Aller au contenu
en Se connecter
Non notée

CVE-2026-34538 Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only…

Description

Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security model documentation that defines the Viewer role as read-only. Airflow uses the FAB Auth Manager to manage access control on a per-resource basis. The Viewer role is intended to be read-only by default, and the security model documentation defines Viewer users as those who can inspect DAGs without accessing sensitive execution results. Users are recommended to upgrade to Apache Airflow 3.2.0 which resolves this issue.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache Airflow 3.0 3.0.0 → < 3.2.0 3.2.0

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache Airflow

Les 153 CVE de Apache Airflow →
CVE-2026-86473 Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie Non notée CVE-2026-75158 Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter… Non notée CVE-2026-82355 When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token,… Non notée CVE-2026-75157 Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of… Non notée
Suivre cette CVE