CVE-2026-28563

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authorized to view.

Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published: Mar 17, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-285649.8Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authentication Accepts St CVE-2026-285677.5Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.CVE-2026-285687.1Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.CVE-2026-285697.1Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.CVE-2026-28578.8A vulnerability was determined in D-Link DWR-M960 1.01.07. Affected by this issue is the function sub_423E00 of the file /boafrm/formPortFw CVE-2026-285708.1Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.CVE-2026-285717.5Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.CVE-2026-285727.8In onCreate of InstallLaunch.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local escalation o CVE-2026-285735.5In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could lead to local denial CVE-2026-285755.5In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java, there is a po CVE-2026-285765.5In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information dis CVE-2026-285777.8In addWindow of WindowManagerService.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local