Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated Users

### Impact **Exposure of Sensitive Information:** An information disclosure vulnerability exists in the Apache Airflow UI that allows authenticated users to view `Import Errors` for DAGs they are not authorized to access. In affected versions, the **Import Errors** view does not correctly filter errors based on granular DAG permissions. This means a user with access to only `DAG_A` can view import errors generated by `DAG_B`, `DAG_C`, or system-level DAGs. These error logs often contain file paths, code snippets, or stack traces that reveal the internal structure and logic of restricted DAGs. ### Patches Users should upgrade to Apache Airflow **3.1.7** or later. This version strictly enforces DAG-level permissions on the Import Errors view. ### Workarounds There are no known workarounds other than upgrading. ### Resources * [CVE-2026-24098](https://nvd.nist.gov/vuln/detail/CVE-2026-24098) * [Pull Request #60801](https://github.com/apache/airflow/pull/60801) * [Mailing List Announcement](https://lists.apache.org/thread/nx96435v77xdst7ls5lk57kqvqyj095x)

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Severity from

GitHub (reviewed advisory)

Weakness

CWE-200

Also known as

BIT-airflow-2026-24098, CVE-2026-24098, PYSEC-2026-12

• nvd.nist.gov/vuln/detail/CVE-2026-24098
• github.com/apache/airflow/pull/60801
• github.com/apache/airflow
• lists.apache.org/thread/nx96435v77xdst7ls5lk57kqvqyj095x
• www.openwall.com/lists/oss-security/2026/02/09/3