CVE-2026-40913
Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcement
Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the ImportError.can_read permission when the failing file has no registered DAG. This happens when a file fails to parse before any DAG is defined, or when all of its previously registered DAGs are removed but the parse error remains. Users who should not see that file's details can read stack traces that may expose file paths and code.
Users are advised to upgrade to Apache Airflow 3.4.0 or later, which restricts these stack traces to users with the new IMPORT_ERRORS_ALL permission.
What each source reports
CVE List No score
Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcement
Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the ImportError.can_read permission when the failing file has no registered DAG. This happens when a file fails to parse before any DAG is defined, or when all of its previously registered DAGs are removed but the parse error remains. Users who should not see that file's details can read stack traces that may expose file paths and code.
Users are advised to upgrade to Apache Airflow 3.4.0 or later, which restricts these stack traces to users with the new IMPORT_ERRORS_ALL permission.
- Record
CVE-2026-40913- Weakness
- CWE-285
- Updated
- 2026-11-09
EUVDEUVD-2026-119907 No score
Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the ImportError.can_read permission when the failing file has no registered DAG. This happens when a file fails to parse before any DAG is defined, or when all of its previously registered DAGs are removed but the parse error remains. Users who should not see that file's details can read stack traces that may expose file paths and code.
Users are advised to upgrade to Apache Airflow 3.4.0 or later, which restricts these stack traces to users with the new IMPORT_ERRORS_ALL permission.
- Record
EUVD-2026-119907- Updated
- 2026-11-09
GitHub AdvisoriesGHSA-r5cg-4fxg-38f2 No score
Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user...
Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the ImportError.can_read permission when the failing file has no registered DAG. This happens when a file fails to parse before any DAG is defined, or when all of its previously registered DAGs are removed but the parse error remains. Users who should not see that file's details can read stack traces that may expose file paths and code.
Users are advised to upgrade to Apache Airflow 3.4.0 or later, which restricts these stack traces to users with the new IMPORT_ERRORS_ALL permission.
- Record
GHSA-r5cg-4fxg-38f2- Weakness
- CWE-285
- Updated
- 2026-11-09
NVD No score
Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the ImportError.can_read permission when the failing file has no registered DAG. This happens when a file fails to parse before any DAG is defined, or when all of its previously registered DAGs are removed but the parse error remains. Users who should not see that file's details can read stack traces that may expose file paths and code.
Users are advised to upgrade to Apache Airflow 3.4.0 or later, which restricts these stack traces to users with the new IMPORT_ERRORS_ALL permission.
- Record
CVE-2026-40913- Weakness
- CWE-285
- Updated
- 2026-11-09
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| published | EUVD | |
| published | EUVD, NVD | |
| aliases, references | GitHub Advisories, NVD | |
| cwes, references, title | CVE List | |
| first indexed | EUVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40913 is a vulnerability with no CVSS score yet in Apache Software Foundation Airflow, published November 9, 2026. No source lists public exploit code. No source names a fixed version.