Vulnerability in Apache Software Foundation Airflow

CVE-2026-28563

Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs…

EPSS: 0.000 (11.1th percentile) — read the EPSS interpretation.