Apache Airflow up to 3.2.0 Asset Dependency Graph insufficient granularity of access control

Summaryinfo

A vulnerability described as problematic has been identified in Apache Airflow up to 3.2.0. Affected is an unknown function of the component Asset Dependency Graph. Such manipulation leads to insufficient granularity of access control. This vulnerability is documented as CVE-2026-40690. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Apache Airflow up to 3.2.0. Affected by this issue is an unknown code block of the component Asset Dependency Graph. The manipulation with an unknown input leads to a insufficient granularity of access control vulnerability. Using CWE to declare the problem leads to CWE-1220. The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets. Impacted is confidentiality. CVE summarizes:

The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment and learn the existence and names of DAGs and assets outside their authorized scope. Users are recommended to upgrade to version 3.2.1, which fixes this issue.

The weakness was released by Saurabh. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-40690 since 04/15/2026. The exploitation is known to be easy. The attack may be launched remotely. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 04/24/2026).

Upgrading to version 3.2.1 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Business Process Management Software

Vendor

• Apache

Name

• Airflow

Version

• 3.0
• 3.1
• 3.2.0

License

• open-source

Website

• Vendor: https://www.apache.org/
• Product: https://github.com/apache/airflow/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion