CVE-2026-49296

MediumCVSS 6.5/10Last modified Sep 16, 2026

Description

Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. `GET /api/v2/dagSources/{dag_id}` — and the equivalent Dag-source view in the UI — returned the entire source file without redacting Dags the caller was not authorized to read, bypassing per-DAG read authorization. Deployments that co-locate multiple Dags in a single file and rely on per-DAG access control to limit source visibility are affected; single-Dag-per-file deployments are not. Upgrade to apache-airflow 3.3.0 or later.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Jul 7, 2026
Last modified
Sep 16, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-492978.1Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS object names returned by thCVE-2026-492988.8A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate against the Execution API to be passed toCVE-2026-492995.3In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defiCVE-2026-49307.1SYMCRYPTO is the SiXG301's host side hardware engine accessed by PSA crypto library that accelerates symmetric cryptographic operations (AESCVE-2026-493016.2Permission control vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service confidentiaCVE-2026-493026.2Permission control vulnerability in the notification service module. Impact: Successful exploitation of this vulnerability may affect servicCVE-2026-493035.1Permission control vulnerability in the notification module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-493046.2Permission control vulnerability in the device key management module. Impact: Successful exploitation of this vulnerability may affect availCVE-2026-493056.2Permission control vulnerability in the Wi-Fi enhancement module. Impact: Successful exploitation of this vulnerability may affect availabilCVE-2026-493063.3UAF vulnerability in the time and time zone module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-493076.2Permission control vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability may affect service coCVE-2026-493085.5Permission control vulnerability in the clipboard module. Impact: Successful exploitation of this vulnerability may affect service confident
CVE-2026-49296: Medium severity, CVSS 6.5 | Vulnix