CVE-2026-48891: 
Apache Airflow vulnerability analysis and mitigation

CVE-2026-48891 is an information disclosure vulnerability in Apache Airflow's /ui/dependencies scheduling graph endpoint that allows authenticated users to enumerate DAG identifiers they are not authorized to access. It affects all versions of apache-airflow before 3.3.0 and was publicly disclosed on July 7, 2026. The flaw is a residual gap in the fix for CVE-2026-28563, which filtered top-level DAG keys but failed to propagate the filter into trigger/sensor dependency dep.source and dep.target fields. It carries a CVSS v3.1 base score of 4.3 (Medium) (Apache Advisory, GitHub Advisory).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The GET /ui/dependencies?dependency_type=scheduling endpoint in Apache Airflow's UI applied the caller's readable-DAG filter only to top-level serialized DAG keys within get_scheduling_dependencies(), but for each dependency object under a readable DAG, it still emitted the dependency node (whose node_id embeds both source and target DAG IDs, e.g., trigger:external_trigger_dag_id:downstream:trigger_dag_run_operator), the inbound edge from dep.source to dep.node_id, and the outbound edge from dep.node_id to dep.target. An authenticated user with read access to at least one DAG could therefore inspect the dependency graph and enumerate identifiers of other DAGs they were not authorized to read, specifically those referenced via TriggerDagRunOperator or ExternalTaskSensor dependencies. The fix (PR #67627) extends the readable-DAG filter inside the dependency loop, skipping dependency nodes and both their edges when either dep.source or dep.target is a bare DAG ID outside the caller's readable set; asset-prefixed identifiers (asset:) are unaffected (GitHub PR, GitHub Advisory).

Successful exploitation allows an authenticated Airflow UI user with limited DAG read permissions to enumerate the identifiers of DAGs belonging to other teams or access scopes, violating the confidentiality guarantees of per-DAG read scoping. The impact is limited to information disclosure — specifically DAG identifier leakage — with no integrity or availability consequences. This primarily affects multi-tenant Airflow deployments where DAG identifiers are considered sensitive organizational information and access is scoped per team (Apache Advisory, GitHub Advisory).

1. Authentication: Log in to the Apache Airflow UI with any valid account that has read permission on at least one DAG.
2. Access the dependencies endpoint: Send an authenticated HTTP GET request to GET /ui/dependencies?dependency_type=scheduling (e.g., using the browser's developer tools or a tool like curl with a valid session cookie).
3. Inspect the response: Parse the JSON response and examine the dep.source and dep.target fields within trigger and sensor dependency entries. These fields will contain DAG IDs that the caller is not authorized to read, embedded in node IDs such as trigger:external_trigger_dag_id:downstream:trigger_dag_run_operator.
4. Enumerate unauthorized DAG identifiers: Collect all unique DAG IDs appearing in dep.source and dep.target fields that do not correspond to DAGs the user has explicit read access to, effectively mapping the private DAG namespace of other teams (GitHub PR, GitHub Advisory).

• Network/Logs: Repeated or scripted authenticated HTTP GET requests to /ui/dependencies?dependency_type=scheduling from a single user account, especially from accounts with minimal DAG read permissions; review Airflow web server access logs for unusual frequency of this endpoint being queried.
• Behavioral: A user account with access to only a small number of DAGs making frequent calls to the scheduling dependencies graph endpoint, potentially followed by reconnaissance activity targeting other DAG-related endpoints using enumerated DAG IDs.

The primary remediation is to upgrade apache-airflow to version 3.3.0 or later, which extends the readable-DAG filter to cover dep.source and dep.target fields in trigger/sensor dependency entries (Apache Advisory, GitHub PR). Organizations that previously upgraded to address CVE-2026-28563 must apply this additional upgrade to close the residual gap. There is no documented configuration-based workaround; upgrading is the only effective mitigation. Deployments that do not rely on per-DAG read scoping to keep DAG identifiers private are at lower risk but should still upgrade as a best practice.

The vulnerability was announced via the Apache security mailing list and the OSS-Sec list on July 7, 2026, and received standard automated coverage across CVE tracking platforms. Social media activity was limited to automated CVE notification accounts on Bluesky. No notable independent researcher commentary or significant media coverage has been identified beyond routine vulnerability database entries.