CVE-2026-40913

Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the ImportError.canread permission when the failing file has no registered DAG. This happens when a file fails to parse before any DAG is defined, or when all of its previously registered DAGs are...