affected:
- package:
    ecosystem: PyPI
    name: apache-airflow
    purl: pkg:pypi/apache-airflow
  ranges:
  - events:
    - introduced: 3.0.0
    - fixed: 3.1.7
    type: ECOSYSTEM
  versions:
  - 3.0.0
  - 3.0.1
  - 3.0.1rc1
  - 3.0.2
  - 3.0.2rc1
  - 3.0.2rc2
  - 3.0.3
  - 3.0.3rc1
  - 3.0.3rc2
  - 3.0.3rc3
  - 3.0.3rc4
  - 3.0.3rc5
  - 3.0.3rc6
  - 3.0.4
  - 3.0.4rc1
  - 3.0.4rc2
  - 3.0.5
  - 3.0.5rc1
  - 3.0.5rc2
  - 3.0.5rc3
  - 3.0.6
  - 3.0.6rc1
  - 3.0.6rc2
  - 3.1.0
  - 3.1.0b1
  - 3.1.0b2
  - 3.1.0rc1
  - 3.1.0rc2
  - 3.1.1
  - 3.1.1rc1
  - 3.1.1rc2
  - 3.1.2
  - 3.1.2rc1
  - 3.1.2rc2
  - 3.1.3
  - 3.1.3rc1
  - 3.1.4
  - 3.1.4rc1
  - 3.1.4rc2
  - 3.1.5
  - 3.1.5rc1
  - 3.1.6
  - 3.1.6rc1
  - 3.1.7rc1
  - 3.1.7rc2
aliases:
- CVE-2026-24098
- GHSA-5g2w-9f8g-g5q7
details: "Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated
  UI users with permission to one or more specific Dags to view import errors generated
  by other Dags they did not have access to. \n\nUsers are advised to upgrade to 3.1.7
  or later, which resolves this issue"
id: PYSEC-2026-12
modified: '2026-05-20T09:18:52.793450Z'
published: '2026-02-09T11:16:14.660Z'
references:
- type: ADVISORY
  url: http://www.openwall.com/lists/oss-security/2026/02/09/3
- type: ADVISORY
  url: https://lists.apache.org/thread/nx96435v77xdst7ls5lk57kqvqyj095x
- type: FIX
  url: https://github.com/apache/airflow/pull/60801
- type: ADVISORY
  url: https://github.com/advisories/GHSA-5g2w-9f8g-g5q7
severity:
- score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
  type: CVSS_V3