CVE-2026-28563

🗓️ 17 Mar 2026 10:54:57Reported by apacheType

cve🔗 web.nvd.nist.gov👁 20 Views🌐 WEB

Airflow 3.1.0 to 3.1.7 exposes all DAGs via dependencies endpoint; upgrade to 3.1.8 or later.

Reporter	Title	Published	Views	Family All 19
ATTACKERKB	CVE-2026-28563	17 Mar 202610:54	–	attackerkb
CNNVD	Apache Airflow 安全漏洞	17 Mar 202600:00	–	cnnvd
CNVD	Apache Airflow Information Disclosure Vulnerability (CNVD-2026-15158)	19 Mar 202600:00	–	cnvd
Cvelist	CVE-2026-28563 Apache Airflow: DAG authorization bypass	17 Mar 202610:54	–	cvelist
EUVD	EUVD-2026-12564	17 Mar 202612:30	–	euvd
Github Security Blog	Apache Airflow: DAG authorization bypass	17 Mar 202612:30	–	github
NVD	CVE-2026-28563	17 Mar 202611:16	–	nvd
OSV	BIT-AIRFLOW-2026-28563 Apache Airflow: DAG authorization bypass	18 Mar 202608:39	–	osv
OSV	GHSA-X3FV-96QH-67M7 Apache Airflow: DAG authorization bypass	17 Mar 202612:30	–	osv
OSV	MINI-8WQR-3G57-9PQX	19 Mar 202614:00	–	osv

NVD

Vulners

Node

apache airflowRange3.0.0–3.1.8

[
  {
    "collectionURL": "https://pypi.python.org",
    "defaultStatus": "unaffected",
    "packageName": "apache-airflow",
    "product": "Apache Airflow",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "3.1.8",
        "status": "affected",
        "version": "3.0.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
github	www.github.com/apache/airflow/pull/62046
lists	www.lists.apache.org/thread/dwzf62qg9z8wvfsjknpfd8bvtwghd49s
openwall	www.openwall.com/lists/oss-security/2026/03/17/5

Parameter	Position	Path	Description	CWE
authorized_dag_ids	path	ui/dependencies	The /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs, allowing an authenticated user with DAG Dependencies permission to enumerate DAGs they are not authorized to view.	CWE-732

17 Jun 2026 10:28Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.14.3

EPSS0.0044

SSVC

CWE-732