Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). As a result, version metadata of DAGs that the requester is not authorized to access is returned. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG
    authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). As a
    result, version metadata of DAGs that the requester is not authorized to access is returned. Users are
    recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue. (CVE-2026-26929)

ID	Name	Product	Family	Type	Severity
460766	Echo: apache-airflow: security update to 3.1.8	Tenable Cloud Security	Echo Local Security Checks	Local	medium
460766	Echo: apache-airflow: security update to 3.1.8	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
438947	SCA: security update for apache-airflow (GHSA-4m3h-wp5w-5hqh)	Tenable Cloud Security	SCA Checks	Local	medium
438947	SCA: security update for apache-airflow (GHSA-4m3h-wp5w-5hqh)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-26929

medium

Tenable Plugins

medium

medium

medium

medium