CVE-2026-28563
Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by…
CVE-2026-28563: Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by….
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Get an email when Apache publishes the next one.
VulniPulse checks Apache's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
CVE-2026-28563 key facts
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- Medium
- CVSS base score
- 4.3 (Apache)
- Fixed releases
- Apache: 3.1.8
- Vendor advisories
- 2 from Apache
- VulniPulse record
- Published · Updated
Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-28563; bulletin-wide values are not repeated here.
Is CVE-2026-28563 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2026-28563 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2026-28563?
Upgrade to a fixed release named by the vendor:
- Apache: 3.1.8
Vendor advisory comparison
Apache
2 advisories- Advisory severityMedium4.3
Medium [CVE-2026-28563 +1] Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target
CVE-2026-48891Source published Source updated
This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
A bug in Apache Airflow's `/ui/dependencies` scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the `dep.source` and `dep.target` fields of trigger / sensor dependency entries. An authenticated UI user with read permission on some Dags could enumerate the identifiers of other Dags they were not authorized to read by inspecting the dependency graph for trigger / sensor references. Affects deployments that rely on per-Dag read scoping to keep Dag identifiers private across teams. This is a residual gap in the fix for CVE-2026-28563, which filtered the top-level Dag key but did not propagate the filter into the trigger / sensor dep-source / dep-target fields. Users who already upgraded for…
- Affected products in this advisory
- Apache Airflow
- Source-reported affected versions
- Apache Airflow before 3.3.0
- Source-reported fixed versions
- 3.3.0
- Mitigation guidance
- Users who already upgraded for CVE-2026-28563 should additionally upgrade to `apache-airflow` 3.3.0 or later to cover the residual trigger / sensor dependency leak.
- Advisory severityMedium4.3
Medium [CVE-2026-28563] Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by…
CVE-2026-28563Source published Source updated
Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authorized to view. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
- Affected products in this advisory
- Apache Airflow
- Airflow
- Source-reported affected versions
- through 3.1.7
- Source-reported fixed versions
- 3.1.8
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
More Apache advisories
- CVE-2026-81930Sep 29, 2026Apache Airflow's Snowflake provider did not validate the connection's `account`
- CVE-2026-81862Sep 29, 2026Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL
- CVE-2026-81914Sep 29, 2026Apache Airflow's Google provider built Google Drive search expressions by interpolating
- CVE-2026-86473Sep 21, 2026Apache Airflow: the Core API logout endpoint revokes only a session token presented
- CVE-2026-75158Sep 21, 2026Apache Airflow's `/assets/events` API returned asset events for every Dag
- CVE-2026-82355Sep 21, 2026Apache Airflow: When a request to the Airflow core API carries both a session cookie
Follow CVE-2026-28563 in the free weekly digest
Every Monday: whether it was added to CISA KEV, reported exploited, got a fix or changed severity, plus the week's critical and high advisories.
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
Android app · Google Play
Monitor future Apache CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.