CVE-2026-26929

The record

Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). As a result, version metadata of DAGs that the requester is not authorized to access is returned. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

Affected packages

Related vulnerabilities

• CVE-2026-102282 adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. CWE-732
• CVE-2026-92941 vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code… CWE-732
• CVE-2026-87988 An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass… CWE-732
• CVE-2026-19583 Velociraptor allows some sensitive artifacts to be gated by additional permissions. CWE-732
• CVE-2026-79617 Incorrect Permission Assignment for Critical Resource vulnerability in TÜBİTAK BİLGEM… CWE-732
• CVE-2026-82312 OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local… CWE-732
• CVE-2026-80112 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and… CWE-732
• CVE-2021-43613 An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. CWE-732