Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitylow

Apache Airflow APIs Leak DAG Metadata and Stack Traces

1 source · 3 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Apache Airflow before 3.4.0 leaks parse failures via Import Errors API and exposes unauthorized DAG IDs through asset APIs.

Apache Airflow's Import Errors API returns raw parse-failure stack traces to any user with ImportError.can_read permission when a file fails to parse before DAG registration. Asset API endpoints return scheduled, producing, and consuming DAG IDs without authorization checks. The queued events DELETE API checks edit rights only against the dag_id query parameter before deleting queued events for all readable DAGs. All issues affect versions before 3.4.0 with low severity ratings. Users should upgrade to Apache Airflow 3.4.0.

Key facts
  • Import Errors API leaks stack traces to ImportError.can_read users
  • Asset APIs expose DAG IDs without read permissions
  • Queued events DELETE allows suppressing runs on uneditable DAGs
  • Affects Apache Airflow before 3.4.0
  • Fix requires upgrade to Apache Airflow 3.4.0
  • Severity rated low for asset API issues
Analyze CVE-2026-111453 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Nov 9, 2026oss-security posts CVE-2026-40913 on Import Errors API leak · oss-security
  2. Nov 9, 2026oss-security posts CVE-2026-111453 on asset queued events DELETE authorization flaw · oss-security
  3. Nov 9, 2026oss-security posts CVE-2026-111454 on asset endpoints exposing DAG IDs · oss-security

What each outlet adds

beyond the shared facts
  • oss-securityDetails CVE-2026-40913 Import Errors API stack trace leak
  • oss-securityDetails CVE-2026-111453 asset queued events authorization bypass
  • oss-securityDetails CVE-2026-111454 asset API DAG ID exposure
CVEs
CVE-2026-111453CVE-2026-40913CVE-2026-111454
Vendors
Apache
Products
Apache Airflow

Coverage

oldest first · one row per article · UTC
  1. · 2d ago oss-securityFirst report

    Apache Airflow Import Errors API leaks stack traces (CVE-2026-40913)

    The Import Errors API exposes raw parse-failure stack traces to users with ImportError.can_read permission in Apache Airflow before 3.4.0.

  2. · 2d ago oss-security

    Airflow queued-event delete ignores per-Dag edit checks

    Edit rights on one Dag let a user delete queued asset events for every Dag they can read.

  3. · 2d ago oss-security

    Airflow asset API returns Dag IDs callers cannot read

    Authenticated users with asset read access can learn scheduled, producing, or consuming Dag IDs before 3.4.0.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-111453
+2 related CVEs
CVE-2026-111454CVE-2026-40913
Permission Bypass in Apache Airflow 3.3.2 Asset Queued Events API
4.3
group max
—