CVE-2026-26929

Apache Airflow 3.0.0–3.1.7 exposes metadata for DAGs not authorized for the requester via FastAPI DagVersion listing API when dag_id is set to ~ (wildcard). Root cause: per-DAG authorization filtering is not applied for wildcard requests, leading to unintended disclosure of version metadata. A fi...