CVE-2026-40690

The record

The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment and learn the existence and names of DAGs and assets outside their authorized scope. Users are recommended to upgrade to version 3.2.1, which fixes this issue.

Affected packages

Related vulnerabilities

• CVE-2026-96372 Insufficient Granularity of Access Control vulnerability in Drupal Webform allows… CWE-1220
• CVE-2026-78230 AshAi exposes Ash read actions to language-model tool calls. CWE-1220
• CVE-2026-78216 AshLua exposes Ash read actions to Lua scripts run through an eval action. CWE-1220
• CVE-2026-15431 A potential security vulnerability has been identified in the HP Support Assistant for… CWE-1220
• CVE-2026-40145 A vulnerability exists in the interaction between a Endpoint Privilege Management… CWE-1220
• CVE-2025-31938 Insufficient granularity of access control in some subsystem for some Intel(R) Xeon(R) 6… CWE-1220
• CVE-2026-50502 Insufficient granularity of access control in Windows Event Logging Service allows an… CWE-1220
• CVE-2026-50405 Insufficient granularity of access control in Windows Filtering Platform (WFP) allows an… CWE-1220