affected:
- package:
    ecosystem: PyPI
    name: apache-airflow
    purl: pkg:pypi/apache-airflow
  ranges:
  - events:
    - introduced: 3.0.0
    - fixed: 3.1.8
    type: ECOSYSTEM
  versions:
  - 3.0.0
  - 3.0.1
  - 3.0.1rc1
  - 3.0.2
  - 3.0.2rc1
  - 3.0.2rc2
  - 3.0.3
  - 3.0.3rc1
  - 3.0.3rc2
  - 3.0.3rc3
  - 3.0.3rc4
  - 3.0.3rc5
  - 3.0.3rc6
  - 3.0.4
  - 3.0.4rc1
  - 3.0.4rc2
  - 3.0.5
  - 3.0.5rc1
  - 3.0.5rc2
  - 3.0.5rc3
  - 3.0.6
  - 3.0.6rc1
  - 3.0.6rc2
  - 3.1.0
  - 3.1.0b1
  - 3.1.0b2
  - 3.1.0rc1
  - 3.1.0rc2
  - 3.1.1
  - 3.1.1rc1
  - 3.1.1rc2
  - 3.1.2
  - 3.1.2rc1
  - 3.1.2rc2
  - 3.1.3
  - 3.1.3rc1
  - 3.1.4
  - 3.1.4rc1
  - 3.1.4rc2
  - 3.1.5
  - 3.1.5rc1
  - 3.1.6
  - 3.1.6rc1
  - 3.1.7
  - 3.1.7rc1
  - 3.1.7rc2
  - 3.1.8rc1
  - 3.1.8rc2
aliases:
- CVE-2026-26929
- GHSA-4m3h-wp5w-5hqh
details: "Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API
  does not apply per-DAG authorization filtering when the request is made with dag_id
  set to \"~\" (wildcard for all DAGs). As a result, version metadata of DAGs that
  the requester is not authorized to access is returned.\n\n\nUsers are recommended
  to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue."
id: PYSEC-2026-14
modified: '2026-05-20T09:18:52.919417Z'
published: '2026-03-17T11:16:11.490Z'
references:
- type: ADVISORY
  url: http://www.openwall.com/lists/oss-security/2026/03/17/4
- type: ADVISORY
  url: https://lists.apache.org/thread/g5o6khx83jwqvdyn0mlyb0krt35cs9ss
- type: REPORT
  url: https://github.com/apache/airflow/pull/61675
- type: ADVISORY
  url: https://github.com/advisories/GHSA-4m3h-wp5w-5hqh
severity:
- score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
  type: CVSS_V3