Medium severity6.5NVD Advisory· Published Feb 9, 2026· Updated Jun 17, 2026
CVE-2026-24098
CVE-2026-24098
Description
Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to.
Users are advised to upgrade to 3.1.7 or later, which resolves this issue
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
apache-airflowPyPI | < 3.1.7 | 3.1.7 |
Affected products
4- osv-coords2 versions
< 3.1.7+ 1 more
- (no CPE)range: < 3.1.7
- (no CPE)range: < 3.1.7
Patches
Vulnerability mechanics
References
5- github.com/apache/airflow/pull/60801nvdIssue TrackingPatchWEB
- www.openwall.com/lists/oss-security/2026/02/09/3nvdMailing ListThird Party AdvisoryWEB
- github.com/advisories/GHSA-5g2w-9f8g-g5q7ghsaADVISORY
- lists.apache.org/thread/nx96435v77xdst7ls5lk57kqvqyj095xnvdMailing ListVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-24098ghsaADVISORY
News mentions
0No linked articles in our index yet.