CVE-2026-26929: Apache Airflow RBAC bypass in FastAPI DagVersion listing API

Executive brief

Apache Airflow is an open-source platform used to schedule and monitor complex workflows. A security flaw in its programming interface allows users to view sensitive version information for workflows they are not supposed to see. This could lead to the exposure of internal metadata and organizational details to unauthorized individuals.

Technical details

An incorrect permission assignment (CWE-732) exists in the FastAPI DagVersion listing API of Apache Airflow. When a request is made to the API with the 'dag_id' parameter set to the "~" wildcard, the system fails to apply per-DAG authorization filtering. This allows a network-based attacker to retrieve version metadata for all Directed Acyclic Graphs (DAGs) in the system, bypassing Role-Based Access Control (RBAC) restrictions. The vulnerability is present in versions 3.0.0 through 3.1.7 and is resolved in version 3.1.8.

Affected products

• Apache Airflow >= 3.0.0, < 3.1.8

Timeline

• 2026-02-10: patched: Fix merged into main branch
• 2026-03-17: disclosed
• 2026-03-17: advisory

References

• https://github.com/apache/airflow/pull/61675
• https://lists.apache.org/thread/g5o6khx83jwqvdyn0mlyb0krt35cs9ss
• http://www.openwall.com/lists/oss-security/2026/03/17/4
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-14.yaml