Is CVE-2026-40913 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40913 being exploited in the wild.

How severe is CVE-2026-40913?

Informational severity, published 9 November 2026.

How is CVE-2026-40913 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-40913?

Check whether you run Apache Airflow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40913: Apache Airflow Import Errors API information disclosure

CVE-2026-40913 · Severity: info · Published 2026-11-09

Apache Airflow is a workflow orchestration platform used to manage data pipelines. The Import Errors API exposes detailed stack traces containing file paths and code details to users with read access to import errors, even when viewing files with no registered workflows. An attacker with limited read permissions could learn internal file structure and code details not intended for their access level.

Technologies: Apache Airflow. Vendors: Apache.

Quick answers

Is CVE-2026-40913 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40913 being exploited in the wild.
How severe is CVE-2026-40913?: Informational severity, published 9 November 2026.
Which products and versions are affected?: Apache Airflow before 3.4.0.
Is there a fix for CVE-2026-40913?: Yes: fixed in Apache Airflow 3.4.0 or later. Until then: Restrict the `ImportError.can_read` permission to trusted users only until upgrading to a patched version. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40913 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-40913?: Check whether you run Apache Airflow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Apache Airflow 3.4.0 or later

Restrict the `ImportError.can_read` permission to trusted users only until upgrading to a patched version.

Technical details

The vulnerability is an information disclosure in the public Import Errors API: unregistered DAG files (those failing to parse before any DAG definition or with all DAGs removed) return raw stack traces to any user with the `ImportError.can_read` permission, bypassing the intended per-DAG authorization model. The fix introduces a new `IMPORT_ERRORS_ALL` permission that gates such traces, with authorization determined per team via the file's bundle when multi-team isolation is supported.

Affected products

Apache Airflow before 3.4.0

Timeline

2026-11-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.