CVE-2026-41490
Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations
Dagster is an orchestration platform for the development, production, and observation of data assets. Prior to Dagster Core version 1.13.1 and prior to Dagster libraries version 0.29.1, the DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would execute against the target database backend under the I/O manager's credentials. Only deployments that use dynamic partitions are affected. Pipelines using static or time-window partitions are not impacted. This issue has been patched in Dagster Core version 1.13.1 and Dagster libraries version 0.29.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations
Dagster is an orchestration platform for the development, production, and observation of data assets. Prior to Dagster Core version 1.13.1 and prior to Dagster libraries version 0.29.1, the DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would execute against the target database backend under the I/O manager's credentials. Only deployments that use dynamic partitions are affected. Pipelines using static or time-window partitions are not impacted. This issue has been patched in Dagster Core version 1.13.1 and Dagster libraries version 0.29.1.
- Record
CVE-2026-41490- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2026-28368
Dagster is an orchestration platform for the development, production, and observation of data assets. Prior to Dagster Core version 1.13.1 and prior to Dagster libraries version 0.29.1, the DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would execute against the target database backend under the I/O manager's credentials. Only deployments that use dynamic partitions are affected. Pipelines using static or time-window partitions are not impacted. This issue has been patched in Dagster Core version 1.13.1 and Dagster libraries version 0.29.1.
- Record
EUVD-2026-28368- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mjw2-v2hm-wj34
Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations
Summary
The DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would execute against the target database backend under the I/O manager's credentials.
Only deployments that use dynamic partitions are affected. Pipelines using static or time-window partitions are not impacted.
Impact
Dagster OSS: Any user with access to the Dagster API can create dynamic partition keys. Organizations should assess exposure based on who has API access in their deployment. Dagster is typically deployed in trusted environments where users who can manage partitions already have equivalent database access through other means.
Dagster+: In most Dagster+ deployments using default permission sets, the Add Dynamic Partitions permission is granted to users with an Editor role or above, who typically already have the ability to modify the affected tables and the asset code that accesses them.
The vulnerability is most relevant in deployments where this permission has been granted independently of broader database access, such as certain multi-tenant or custom RBAC configurations. In those cases, an affected user could read or modify data within the databases accessible to the I/O manager, beyond what their role would otherwise permit. Organizations should review which users hold this permission and assess their exposure accordingly.
Remediation
Update to the patched versions listed above. No configuration changes or workarounds are required alongside the update. Only your Dagster code version needs to be updated; the Dagster+ agent/Dagster OSS daemon/webserver do not need to be updated.
The fix ensures that partition key values are properly escaped before inclusion in SQL queries across all affected I/O managers.
If you are unable to apply the update, manual workarounds are described here.
- Record
GHSA-mjw2-v2hm-wj34- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-89
- Updated
- 2026-11-02
NVD
Dagster is an orchestration platform for the development, production, and observation of data assets. Prior to Dagster Core version 1.13.1 and prior to Dagster libraries version 0.29.1, the DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would execute against the target database backend under the I/O manager's credentials. Only deployments that use dynamic partitions are affected. Pipelines using static or time-window partitions are not impacted. This issue has been patched in Dagster Core version 1.13.1 and Dagster libraries version 0.29.1.
- Record
CVE-2026-41490- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations
Dagster is an orchestration platform for the development, production, and observation of data assets. Prior to Dagster Core version 1.13.1 and prior to Dagster libraries version 0.29.1, the DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would execute against the target database backend under the I/O manager's credentials. Only deployments that use dynamic partitions are affected. Pipelines using static or time-window partitions are not impacted. This issue has been patched in Dagster Core version 1.13.1 and Dagster libraries version 0.29.1.
- Record
CVE-2026-41490- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVGHSA-mjw2-v2hm-wj34
Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations
Summary
The DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would execute against the target database backend under the I/O manager's credentials.
Only deployments that use dynamic partitions are affected. Pipelines using static or time-window partitions are not impacted.
Impact
Dagster OSS: Any user with access to the Dagster API can create dynamic partition keys. Organizations should assess exposure based on who has API access in their deployment. Dagster is typically deployed in trusted environments where users who can manage partitions already have equivalent database access through other means.
Dagster+: In most Dagster+ deployments using default permission sets, the Add Dynamic Partitions permission is granted to users with an Editor role or above, who typically already have the ability to modify the affected tables and the asset code that accesses them.
The vulnerability is most relevant in deployments where this permission has been granted independently of broader database access, such as certain multi-tenant or custom RBAC configurations. In those cases, an affected user could read or modify data within the databases accessible to the I/O manager, beyond what their role would otherwise permit. Organizations should review which users hold this permission and assess their exposure accordingly.
Remediation
Update to the patched versions listed above. No configuration changes or workarounds are required alongside the update. Only your Dagster code version needs to be updated; the Dagster+ agent/Dagster OSS daemon/webserver do not need to be updated.
The fix ensures that partition key values are properly escaped before inclusion in SQL queries across all affected I/O managers.
If you are unable to apply the update, manual workarounds are described here.
- Record
GHSA-mjw2-v2hm-wj34- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-89
- Updated
- 2026-11-02
Show 6 moreShow less
OSVPYSEC-2026-2432
Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations
Summary
The DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would execute against the target database backend under the I/O manager's credentials.
Only deployments that use dynamic partitions are affected. Pipelines using static or time-window partitions are not impacted.
Impact
Dagster OSS: Any user with access to the Dagster API can create dynamic partition keys. Organizations should assess exposure based on who has API access in their deployment. Dagster is typically deployed in trusted environments where users who can manage partitions already have equivalent database access through other means.
Dagster+: In most Dagster+ deployments using default permission sets, the Add Dynamic Partitions permission is granted to users with an Editor role or above, who typically already have the ability to modify the affected tables and the asset code that accesses them.
The vulnerability is most relevant in deployments where this permission has been granted independently of broader database access, such as certain multi-tenant or custom RBAC configurations. In those cases, an affected user could read or modify data within the databases accessible to the I/O manager, beyond what their role would otherwise permit. Organizations should review which users hold this permission and assess their exposure accordingly.
Remediation
Update to the patched versions listed above. No configuration changes or workarounds are required alongside the update. Only your Dagster code version needs to be updated; the Dagster+ agent/Dagster OSS daemon/webserver do not need to be updated.
The fix ensures that partition key values are properly escaped before inclusion in SQL queries across all affected I/O managers.
If you are unable to apply the update, manual workarounds are described here.
- Record
PYSEC-2026-2432- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
OSVPYSEC-2026-2433
Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations
Summary
The DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would execute against the target database backend under the I/O manager's credentials.
Only deployments that use dynamic partitions are affected. Pipelines using static or time-window partitions are not impacted.
Impact
Dagster OSS: Any user with access to the Dagster API can create dynamic partition keys. Organizations should assess exposure based on who has API access in their deployment. Dagster is typically deployed in trusted environments where users who can manage partitions already have equivalent database access through other means.
Dagster+: In most Dagster+ deployments using default permission sets, the Add Dynamic Partitions permission is granted to users with an Editor role or above, who typically already have the ability to modify the affected tables and the asset code that accesses them.
The vulnerability is most relevant in deployments where this permission has been granted independently of broader database access, such as certain multi-tenant or custom RBAC configurations. In those cases, an affected user could read or modify data within the databases accessible to the I/O manager, beyond what their role would otherwise permit. Organizations should review which users hold this permission and assess their exposure accordingly.
Remediation
Update to the patched versions listed above. No configuration changes or workarounds are required alongside the update. Only your Dagster code version needs to be updated; the Dagster+ agent/Dagster OSS daemon/webserver do not need to be updated.
The fix ensures that partition key values are properly escaped before inclusion in SQL queries across all affected I/O managers.
If you are unable to apply the update, manual workarounds are described here.
- Record
PYSEC-2026-2433- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
OSVPYSEC-2026-2434
Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations
Summary
The DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would execute against the target database backend under the I/O manager's credentials.
Only deployments that use dynamic partitions are affected. Pipelines using static or time-window partitions are not impacted.
Impact
Dagster OSS: Any user with access to the Dagster API can create dynamic partition keys. Organizations should assess exposure based on who has API access in their deployment. Dagster is typically deployed in trusted environments where users who can manage partitions already have equivalent database access through other means.
Dagster+: In most Dagster+ deployments using default permission sets, the Add Dynamic Partitions permission is granted to users with an Editor role or above, who typically already have the ability to modify the affected tables and the asset code that accesses them.
The vulnerability is most relevant in deployments where this permission has been granted independently of broader database access, such as certain multi-tenant or custom RBAC configurations. In those cases, an affected user could read or modify data within the databases accessible to the I/O manager, beyond what their role would otherwise permit. Organizations should review which users hold this permission and assess their exposure accordingly.
Remediation
Update to the patched versions listed above. No configuration changes or workarounds are required alongside the update. Only your Dagster code version needs to be updated; the Dagster+ agent/Dagster OSS daemon/webserver do not need to be updated.
The fix ensures that partition key values are properly escaped before inclusion in SQL queries across all affected I/O managers.
If you are unable to apply the update, manual workarounds are described here.
- Record
PYSEC-2026-2434- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
OSVPYSEC-2026-2435
Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations
Summary
The DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would execute against the target database backend under the I/O manager's credentials.
Only deployments that use dynamic partitions are affected. Pipelines using static or time-window partitions are not impacted.
Impact
Dagster OSS: Any user with access to the Dagster API can create dynamic partition keys. Organizations should assess exposure based on who has API access in their deployment. Dagster is typically deployed in trusted environments where users who can manage partitions already have equivalent database access through other means.
Dagster+: In most Dagster+ deployments using default permission sets, the Add Dynamic Partitions permission is granted to users with an Editor role or above, who typically already have the ability to modify the affected tables and the asset code that accesses them.
The vulnerability is most relevant in deployments where this permission has been granted independently of broader database access, such as certain multi-tenant or custom RBAC configurations. In those cases, an affected user could read or modify data within the databases accessible to the I/O manager, beyond what their role would otherwise permit. Organizations should review which users hold this permission and assess their exposure accordingly.
Remediation
Update to the patched versions listed above. No configuration changes or workarounds are required alongside the update. Only your Dagster code version needs to be updated; the Dagster+ agent/Dagster OSS daemon/webserver do not need to be updated.
The fix ensures that partition key values are properly escaped before inclusion in SQL queries across all affected I/O managers.
If you are unable to apply the update, manual workarounds are described here.
- Record
PYSEC-2026-2435- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
OSVPYSEC-2026-2436
Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations
Summary
The DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would execute against the target database backend under the I/O manager's credentials.
Only deployments that use dynamic partitions are affected. Pipelines using static or time-window partitions are not impacted.
Impact
Dagster OSS: Any user with access to the Dagster API can create dynamic partition keys. Organizations should assess exposure based on who has API access in their deployment. Dagster is typically deployed in trusted environments where users who can manage partitions already have equivalent database access through other means.
Dagster+: In most Dagster+ deployments using default permission sets, the Add Dynamic Partitions permission is granted to users with an Editor role or above, who typically already have the ability to modify the affected tables and the asset code that accesses them.
The vulnerability is most relevant in deployments where this permission has been granted independently of broader database access, such as certain multi-tenant or custom RBAC configurations. In those cases, an affected user could read or modify data within the databases accessible to the I/O manager, beyond what their role would otherwise permit. Organizations should review which users hold this permission and assess their exposure accordingly.
Remediation
Update to the patched versions listed above. No configuration changes or workarounds are required alongside the update. Only your Dagster code version needs to be updated; the Dagster+ agent/Dagster OSS daemon/webserver do not need to be updated.
The fix ensures that partition key values are properly escaped before inclusion in SQL queries across all affected I/O managers.
If you are unable to apply the update, manual workarounds are described here.
- Record
PYSEC-2026-2436- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
OSVPYSEC-2026-2437
Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations
Summary
The DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would execute against the target database backend under the I/O manager's credentials.
Only deployments that use dynamic partitions are affected. Pipelines using static or time-window partitions are not impacted.
Impact
Dagster OSS: Any user with access to the Dagster API can create dynamic partition keys. Organizations should assess exposure based on who has API access in their deployment. Dagster is typically deployed in trusted environments where users who can manage partitions already have equivalent database access through other means.
Dagster+: In most Dagster+ deployments using default permission sets, the Add Dynamic Partitions permission is granted to users with an Editor role or above, who typically already have the ability to modify the affected tables and the asset code that accesses them.
The vulnerability is most relevant in deployments where this permission has been granted independently of broader database access, such as certain multi-tenant or custom RBAC configurations. In those cases, an affected user could read or modify data within the databases accessible to the I/O manager, beyond what their role would otherwise permit. Organizations should review which users hold this permission and assess their exposure accordingly.
Remediation
Update to the patched versions listed above. No configuration changes or workarounds are required alongside the update. Only your Dagster code version needs to be updated; the Dagster+ agent/Dagster OSS daemon/webserver do not need to be updated.
The fix ensures that partition key values are properly escaped before inclusion in SQL queries across all affected I/O managers.
If you are unable to apply the update, manual workarounds are described here.
- Record
PYSEC-2026-2437- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dagster-duckdbPyPI |
through 0.29.0 | 0.29.1 |
dagster-snowflakePyPI |
through 0.29.0 | 0.29.1 |
dagster-gcpPyPI |
through 0.29.0 | 0.29.1 |
dagsterPyPI |
through 1.13.0 | 1.13.1 |
dagster-deltalakePyPI |
through 0.29.0 | 0.29.1 |
dagster-snowflake-polarsPyPI |
through 0.29.0 | 0.29.1 |
dagster-duckdbPyPI |
before 0.29.1, plus listed versions 0.16.130.16.140.16.150.16.160.16.17 Show 45 moreShow less0.17.10.17.100.17.110.17.120.17.130.17.140.17.150.17.160.17.170.17.17rc00.17.180.17.190.17.20.17.200.17.210.17.30.17.40.17.50.17.60.17.70.17.80.17.90.18.00.18.10.18.20.18.30.18.40.18.50.18.60.18.70.19.00.19.10.19.100.19.110.19.120.19.130.19.140.19.14rc10.19.14rc20.19.20.19.30.19.40.19.50.19.60.19.7 |
0.29.1 |
dagster-snowflakePyPI |
before 0.29.1, plus listed versions 0.10.00.10.0rc00.10.10.10.1rc00.10.2 Show 45 moreShow less0.10.2rc00.10.30.10.3rc00.10.40.10.4rc00.10.50.10.5rc00.10.60.10.6rc00.10.70.10.7rc00.10.80.10.8rc00.10.90.11.00.11.0rc00.11.10.11.100.11.10rc00.11.10rc10.11.10rc20.11.110.11.11rc10.11.11rc50.11.11rc70.11.120.11.12rc00.11.12rc20.11.12rc30.11.130.11.13rc20.11.13rc30.11.13rc50.11.140.11.14rc00.11.14rc10.11.14rc20.11.14rc30.11.14rc40.11.14rc50.11.14rc70.11.14rc80.11.150.11.15rc00.11.15rc1 |
0.29.1 |
dagster-gcpPyPI |
before 0.29.1, plus listed versions 0.10.00.10.0rc00.10.10.10.1rc00.10.2 Show 45 moreShow less0.10.2rc00.10.30.10.3rc00.10.40.10.4rc00.10.50.10.5rc00.10.60.10.6rc00.10.70.10.7rc00.10.80.10.8rc00.10.90.11.00.11.0rc00.11.10.11.100.11.10rc00.11.10rc10.11.10rc20.11.110.11.11rc10.11.11rc50.11.11rc70.11.120.11.12rc00.11.12rc20.11.12rc30.11.130.11.13rc20.11.13rc30.11.13rc50.11.140.11.14rc00.11.14rc10.11.14rc20.11.14rc30.11.14rc40.11.14rc50.11.14rc70.11.14rc80.11.150.11.15rc00.11.15rc1 |
0.29.1 |
dagsterPyPI |
before 1.13.1, plus listed versions 0.1.0rc10.1.10.1.20.1.30.1.4 Show 45 moreShow less0.1.50.1.60.1.70.1.90.10.00.10.0rc00.10.10.10.1rc00.10.20.10.2rc00.10.30.10.3rc00.10.40.10.4rc00.10.50.10.5rc00.10.60.10.6rc00.10.70.10.7rc00.10.80.10.8rc00.10.90.11.00.11.0rc00.11.10.11.100.11.10rc00.11.10rc10.11.10rc20.11.110.11.11rc10.11.11rc50.11.11rc70.11.120.11.12rc00.11.12rc20.11.12rc30.11.130.11.13rc10.11.13rc20.11.13rc30.11.13rc50.11.140.11.14rc0 |
1.13.1 |
dagster-deltalakePyPI |
before 0.29.1, plus listed versions 0.21.100.21.110.21.120.21.130.21.14 Show 45 moreShow less0.21.14rc00.21.90.22.00.22.10.22.100.22.110.22.120.22.130.22.140.22.20.22.30.22.40.22.50.22.60.22.70.22.80.22.90.23.00.23.10.23.100.23.110.23.120.23.130.23.140.23.150.23.160.23.20.23.2rc10.23.2rc20.23.2rc30.23.2rc40.23.30.23.40.23.50.23.60.23.70.23.80.23.90.23.9rc00.24.00.24.10.24.100.24.110.24.120.24.13 |
0.29.1 |
dagster-snowflake-polarsPyPI |
before 0.29.1, plus listed versions 0.27.100.27.110.27.120.27.130.27.14 Show 42 moreShow less0.27.150.27.160.27.20.27.30.27.40.27.50.27.60.27.70.27.80.27.90.28.00.28.10.28.100.28.110.28.120.28.130.28.13rc00.28.140.28.14rc20.28.14rc30.28.14rc40.28.150.28.15rc30.28.15rc40.28.160.28.16rc10.28.170.28.17rc00.28.180.28.190.28.20.28.200.28.210.28.220.28.30.28.40.28.50.28.60.28.70.28.80.28.90.29.0 |
0.29.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | romain-deperne/CVE-2026-41490 | 2026-06-13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-41490 is a high vulnerability (CVSS 8.3) in Dagster-io Dagster, published April 18, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 18th percentile. Fixed in dagster-duckdb 0.29.1.
References
github.com/dagster-io/dagster/security/advisories/GHSA-mjw2-v2hm-wj34
gist.github.com/gibsondan/6d0c483f8499a8b1cd460cddc9fd8f72
nvd.nist.gov/vuln/detail/CVE-2026-41490
Left out here: 2,144 versions. The JSON record has them.