Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authorized to view.
Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
References
| Link | Resource |
|---|---|
| https://github.com/apache/airflow/pull/62046 | Issue Tracking Patch |
| https://lists.apache.org/thread/dwzf62qg9z8wvfsjknpfd8bvtwghd49s | Mailing List Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/03/17/5 | Mailing List Third Party Advisory |
Configurations
History
17 Mar 2026, 17:42
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Apache airflow
Apache |
|
| References | () https://github.com/apache/airflow/pull/62046 - Issue Tracking, Patch | |
| References | () https://lists.apache.org/thread/dwzf62qg9z8wvfsjknpfd8bvtwghd49s - Mailing List, Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/03/17/5 - Mailing List, Third Party Advisory | |
| CPE | cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* |
17 Mar 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
17 Mar 2026, 14:20
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
17 Mar 2026, 11:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-17 11:16
Updated : 2026-03-17 17:42
NVD link : CVE-2026-28563
Mitre link : CVE-2026-28563
CVE.ORG link : CVE-2026-28563
JSON object : View
Products Affected
apache
- airflow
CWE
CWE-732
Incorrect Permission Assignment for Critical Resource