CVE-2026-41014: Apache Airflow has a Missing Authorization issue

June 1, 2026 (updated July 9, 2026)

The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization. An authenticated UI/API user with global Asset:read permission could enumerate partition run state, schedule configuration, and asset wiring for Dags they were not authorized to read. Affects deployments that rely on per-Dag read scoping while granting users broader Asset access. Users are advised to upgrade to apache-airflow 3.2.2 or later.

References

github.com/advisories/GHSA-x2x7-p37c-43cr
github.com/apache/airflow/pull/65344
github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-182.yaml
lists.apache.org/thread/12nbzwwby7g883w2j13gn7ny1545xob9
nvd.nist.gov/vuln/detail/CVE-2026-41014

Code Behaviors & Features

Detect and mitigate CVE-2026-41014 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →