CVE-2026-41490

CVE-2026-41490 — SQL Injection in Dagster database I/O managers via dynamic partition keys Severity : High CVSS 8.3 CWE : CWE-89 — SQL Injection Affected : Dagster core = 1.13.0 and integration packages = 0.29.0 Fixed in : Dagster core 1.13.1 and integration packages 0.29.1 Advisory :...

ablog (>=0.10.3, <=0.10.7), acumos (>=0.9.3, <=0.9.4) +13 more potentially affected by CVE-2026-102598 via werkzeug (1.0.0rc1)

werkzeug PYPI version 1.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - ablog =0.10.3, =0.9.3, =0.7.0rc0, =0.26.0, =0.26.0, =5.0.19, =0.2.11, =0.51.0, =0.51.6, =0.52.0, =0.52.0, =0.53.0, =0.53.4 Source cves:...

dagster-snowflake (>=0.21.8, <=0.22.3), dagster-snowflake-pandas (>=0.21.8, <=0.22.3) +2 more potentially affected by CVE-2026-86597 via snowflake-connector-python (3.4.1)

snowflake-connector-python PYPI version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dagster-snowflake =0.21.8, =0.21.8, =0.21.8, =0.22.3 - quacker 0.6.2 Source cves: CVE-2026-86597 Source...

dagster-snowflake (>=0.4.0rc2, <=0.6.1) potentially affected by CVE-2026-15925 via snowflake-connector-python (1.7.11)

snowflake-connector-python PYPI version 1.7.11 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dagster-snowflake =0.4.0rc2, =0.6.1 Source cves: CVE-2026-15925 Source advisory: OSV:PYSEC-2026-3920...

dag-manager (>=0.1.3a0, <=0.1.5a0), dagster-airflow (>=0.5.4rc0, <=0.5.4) +2 more potentially affected by CVE-2026-59242 via apache-airflow (1.10.3)

apache-airflow PYPI version 1.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dag-manager =0.1.3a0, =0.5.4rc0, =0.1.0, =3.0.2, =3.0.3 Source cves: CVE-2026-59242 Source advisory: OSV:GHSA-FCMM-42R9-MMMM...

dag-manager (>=0.1.3a0, <=0.1.5a0), dagster-airflow (>=0.5.4rc0, <=0.5.4) +2 more potentially affected by CVE-2026-68076 via apache-airflow (1.10.3)

apache-airflow PYPI version 1.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dag-manager =0.1.3a0, =0.5.4rc0, =0.1.0, =3.0.2, =3.0.3 Source cves: CVE-2026-68076 Source advisory: OSV:PYSEC-2026-3709...

dagster-snowflake (>=0.4.0rc2, <=0.6.1) potentially affected by CVE-2026-15925 via snowflake-connector-python (1.7.11)

snowflake-connector-python PYPI version 1.7.11 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dagster-snowflake =0.4.0rc2, =0.6.1 Source cves: CVE-2026-15925 Source advisory: OSV:GHSA-5CC2-282F-JJQ2...

dagster-mlflow (>=0.14.18rc5, <=0.17.21), sparkpipelineframework (1.0.18) potentially affected by CVE-2026-2614 via mlflow (1.26.0)

mlflow PYPI version 1.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.14.18rc5, =0.17.21 - sparkpipelineframework 1.0.18 Source cves: CVE-2026-2614 Source advisory: OSV:PYSEC-2026-2654...

dagit (0.11.12rc0), dagster-airflow (0.11.12rc0) potentially affected by CVE-2026-41490 via dagster (0.11.12rc0)

dagster PYPI version 0.11.12rc0 is affected by a known vulnerability. The following packages have a transitive dependency on dagster and may be impacted: - dagit 0.11.12rc0 - dagster-airflow 0.11.12rc0 Source cves: CVE-2026-41490 Source advisory: OSV:PYSEC-2026-2432...

dagit (0.12.6), dagster-airflow (0.12.6) +28 more potentially affected by CVE-2026-41490 via dagster (0.12.6)

dagster PYPI version 0.12.6 is affected by a known vulnerability. The following packages have a transitive dependency on dagster and may be impacted: - dagit 0.12.6 - dagster-airflow 0.12.6 - dagster-aws 0.12.6 - dagster-azure 0.12.6 - dagster-cloud 0.12.6 - dagster-dask 0.12.6 - dagster-databric...

dagit (0.8.0rc0), dagster-airflow (0.8.0rc0) potentially affected by CVE-2026-41490 via dagster (0.8.0rc0)

dagster PYPI version 0.8.0rc0 is affected by a known vulnerability. The following packages have a transitive dependency on dagster and may be impacted: - dagit 0.8.0rc0 - dagster-airflow 0.8.0rc0 Source cves: CVE-2026-41490 Source advisory: OSV:PYSEC-2026-2432...

dagit (0.15.3), dagster-airbyte (0.15.3) +35 more potentially affected by CVE-2026-41490 via dagster (0.15.3)

dagster PYPI version 0.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on dagster and may be impacted: - dagit 0.15.3 - dagster-airbyte 0.15.3 - dagster-airflow 0.15.3 - dagster-aws 0.15.3 - dagster-azure 0.15.3 - dagster-celery 0.15.3 -...

dagit (0.14.18rc2), dagster-airbyte (0.14.18rc2) +33 more potentially affected by CVE-2026-41490 via dagster (0.14.18rc2)

dagster PYPI version 0.14.18rc2 is affected by a known vulnerability. The following packages have a transitive dependency on dagster and may be impacted: - dagit 0.14.18rc2 - dagster-airbyte 0.14.18rc2 - dagster-airflow 0.14.18rc2 - dagster-aws 0.14.18rc2 - dagster-azure 0.14.18rc2 - dagster-cele...

dagit (>=0.3.4, <=0.11.2), dagster-airflow (0.11.2) potentially affected by CVE-2026-41490 via dagster (0.11.2)

dagster PYPI version 0.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on dagster and may be impacted: - dagit =0.3.4, =0.11.2 - dagster-airflow 0.11.2 Source cves: CVE-2026-41490 Source advisory: OSV:PYSEC-2026-2432...

dagit (0.13.2rc2), dagster-airflow (0.13.2rc2) +30 more potentially affected by CVE-2026-41490 via dagster (0.13.2rc2)

dagster PYPI version 0.13.2rc2 is affected by a known vulnerability. The following packages have a transitive dependency on dagster and may be impacted: - dagit 0.13.2rc2 - dagster-airflow 0.13.2rc2 - dagster-aws 0.13.2rc2 - dagster-azure 0.13.2rc2 - dagster-celery 0.13.2rc2 - dagster-celery-dock...

dagit (0.9.17rc0), dagster-airflow (0.9.17rc0) potentially affected by CVE-2026-41490 via dagster (0.9.17rc0)

dagster PYPI version 0.9.17rc0 is affected by a known vulnerability. The following packages have a transitive dependency on dagster and may be impacted: - dagit 0.9.17rc0 - dagster-airflow 0.9.17rc0 Source cves: CVE-2026-41490 Source advisory: OSV:PYSEC-2026-2432...

dagit (0.11.6rc32), dagster-airflow (0.11.6rc32) potentially affected by CVE-2026-41490 via dagster (0.11.6rc32)

dagster PYPI version 0.11.6rc32 is affected by a known vulnerability. The following packages have a transitive dependency on dagster and may be impacted: - dagit 0.11.6rc32 - dagster-airflow 0.11.6rc32 Source cves: CVE-2026-41490 Source advisory: OSV:PYSEC-2026-2432...

dagit (0.15.8), dagster-airbyte (0.15.8) +36 more potentially affected by CVE-2026-41490 via dagster (0.15.8)

dagster PYPI version 0.15.8 is affected by a known vulnerability. The following packages have a transitive dependency on dagster and may be impacted: - dagit 0.15.8 - dagster-airbyte 0.15.8 - dagster-airflow 0.15.8 - dagster-aws 0.15.8 - dagster-azure 0.15.8 - dagster-celery 0.15.8 -...

dagit (0.9.12rc0), dagster-airflow (0.9.12rc0) potentially affected by CVE-2026-41490 via dagster (0.9.12rc0)

dagster PYPI version 0.9.12rc0 is affected by a known vulnerability. The following packages have a transitive dependency on dagster and may be impacted: - dagit 0.9.12rc0 - dagster-airflow 0.9.12rc0 Source cves: CVE-2026-41490 Source advisory: OSV:PYSEC-2026-2432...

dagit (0.11.6rc9), dagster-airflow (0.11.6rc9) potentially affected by CVE-2026-41490 via dagster (0.11.6rc9)

dagster PYPI version 0.11.6rc9 is affected by a known vulnerability. The following packages have a transitive dependency on dagster and may be impacted: - dagit 0.11.6rc9 - dagster-airflow 0.11.6rc9 Source cves: CVE-2026-41490 Source advisory: OSV:PYSEC-2026-2432...