Moderate severityNVD Advisory· Published Feb 9, 2026· Updated Mar 10, 2026
Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors
CVE-2026-24098
Description
Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to.
Users are advised to upgrade to 3.1.7 or later, which resolves this issue
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
apache-airflowPyPI | < 3.1.7 | 3.1.7 |
Affected products
3- osv-coords2 versions
< 3.1.7+ 1 more
- (no CPE)range: < 3.1.7
- (no CPE)range: < 3.1.7
Patches
Vulnerability mechanics
References
5- github.com/apache/airflow/pull/60801ghsapatchWEB
- github.com/advisories/GHSA-5g2w-9f8g-g5q7ghsaADVISORY
- lists.apache.org/thread/nx96435v77xdst7ls5lk57kqvqyj095xghsavendor-advisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-24098ghsaADVISORY
- www.openwall.com/lists/oss-security/2026/02/09/3ghsaWEB
News mentions
0No linked articles in our index yet.