CVE-2026-24098
Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated Users
Impact
### Impact **Exposure of Sensitive Information:** An information disclosure vulnerability exists in the Apache Airflow UI that allows authenticated users to view `Import Errors` for DAGs they are not authorized to access. In affected versions, the **Import Errors** view does not correctly filter errors based on granular DAG permissions. This means a user with access to only `DAG_A` can view import errors generated by `DAG_B`, `DAG_C`, or system-level DAGs. These error logs often contain file paths, code snippets, or stack traces that reveal the internal structure and logic of restricted DAGs. ### Patches Users should upgrade to Apache Airflow **3.1.7** or later. This version strictly enforces DAG-level permissions on the Import Errors view. ### Workarounds There are no known workarounds other than upgrading. ### Resources * [CVE-2026-24098](https://nvd.nist.gov/vuln/detail/CVE-2026-24098) * [Pull Request #60801](https://github.com/apache/airflow/pull/60801) * [Mailing List Announcement](https://lists.apache.org/thread/nx96435v77xdst7ls5lk57kqvqyj095x)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | apache-airflow | < 3.1.7 | 3.1.7 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Airflow | from 3.0.0 before 3.1.7 |