CVE-2026-41014

PYSEC-2026-182 · BIT-airflow-2026-41014 · CVE-2026-41014 · GHSA-x2x7-p37c-43cr

Published Jun 1, 2026 · Modified Jul 13, 2026

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization. An authenticated UI/API user with global Asset:read permission could enumerate partition run state, schedule configuration, and asset wiring for Dags they were not authorized to read. Affects deployments that rely on per-Dag read scoping while granting users broader Asset access. Users are advised to upgrade to apache-airflow 3.2.2 or later.

References

ADVISORY http://www.openwall.com/lists/oss-security/2026/05/31/4
ADVISORY https://lists.apache.org/thread/12nbzwwby7g883w2j13gn7ny1545xob9
FIX https://github.com/apache/airflow/pull/65344
ADVISORY https://github.com/advisories/GHSA-x2x7-p37c-43cr

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes

CVE-2026-41014

Description

References

More PyPI vulnerabilities

Start Securing