GHSA-5g2w-9f8g-g5q7
Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated Users
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | apache-airflow | < 3.1.7 | 3.1.7 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
**Exposure of Sensitive Information:**
An information disclosure vulnerability exists in the Apache Airflow UI that allows authenticated users to view `Import Errors` for DAGs they are not authorized to access.
In affected versions, the **Import Errors** view does not correctly filter errors based on granular DAG permissions. This means a user with access to only `DAG_A` can view import errors generated by `DAG_B`, `DAG_C`, or system-level DAGs. These error logs often contain file paths, code snippets, or stack traces that reveal the internal structure and logic of restricted DAGs.
### Patches
Users should upgrade to Apache Airflow **3.1.7** or later.
This version strictly enforces DAG-level permissions on the Import Errors view.
### Workarounds
There are no known workarounds other than upgrading.
### Resources
* [CVE-2026-24098](https://nvd.nist.gov/vuln/detail/CVE-2026-24098)
* [Pull Request #60801](https://github.com/apache/airflow/pull/60801)
* [Mailing List Announcement](https://lists.apache.org/thread/nx96435v77xdst7ls5lk57kqvqyj095x)
References
External links from the advisory. They lead to third-party sites.