Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions

CVE-2026-40690 · Published Apr 24, 2026 · updated Jul 13, 2026

Medium4.3

Fix: upgrade to 3.2.1rc1 or later

The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment and learn the existence and names of DAGs and assets outside their authorized scope.

Users are recommended to upgrade to version 3.2.1, which fixes this issue.

Affected versions

Package	Affected	Fixed in
apache-airflow PyPI	< 3.2.1rc1	3.2.1rc1

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity from: GitHub (reviewed advisory)
Weakness: CWE-1220
Also known as: BIT-airflow-2026-40690, CVE-2026-40690, PYSEC-2026-2356

More Apache Airflow advisories

All Apache Airflow

Medium 4.3Apr 24

Apache Airflow: improper access controlCVE-2026-38743fixed in 3.2.1rc1 Low 3.7Apr 18

Apache Airflow Exposes Secrets in Variables Saved as JSON DictionariesCVE-2026-32690fixed in 3.2.0 High 7.5Apr 18

In case of SQL errorsCVE-2026-30912fixed in 3.2.0 High 7.2Apr 18

Apache Airflow: code executionCVE-2026-25917fixed in 3.2.0 Medium 7.5Apr 16

Apache Airflow: JWT token appearing in logsCVE-2026-31987fixed in 3.2.0 High 8.1Apr 16

Apache Airflow: RCE by race condition in example_xcom dagCVE-2025-54550fixed in 3.2.0