Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2026-40690 · ADVISORY
• apache/airflow#65273 · WEB
• apache/airflow commit cf3452d · WEB
• apache/airflow · PACKAGE
• lists.apache.org/thread/bqt7y4g2cpj396b0sd20lv510ff19ndl · WEB
• openwall.com/lists/oss-security/2026/04/24/4 · WEB
• pypi.org/project/apache-airflow · PACKAGE
• GitHub Advisory GHSA-w7rc-q6cm-f5gm · ADVISORY

apache-airflow のその他の脆弱性

• CVE-2026-86473緊急 9.1Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting …
• CVE-2026-82355中 4.2When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the cal…
• CVE-2026-75158中 4.3Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the…
• CVE-2026-68971中 6.5Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_un…
• CVE-2026-68970中 6.5Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cl…