Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. `GET /api/v2/dagSources/{dag_id}` — and the equivalent Dag-source view in the UI — returned the entire source file without redacting Dags the caller was not authorized to read, bypassing per-DAG read authorization. Deployments that co-locate multiple Dags in a single file and rely on per-DAG access control to limit source visibility are affected; single-Dag-per-file deployments are not. Upgrade to apache-airflow 3.3.0 or later.
References
| Link | Resource |
|---|---|
| https://github.com/apache/airflow/pull/67662 | Issue Tracking Patch |
| https://lists.apache.org/thread/qqv41t3oydkn9o14r2rfz1wkdrsp5jzn | Vendor Advisory Mailing List |
| http://www.openwall.com/lists/oss-security/2026/07/07/5 | Third Party Advisory Mailing List |
Configurations
History
08 Jul 2026, 20:04
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Apache
Apache airflow |
|
| CPE | cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* | |
| References | () https://github.com/apache/airflow/pull/67662 - Issue Tracking, Patch | |
| References | () https://lists.apache.org/thread/qqv41t3oydkn9o14r2rfz1wkdrsp5jzn - Vendor Advisory, Mailing List | |
| References | () http://www.openwall.com/lists/oss-security/2026/07/07/5 - Third Party Advisory, Mailing List |
07 Jul 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
07 Jul 2026, 13:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
07 Jul 2026, 10:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-07-07 10:16
Updated : 2026-07-08 20:04
NVD link : CVE-2026-49296
Mitre link : CVE-2026-49296
CVE.ORG link : CVE-2026-49296
JSON object : View
Products Affected
apache
- airflow
CWE
CWE-639
Authorization Bypass Through User-Controlled Key