Vulnerability in Apache Software Foundation Airflow
CVE-2026-38743
The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance records: a logged-in Airflow user with read access to at least one DAG could retrieve HITL prompts (including…
EPSS: 0.001 (20.4th percentile) — read the EPSS interpretation.
Affected products
- Apache Software Foundation Airflow — versions 0
Weakness classification (CWE)
References
- github.com/apache/airflow/pull/64822 (patch)
- lists.apache.org/thread/sk2wj0x48o8qb4p7c47gvnhjbm0mg396 (vendor-advisory)