata.
Vulnerability Detail
Apache Airflow versions 3.0.0 through 3.1.7 have a vulnerability in the FastAPI DagVersion listing API. When a request is made with the dag_id set to '~', which acts as a wildcard for all DAGs, the API fails to enforce per-DAG authorization filtering. This oversight allows unauthorized users to access version metadata of DAGs they should not have permission to view, potentially exposing sensitive information and leading to unauthorized access to workflow details.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.8
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==3.1.8"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the API or implement additional authorization checks in their application logic until the upgrade is completed.
Conclusion
The vulnerability identified as CVE-2026-26929 in Apache Airflow poses a significant risk by allowing unauthorized access to DAG version metadata. Users are strongly advised to upgrade to version 3.1.8 or later to mitigate this issue. Additionally, temporary workarounds can be implemented to enhance security until the upgrade is completed.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow versions 3.0.0 through 3.1.7 are affected by this vulnerability.
The CVSS score of this vulnerability is 6.5, indicating a medium severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate upgrade is not possible, consider implementing additional authorization checks or restricting access to the API as a temporary workaround.
More information can be found in the official advisory and the Apache Airflow GitHub repository.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
