apache-airflow-core (>=3.2.0, <=3.2.1), apache-airflow-task-sdk (>=1.2.0, <=1.2.2rc3) +9 more potentially affected by CVE-2026-41014 via apache-airflow (>=3.2.0, <=3.2.2rc3)

apache-airflow PYPI version =3.2.0, =3.2.0, =1.2.0, =13.0.2, =7.2.0, =1.18.3, =1.4.2, =1.10.3, =1.41.2, =0.1.0rc1, =1.28.2, =5.6.2, =5.7.27 Source cves: CVE-2026-41014 Source advisory: OSV:GHSA-X2X7-P37C-43CR...

CVE-2026-41014 Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints

The partitioneddagruns endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization. An authenticated UI/API user with global Asset:read permission could enumerate partition run state, schedule configuration, and asset wiring for Dags they were not authorized to...

CVE-2026-41014

creationtimestamp| type| source ---|---|--- 2026-05-31 12:13:15+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mn5k2dd5f32j...