Apache Airflow Import Errors API leaks stack traces (CVE-2026-40913)
Original title: CVE-2026-40913: Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcement
The Import Errors API exposes raw parse-failure stack traces to users with ImportError.can_read permission in Apache Airflow before 3.4.0.
Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the ImportError.can_read permission when the failing file has no registered DAG. This occurs when a file fails to parse before any DAG is defined or when previously registered DAGs are removed but the parse error remains.
- Apache Airflow before 3.4.0 affected
- Incomplete Per-File RBAC Enforcement
- Leaked via Import Errors API
Impact: unauthorized access to parse-failure stack traces
- 1.Upgrade to Apache Airflow 3.4.0 or later
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-40913 | Apache Airflow Import Errors API Leaks Unauthorized DAG Stack Traces | — | — |
From the original article
Posted by Rahul Vats on Nov 08 Severity: low Affected versions: - Apache Airflow before 3. 4. 0 Description: Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the `ImportError.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.