CVE-2026-41014: Apache Airflow Unauthorized DAG Access via Asset Permissions

Technical summary

CVE-2026-41014 is an improper access control vulnerability in Apache Airflow's partitioned_dag_runs endpoints. The vulnerability stems from enforcement of asset-level permissions (Asset:read) without corresponding per-DAG authorization checks. An authenticated user holding global Asset:read permission can query the partitioned_dag_runs endpoint to enumerate partition run metadata, schedule configuration, and asset dependency graphs for DAGs outside their authorization scope. This represents a broken access control pattern where coarse-grained permissions bypass fine-grained resource isolation. The issue is classified as CWE-862 (Missing Authorization). CVSS score 4.3 reflects the low attack complexity, low privilege requirement, and information disclosure nature (confidentiality impact only, no integrity or availability compromise).

Business impact

The primary risk is unauthorized information disclosure. Users with legitimate need-to-know restrictions on sensitive DAGs—such as those processing regulated data, competitive workloads, or isolated team projects—may have their pipeline state and configuration exposed to colleagues with broader asset permissions. This could leak business logic, data dependencies, scheduling patterns, and asset integrations. Organizations using Airflow for multi-tenant environments, compliance-regulated workflows, or team-based access controls face the highest exposure. The impact is bounded because no data modification or pipeline disruption is possible; this is reconnaissance-level access only.

Affected systems

Apache Airflow versions prior to 3.2.2 are affected. The vulnerability only manifests in deployments configured with per-DAG read access restrictions (role-based or user-based isolation) while concurrently granting users or roles Asset:read permission at the global level. Deployments with flat access models (everyone can read everything, or access is role-locked at DAG level without asset-level separation) are not vulnerable to this specific authorization bypass because the permission inconsistency does not arise.

Exploitability

Exploitation requires an existing authenticated user account with UI or API access. An attacker cannot exploit this remotely without credentials. Once authenticated, the attack is trivial: any user with Asset:read permission can simply invoke or query the partitioned_dag_runs endpoint. No special tooling, social engineering, or race conditions are required. The barrier to exploitation is authentication and presence of the permission misconfiguration, not technical sophistication. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog as of the advisory date.

Remediation

Upgrade Apache Airflow to version 3.2.2 or later. The patch enforces per-DAG authorization checks on the partitioned_dag_runs endpoints, ensuring that Asset:read permission alone does not grant access to restricted DAGs. Organizations unable to upgrade immediately should audit Airflow role assignments to identify users or service accounts with global Asset:read permissions, and restrict those permissions to only users requiring broad asset visibility. Consider implementing network-level access controls to the partitioned_dag_runs endpoint if segmentation is critical and patching is delayed.

Patch guidance

Verify the Apache Airflow release notes and vendor advisory for version 3.2.2 or later to confirm the authorization fix is included. Test the upgrade in a staging environment with a replica of your role-based access control configuration to ensure the per-DAG checks function as expected and do not break legitimate user workflows. Monitor for any API calls to partitioned_dag_runs endpoints during and after the upgrade to detect anomalies or access pattern changes. If you are using Apache Airflow provided as a managed service (e.g., AWS MWAA, GCP Cloud Composer), check the vendor's upgrade timeline and apply patches according to their release schedule.

Detection guidance

Review Airflow audit logs and API access logs for queries to partitioned_dag_runs endpoints, particularly from users or service accounts with Asset:read permission but restricted DAG access. Look for repeated or bulk enumeration of partition state and schedule metadata across multiple DAGs. Implement alerting on unauthorized DAG metadata access patterns. Check role assignments and permission matrices to identify over-provisioned Asset:read grants that may be exploited. In the absence of comprehensive audit logging, a manual permissions audit comparing DAG-level restrictions against asset-level permissions is prudent.

Why prioritize this

This vulnerability merits prompt but not emergency patching. The CVSS score of 4.3 (Medium) reflects low attack complexity and the information-disclosure-only impact. The main drivers for prioritization are: (1) likelihood of misconfigured access control in multi-team Airflow deployments, (2) potential for subtle data leakage in compliance-sensitive environments, and (3) ease of exploitation once a malicious insider or over-privileged account is present. Organizations relying on Airflow role separation for data governance or team isolation should prioritize the upgrade within 4–6 weeks. Others may schedule patching within routine maintenance windows.

Risk score, explained

The CVSS 4.3 score reflects: Attack Vector (Network) and low privilege requirement (authenticated user), resulting in moderate accessibility; Attack Complexity (Low) because no special conditions are required; Confidentiality impact (Low) because only metadata and configuration are exposed, not actual data; and no impact to Integrity or Availability. The severity is Medium rather than High because the vulnerability does not enable data modification, denial of service, or remote code execution, and the attack prerequisite (authentication) limits blast radius. The score appropriately penalizes authorization bypass but recognizes the limited scope of disclosure.

Frequently asked questions