Vulnerability · low
Airflow Import Errors API leaks DAG stack traces (CVE-2026-40913)
Tier C · Keep an eye on it – Check if you’re affected
Who’s exposed: Airflow users with ImportError.can_read on affected DAG files
Tier C because: Hits tech teams
Reach
Attack
Damage
Fix
Popular tool
What to do
- Upgrade Apache Airflow to 3.4.0 or later
The Brief
- Apache Airflow's public Import Errors API returns raw DAG parse-failure stack traces to users holding the ImportError.can_read permission when the failing file lacks complete per-file RBAC enforcement.
- Affected versions are Apache Airflow before 3.4.0, and the source rates the severity as low.
Why it matters
Stack traces from DAG files can expose internal code paths and details to users who should not see them, so teams running affected Airflow versions should plan to upgrade.
The checklist behind the tier
Checklist · 2 of 10 yes
| Yes | Hits tech teams | Airflow is a workflow orchestration platform that data and engineering teams run and build on. |
| No | Core infrastructure | A single workflow framework, not core infrastructure like OpenSSH, the Linux kernel, or GitHub. |
| Yes | Popular tool | Apache Airflow is a widely used mainstream data orchestration tool. |
| No | Exploited in the wild | Open Source Security post describes the flaw; no source reports observed attacks. |
| No | Public exploit | Open Source Security: advisory describes the flaw; no source says exploit code or PoC is published. |
| No | Remote, no login | Open Source Security: exploitation requires the ImportError.can_read permission, so an account is needed. |
| No | Full takeover | Open Source Security: flaw is unauthorized disclosure of stack traces, not code execution or privilege escalation. |
| No | Secrets exposed | Open Source Security: stack traces leaked to unauthorized users; no source says credentials, configs or source code were exposed. |
| No | Supply chain | Open Source Security: a normal access-control bug in legitimate code; no malicious code shipped. |
| No | No fix yet | Open Source Security: affected versions are before 3.4.0, implying a fixed release exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
- Exploited
- Not in CISA’s exploited catalog
Timeline
Vulnerability disclosed on oss-security by Rahul Vats
Open Source Security
CVE-2026-40913: Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcement
Source
CVE-2026-40913: Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcement ↗ Open Source Security · 2h ago
First seen · 1 source · Full story page · How tiers are decided