CVE-2026-34538

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security model documentation that defines the Viewer role as read-only.

Airflow uses the FAB Auth Manager to manage access control on a per-resource basis. The Viewer role is intended to be read-only by default, and the security model documentation defines Viewer users as those who can inspect DAGs without accessing sensitive execution results.

Users are recommended to upgrade to Apache Airflow 3.2.0 which resolves this issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-668

Affected software

No affected versions have been published.

Timeline

Published
Apr 9, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-345395.5iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profileCVE-2026-34546.5The GenerateBlocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.0. This CVE-2026-345405.5iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profileCVE-2026-345415.5iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profileCVE-2026-345425.5iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profileCVE-2026-345437.5OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture indusCVE-2026-345447.3OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture indusCVE-2026-345457.3OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture indusCVE-2026-345465.5iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted TIFF input CVE-2026-345475.5iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, an Undefined BehaviorCVE-2026-345485.5iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is an UndefinedCVE-2026-345495.5iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is an Undefined
CVE-2026-34538: Medium severity, CVSS 6.5 | Vulnix