CVE-2026-48891: Apache Airflow DAG Enumeration via Dependency Graph Information Disclosure

Technical summary

CVE-2026-48891 is a residual information disclosure in Apache Airflow's `/ui/dependencies` endpoint. The vulnerability exists because access control filtering is inconsistently applied across the endpoint's response structure. While the top-level serialized DAG key respects the caller's read permissions (filtering readable DAGs), the `dep.source` and `dep.target` fields within trigger and sensor dependency entries do not apply this filter. An authenticated user can therefore enumerate DAG identifiers of workflows outside their authorized scope by inspecting these unfiltered dependency references. This is a follow-up issue to CVE-2026-28563, which addressed the top-level filtering gap but left the dependency field leak intact. The root cause is a failure to propagate read-access filtering consistently across all response fields that reference DAGs.

Business impact

Organizations using Airflow's per-DAG read access controls as a security boundary to partition workflows across teams, projects, or compliance domains will experience a partial loss of that boundary. Workflow identifiers that should remain hidden can be discovered by users with UI access to any workflow they are authorized to read. In environments where workflow names encode sensitive information (e.g., customer names, project codes, or system tier) or where workflow existence itself is confidential, this leakage could enable competitive intelligence gathering, privilege escalation research, or compliance violations. The impact is limited to information disclosure—no unauthorized workflow execution, data access, or system modification occurs through this vulnerability. However, the leaked identifiers may enable attackers to focus further reconnaissance or social engineering efforts on specific, previously-unknown workflows.

Affected systems

All Apache Airflow versions prior to 3.3.0 that expose the `/ui/dependencies` endpoint are affected. This includes deployments using Airflow 2.x and early 3.x releases. The vulnerability requires that (1) the Airflow UI is enabled and accessible to authenticated users, and (2) access control policies use per-DAG read scoping to restrict which workflows different users can see. Environments that do not enforce per-DAG access restrictions (e.g., all authenticated users have read access to all DAGs, or no per-DAG RBAC is configured) are not meaningfully exposed to this particular leakage, though they remain subject to standard Airflow security practices.

Exploitability

Exploitation is straightforward and requires only valid Airflow UI credentials. No special configuration, race conditions, or complex attack steps are necessary. An authenticated user simply navigates to or queries the `/ui/dependencies` endpoint and parses the JSON response to extract DAG identifiers from the `dep.source` and `dep.target` fields of dependency entries. Enumeration can be automated via the Airflow REST API or UI requests, making it scalable. The attack is entirely passive—it leaves no suspicious logs or audit trail beyond normal API access. However, exploitation is limited to users with UI authentication; public deployments without authentication are already assumed to be insecure for other reasons. The CVSS score of 4.3 (Low-Medium) reflects the authentication requirement and the information-only impact, with no availability or integrity consequences.

Remediation

Immediate remediation is to upgrade Apache Airflow to version 3.3.0 or later. This version includes a fix that properly propagates read-access filtering to the `dep.source` and `dep.target` fields, ensuring that authenticated users cannot enumerate DAG identifiers outside their authorized scope. Organizations that previously patched CVE-2026-28563 must apply this additional upgrade, as the earlier fix was incomplete. Verification should confirm that the dependency graph endpoint correctly respects per-DAG RBAC policies before and after patching.

Patch guidance

Upgrade Apache Airflow to 3.3.0 or later. Refer to the official Apache Airflow release notes and security advisory for version-specific upgrade instructions, potential breaking changes, and any configuration adjustments needed. If you are currently running Airflow 2.x, verify the support status and upgrade path with your deployment environment (some organizations use extended support tracks). Test the patch in a staging environment to confirm that dependency graphs are still functional and that access control behavior is as expected. After upgrading, validate that users without read permission on a given DAG can no longer discover that DAG's identifier via the dependency graph, even when inspecting trigger or sensor references.

Detection guidance

Review Airflow audit logs and API access logs to identify suspicious patterns of `/ui/dependencies` requests or programmatic queries to the dependencies endpoint. Look for users or service accounts repeatedly accessing the endpoint with the apparent intent of enumerating DAG names (e.g., automated scanning, high request volume, cross-referenced responses). Implement network or WAF-level logging to track access to this endpoint if Airflow is exposed externally. Monitor for unauthorized knowledge of DAG identifiers that users should not have access to—this may surface in downstream attack attempts or reconnaissance activities targeting specific workflows. If per-DAG RBAC is in place, verify post-patch that the access controls are being enforced correctly by testing with a low-privileged account and confirming that unreadable DAG identifiers do not appear in the response.

Why prioritize this

While the CVSS score is moderate (4.3), prioritization should be based on organizational context. Organizations that (1) enforce per-DAG access control policies to segregate workflows across teams or security domains, and (2) consider DAG identifiers or existence to be confidential information, should prioritize this patch. Conversely, organizations with a flat access model (all authenticated users can read all DAGs) or those that do not treat workflow identifiers as sensitive can deprioritize it relative to more critical vulnerabilities. Because this is a residual gap in a previous fix (CVE-2026-28563), users who already patched that issue should treat this as high-priority follow-up to complete the remediation. The passive nature of the exploitation (no operational disruption) and the authentication requirement (not remotely exploitable without credentials) lower operational urgency compared to unauthenticated remote code execution vulnerabilities.

Risk score, explained

CVE-2026-48891 receives a CVSS 3.1 score of 4.3 (MEDIUM severity) due to the following factors: (1) Attack Vector: Network—the endpoint is accessible over HTTP(S), satisfying the 'N' requirement. (2) Attack Complexity: Low—no special conditions or race conditions are required. (3) Privileges Required: Low—authenticated users with minimal permissions (read on any single DAG) can exploit. (4) User Interaction: None—the attack is fully automatable. (5) Scope: Unchanged—only the Airflow system is affected, not other systems. (6) Confidentiality Impact: Low—only DAG identifiers (metadata) are leaked, not workflow code, logs, or data. (7) Integrity and Availability: None. The moderate score reflects that this is a metadata leakage issue with a real but limited blast radius, contingent on the organization's use of access controls to keep DAG names secret. The lack of KEV (Known Exploited Vulnerability) status indicates no public evidence of active exploitation in the wild at the time of publication.

Frequently asked questions