CVE-2026-40913: Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcement

The Brief

Apache Airflow's public Import Errors API returns raw DAG parse-failure stack traces to users holding the ImportError.can_read permission when the failing file lacks complete per-file RBAC enforcement.
Affected versions are Apache Airflow before 3.4.0, and the source rates the severity as low.

Why it matters

Stack traces from DAG files can expose internal code paths and details to users who should not see them, so teams running affected Airflow versions should plan to upgrade.

Who’s affected

Apache Airflow users running versions before 3.4.0
Teams that grant ImportError.can_read permission to users

What to do

Upgrade Apache Airflow to 3.4.0 or later

Apache Airflow 3.4.0
CVE-2026-40913
#airflow
#security
#rbac
#api
#cve-2026-40913
#apache

Posted by Rahul Vats on Nov 08 Severity: low Affected versions: - Apache Airflow before 3.4.0 Description: Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the `ImportError.can_read` permission when the failing file has no…

Read the full story at seclists.org ↗

Timeline

Nov 8
Vulnerability disclosed on oss-security by Rahul Vats
Nov 9 · 5:59 AM
Open Source Security
CVE-2026-40913: Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcement