6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24098

CVE-2026-24098: Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors

Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to.

Users are advised to upgrade to 3.1.7 or later, which resolves this issue

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24098

CVE-2026-24098:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
apache-airflow	pip	< 3.1.7	3.1.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an information disclosure weakness in Apache Airflow's API for retrieving DAG import errors. The analysis of the patch 43c3262597a1a624a835784b1b657510f395985d shows that two functions, get_import_error and get_import_errors, contained a flawed authorization check. They used auth_manager.is_authorized_dag(method="GET", ...) to decide if a user could view import errors. However, as stated in the pull request, this check only verifies if a user can list DAGs, not if they have read permissions on the specific DAGs generating the errors. The vulnerable logic would incorrectly grant access to all import errors if this check passed. This allowed any authenticated user with permission to see the DAG list to view potentially sensitive details (file paths, code snippets, stack traces) from the import errors of any DAG in the system, even those they were not authorized to access. The patch rectifies this by removing the faulty check and ensuring that errors are filtered based on the user's specific DAG-level permissions using get_authorized_dag_ids.

Vulnerable functions

get_import_error

airflow-core/src/airflow/api_fastapi/core_api/routes/public/import_error.py

The function performed an incorrect authorization check using `auth_manager.is_authorized_dag(method="GET", user=user)`. This check only verified if a user had permission to list DAGs, not whether they had permission to read the specific DAG associated with the import error. If the check passed, the function would return the import error, allowing an authenticated user to view sensitive information for DAGs they were not authorized to access.

get_import_errors

airflow-core/src/airflow/api_fastapi/core_api/routes/public/import_error.py

This function fetched all import errors and then used a flawed authorization check, `auth_manager.is_authorized_dag(method="GET", user=user)`. A positive result from this check, which only confirmed the user's permission to list DAGs, would cause the function to return all import errors. This exposed potentially sensitive information from the error logs of DAGs the user was not authorized to view.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.