CVE-2026-24098

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24098", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-01-21T15:52:53.472Z", "datePublished": "2026-02-09T10:32:53.910Z", "dateUpdated": "2026-11-03T06:52:09.394Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-03T06:52:09.394Z"}, "title": "Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors", "problemTypes": [{"descriptions": [{"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "cweId": "CWE-200", "type": "CWE"}]}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow", "collectionURL": "https://pypi.python.org", "packageName": "apache-airflow-core", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "3.1.7", "versionType": "semver"}], "defaultStatus": "unaffected", "packageURL": "pkg:pypi/apache-airflow-core"}], "descriptions": [{"value": "Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. \n\nUsers are advised to upgrade to 3.1.7 or later, which resolves this issue", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. <br><br>Users are advised to upgrade to 3.1.7 or later, which resolves this issue"}]}], "references": [{"url": "https://github.com/apache/airflow/pull/60801", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread/nx96435v77xdst7ls5lk57kqvqyj095x", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}}], "credits": [{"lang": "en", "value": "Saurabh", "type": "finder"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-02-09T15:28:52.675029Z", "id": "CVE-2026-24098", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T15:29:40.555Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/02/09/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-02-09T17:18:52.980Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/02/09/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-02-09T17:18:52.980Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-24098", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-09T15:28:52.675029Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T15:29:08.671Z"}}], "cna": {"title": "Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Saurabh"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "3.1.7", "versionType": "semver"}], "packageURL": "pkg:pypi/apache-airflow-core", "packageName": "apache-airflow-core", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/apache/airflow/pull/60801", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread/nx96435v77xdst7ls5lk57kqvqyj095x", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. \n\nUsers are advised to upgrade to 3.1.7 or later, which resolves this issue", "supportingMedia": [{"type": "text/html", "value": "Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. <br><br>Users are advised to upgrade to 3.1.7 or later, which resolves this issue", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-03T06:52:09.394Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24098", "state": "PUBLISHED", "dateUpdated": "2026-11-03T06:52:09.394Z", "dateReserved": "2026-01-21T15:52:53.472Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-02-09T10:32:53.910Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected", "packageName": "apache-airflow-core", "packageURL": "pkg:pypi/apache-airflow-core", "product": "Apache Airflow", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "3.1.7", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C0114E8-30C3-477B-9AA9-2B388731C60A", "versionEndExcluding": "3.1.7", "versionStartIncluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. \n\nUsers are advised to upgrade to 3.1.7 or later, which resolves this issue"}, {"lang": "es", "value": "Apache Airflow versiones anteriores a la 3.1.7, tiene una vulnerabilidad que permite a los usuarios autenticados de la interfaz de usuario (UI) con permiso para uno o m\u00e1s DAGs espec\u00edficos ver errores de importaci\u00f3n generados por otros DAGs a los que no ten\u00edan acceso.\n\nSe aconseja a los usuarios actualizar a la versi\u00f3n 3.1.7 o posterior, lo que resuelve este problema."}], "id": "CVE-2026-24098", "lastModified": "2026-11-03T07:18:26.740", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24098", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-09T15:28:52.675029Z", "version": "2.0.3"}}]}, "published": "2026-02-09T11:16:14.660", "references": [{"source": "security@apache.org", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/apache/airflow/pull/60801"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/nx96435v77xdst7ls5lk57kqvqyj095x"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/02/09/3"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.1.7)"}}], "product": "airflow", "vendor": "apache"}], "analysis": {"en": {"generated_at": "2026-04-16T17:19:40.384705+00:00", "value": {"mitigation_remediation": ["Upgrade Apache Airflow to version 3.1.7 or later.", "Audit user permissions and remove unnecessary DAG access to limit the spread of error information if an upgrade is delayed.", "Disable or mask detailed error messages in Airflow\u2019s configuration as a temporary measure to reduce the amount of sensitive data revealed."], "summary": {"action": "Apply Patch", "impact": "Information disclosure of DAG import errors"}, "threat_synthesis": {"affected_systems": "All installations running Apache Airflow 3.0.0, 3.0.1, 3.0.2, up through 3.1.7 are affected. The issue resides in the web UI component that displays DAG import errors. It impacts any environment where users have DAG-level permissions, irrespective of other security settings.", "description_and_impact": "This vulnerability in Apache Airflow versions 3.0.0 through 3.1.7 allows any authenticated UI user who has permission to at least one DAG to view import error messages for DAGs beyond their authorized scope. The exposed error logs can reveal stack traces, underlying configuration, and other internal details that could aid future attacks. Importantly, this flaw only leaks information; it does not grant the ability to modify DAGs or execute arbitrary code.", "risk_and_exploitability": "The CVSS score of 6.5 classifies the flaw as moderate severity, while an EPSS score of less than 1% indicates a low of exploitation. Attack vectors require an authenticated session in the Airflow UI; the attacker can then request the error view endpoint for DAGs they cannot normally access. No privilege escalation or remote code execution is possible, and the flaw is not currently recorded in the CISA KEV catalog, but it still warrants prompt patching."}}}}, "created": "2026-02-10T15:37:38.185525+00:00", "updated": "2026-04-16T17:30:26.000284+00:00", "vendors": ["apache", "apache$PRODUCT$airflow"]}