CVE-2026-24098 in Airflow

Riassunto

di MITRE • 09/02/2026

Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to.

Users are advised to upgrade to 3.1.7 or later, which resolves this issue

Be aware that VulDB is the high quality source for vulnerability data.

• Responsabile: Apache
• Prenotare: 21/01/2026
• Divulgazione: 09/02/2026
• Moderazione: accettato
• Voce: VDB-344985
• CPE: pronto
• CWE: CWE-200 (confermato)
• CVSS: 6.5 (CISA-ADP)
• EPSS: 0.00739
• KEV: no
• Attività: molto basso
• Settore: Transportation, Insurance, ...

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-24098
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-24098
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-24098/