# CVE-2026-40913: Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcement

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/583) · 2026-11-09 · Security
Page: https://themorning.dev/story/cve-2026-40913-apache-airflow-import-errors-api-leaks-unauthorized-dag-stack-tra-4d6df70a5ba3491f
Kind: security · Impact: low

## In brief

- Apache Airflow's public Import Errors API returns raw DAG parse-failure stack traces to users holding the ImportError.can_read permission when the failing file lacks complete per-file RBAC enforcement.
- Affected versions are Apache Airflow before 3.4.0, and the source rates the severity as low.

## Why it matters

Stack traces from DAG files can expose internal code paths and details to users who should not see them, so teams running affected Airflow versions should plan to upgrade.

## What to do

- Upgrade Apache Airflow to 3.4.0 or later

## Versions

- Apache Airflow 3.4.0

## CVEs

- CVE-2026-40913

## Timeline

- 2026-11-08: Vulnerability disclosed on oss-security by Rahul Vats

## Coverage

- [CVE-2026-40913: Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcement](https://seclists.org/oss-sec/2026/q4/583) — Open Source Security, 2026-11-09

Tags: airflow, security, rbac, api, cve-2026-40913, apache

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev