CVE-2026-40963: Apache Airflow Unauthorized DAG Metadata Disclosure

Technical summary

The structure_data endpoint in the Airflow UI failed to enforce per-DAG read authorization before returning external dependency graph nodes for linked DAGs. When a user with read access to DAG A queried the endpoint, the response included node identifiers and dependency metadata for DAG B, C, and other linked DAGs without verifying the caller's read permission on those downstream/upstream DAGs. This violates the access control model in deployments that partition DAG visibility by team or role. The issue stems from incomplete authorization checks in the endpoint handler (CWE-285: Improper Authorization).

Business impact

In shared Airflow environments where different teams manage separate workflows, this vulnerability enables cross-team workflow discovery. A user from Team A can infer the existence, names, and interdependencies of Team B's critical workflows. While direct access to Team B's DAG definitions remains blocked, leaked topology information can aid reconnaissance, inform social engineering, or reveal business-sensitive process flows. Organizations that use Airflow's per-DAG RBAC to enforce strict workflow isolation should prioritize remediation.

Affected systems

Apache Airflow versions prior to 3.2.2 are affected. Any deployment using the web UI or REST API to query the structure_data endpoint with multi-DAG environments and per-DAG read scoping is potentially vulnerable. Self-managed and cloud-hosted Airflow instances are both at risk if running vulnerable versions.

Exploitability

Exploitation requires valid Airflow UI or API credentials (PR:L in CVSS). An authenticated user simply needs to query the structure_data endpoint for a DAG they are authorized to read; linked DAG metadata is returned without additional interaction or complex attack steps. However, the attack surface is limited to users who already have authentication and at least one DAG read grant. The CVSS score of 3.1 (LOW) reflects limited confidentiality impact and high barrier to exploitation (AC:H suggests the vulnerability may only manifest under specific deployment configurations or DAG linkage topologies).

Remediation

Upgrade to Apache Airflow 3.2.2 or later. In that version, the structure_data endpoint enforces read authorization checks on all linked DAGs before returning their metadata in the response graph. No workarounds are available for older versions; patching is the primary remediation path. Verify the upgrade against the official Apache Airflow release notes and security advisory.

Patch guidance

Consult the Apache Airflow project's official release notes for version 3.2.2 and later. The patch adds authorization validation logic to the structure_data endpoint handler. Deployment steps vary by installation method (pip, Docker, Kubernetes, managed services); follow your vendor's upgrade procedure. Test the update in a non-production environment first, especially if your Airflow instance has custom plugins or extensions that extend the UI or API. Rolling upgrades are typically safe but confirm with your deployment topology before production rollout.

Detection guidance

In the short term, monitor Airflow API/UI access logs for queries to the structure_data endpoint by users with limited DAG read scope. If users access structure_data for a DAG they own but the response includes linked DAGs outside their authorized scope, log those events for investigation. Enable Airflow's audit logging if available in your version. Implement network-level monitoring if the Airflow API is exposed; look for unusual patterns of cross-DAG queries. After patching, re-audit access logs to confirm authorization checks are now enforced.

Why prioritize this

This vulnerability rates LOW severity due to its limited scope (information disclosure only), requirement for prior authentication, and conditional exploitability. However, prioritization should reflect your organization's data classification and team isolation model. If your Airflow deployment uses per-DAG RBAC to enforce strict workflow secrecy across teams, or if workflow topology is considered confidential intellectual property, prioritize the patch in your next maintenance window. If Airflow is internal-only and workflows are not sensitive, defer to a routine patch cycle. The lack of KEV status and public exploit suggests minimal real-world pressure, but the fix is straightforward.

Risk score, explained

CVSS 3.1 (LOW) balances several factors: confidentiality impact is low because only metadata and topology are leaked, not DAG code or execution logs; integrity and availability are unaffected; the attacker needs valid credentials and at least one DAG read grant; and the vulnerability is conditional on specific deployment configurations (AC:H). The score is not indicative of business risk in your environment—adjust your internal risk ranking based on whether workflow topology isolation is a compliance or security requirement.

Frequently asked questions