CVE-2026-41014

MediumCVSS 4.3/10Last modified Jul 21, 2026

Description

The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization. An authenticated UI/API user with global Asset:read permission could enumerate partition run state, schedule configuration, and asset wiring for Dags they were not authorized to read. Affects deployments that rely on per-Dag read scoping while granting users broader Asset access. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jun 1, 2026
Last modified: Jul 21, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-410157.4radare2 before 9236f44, when configured on UNIX without SSL, allows command injection via a PDB name to rabin2 -PP. NOTE: although users are CVE-2026-410165.9Apache Airflow's SMTP provider `SmtpHook` called Python's `smtplib.SMTP.starttls()` without an SSL context, so no certificate validation was CVE-2026-410175.9Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure` flag, so deployments running the Airflow API server beh CVE-2026-410186.5The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.exa CVE-2026-41036.4Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encodi CVE-2026-410306.2In ONLYOFFICE DesktopEditors before 9.3.0, the update service allows attackers to perform actions on files with SYSTEM privileges.CVE-2026-410318.7A Stored Cross-Site Scripting vulnerability in Vinna Process Monitor Version 4.0 Service Pack 1 (Build 63255) allows an authenticated remote CVE-2026-410327.5It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some restricted informat CVE-2026-410345.0ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion (via pictFmla.cbBufInCtlStm and oth CVE-2026-410357.8In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. T CVE-2026-410368.8This vulnerability exists in Quantum Networks router due to inadequate sanitization of user-supplied input in the management CLI interface. CVE-2026-410378.8This vulnerability exists in Quantum Networks router due to missing rate limiting and CAPTCHA protection for failed login attempts in the we