airflow-balancer (>=0.7.0, <=0.7.6), airflow-clickhouse-plug (1.6.2) +43 more potentially affected by CVE-2026-28563 +1 more via apache-airflow-core (>=3.0.0rc2, <=3.2.2)

apache-airflow-core PYPI version =3.0.0rc2, =0.7.0, =1.5.0, =0.6.1, =1.10.7, =0.6.0a1, =0.1.0, =1.4.3, =0.3.0, =1.2.10, =3.0.0rc3, =1.1.3rc1, =1.6.0rc1, =1.5.3rc1, =1.6.2 and more Source cves: CVE-2026-28563, CVE-2026-48891 Source advisory: SNYK:PYTHON-APACHEAIRFLOWCORE-17878939...

airflow-balancer (>=0.7.0, <=0.7.6), airflow-clickhouse-plugin (1.5.0) +26 more potentially affected by CVE-2026-28563 via apache-airflow (>=3.0.0, <=3.1.8rc2)

apache-airflow PYPI version =3.0.0, =0.7.0, =0.6.1, =1.10.7, =0.1.0, =1.4.3, =1.2.10, =3.0.0, =1.1.3rc1, =1.6.0rc1, =1.5.3rc1, =1.25.0, =3.12.0rc1, =0.0.4, =2.0.2rc1, =2.3.0 and more Source cves: CVE-2026-28563 Source advisory: OSV:GHSA-X3FV-96QH-67M7...

CVE-2026-28563

Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authorized to view. Users are recommended to...

airflow-balancer (>=0.7.0, <=0.7.6), airflow-clickhouse-plugin (1.5.0) +26 more potentially affected by CVE-2026-28563 via apache-airflow (>=3.0.0, <=3.1.8rc2)

apache-airflow PYPI version =3.0.0, =0.7.0, =0.6.1, =1.10.7, =0.1.0, =1.4.3, =1.2.10, =3.0.0, =1.1.3rc1, =1.6.0rc1, =1.5.3rc1, =1.25.0, =3.12.0rc1, =0.0.4, =2.0.2rc1, =2.3.0 and more Source cves: CVE-2026-28563 Source advisory: OSV:PYSEC-2026-15...

airflow-balancer (>=0.7.0, <=0.7.6), airflow-clickhouse-plugin (1.5.0) +26 more potentially affected by CVE-2026-28563 via apache-airflow (>=3.0.0, <=3.1.8rc2)

apache-airflow PYPI version =3.0.0, =0.7.0, =0.6.1, =1.10.7, =0.1.0, =1.4.3, =1.2.10, =3.0.0, =1.1.3rc1, =1.6.0rc1, =1.5.3rc1, =1.25.0, =3.12.0rc1, =0.0.4, =2.0.2rc1, =2.3.0 and more Source cves: CVE-2026-28563 Source advisory: MEND:CVE-2026-28563...