CVE-2026-24098

MEDIUM EPSS 50.0%
Published Feb 9, 20264mo ago · Modified Mar 11, 20263mo ago
6.5 CVSS 3.1
Medium
Find Similar
Published Feb 9, 2026 4mo ago
Last Modified Mar 11, 2026 3mo ago

Description

Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. Users are advised to upgrade to 3.1.7 or later, which resolves this issue

CVSS Details

Base Score
6.5
Exploitability
2.8
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
50.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure

Affected Products 1

VendorProductVersionRange
apacheairflow*≥3.0.0  –  <3.1.7

References 3

  • openwall.com http://www.openwall.com/lists/oss-security/2026/02/09/3
    Mailing ListThird Party Advisory
  • github.com https://github.com/apache/airflow/pull/60801
    Issue TrackingPatch
  • lists.apache.org https://lists.apache.org/thread/nx96435v77xdst7ls5lk57kqvqyj095x
    Mailing ListVendor Advisory

Remediation

  • github.com https://github.com/apache/airflow/pull/60801
    Issue TrackingPatch