CVE-2026-49296: Apache Airflow DAG Source Disclosure via Authorization Bypass

Technical summary

The vulnerability exists in the `GET /api/v2/dagSources/{dag_id}` endpoint and the corresponding UI component. When a caller requests the source of a specific DAG they are authorized to read, the implementation returns the full source file contents rather than filtering to only the requested DAG. This bypasses Airflow's per-DAG read authorization model. The flaw is a broken access control issue (CWE-639) where authorization checks are applied at the DAG selection level but not enforced when retrieving and returning file content. Network accessibility (no special client setup required), low complexity exploitation, and a low privilege requirement (authenticated user) make this exploitable in most Airflow deployments, resulting in a CVSS 3.1 score of 6.5 (Medium severity).

Business impact

Sensitive information disclosure is the primary impact. DAG source code often contains secrets, API keys, database credentials, and proprietary business logic. An authenticated user with legitimate access to one DAG can extract the source code of unrelated DAGs—potentially those belonging to other teams or business units—defeating the access control model that should isolate them. In regulated environments, this may violate data segregation requirements or compliance controls. The impact is confidentiality-focused; the vulnerability does not allow modification or denial of service.

Affected systems

Apache Airflow versions prior to 3.3.0 are vulnerable. The risk is specific to deployments that (1) store multiple DAGs in a single source file and (2) enforce per-DAG read authorization policies. Single-DAG-per-file deployments have no exposure because the full file and the requested DAG are one and the same. Organizations using default or recommended Airflow configurations (separate files per DAG) are not affected.

Exploitability

Exploitation requires valid Airflow credentials and network access to the API or UI. An authenticated user simply requests a DAG source they have permission to view; the returned file reveals all co-located DAGs without additional authentication or unusual attack complexity. No user interaction or specialized tools are needed. The barrier to exploitation is low for any insider or compromised account with basic Airflow access. This is not listed on CISA's KEV catalog, indicating no active exploitation in the wild has been widely reported, but the simplicity of the attack means defenders should not assume it is unexploited.

Remediation

Upgrade Apache Airflow to version 3.3.0 or later, which corrects the authorization logic to return only the source of the requested DAG and redact other DAGs in the same file. Organizations unable to upgrade immediately should review access control policies and audit logs to identify co-located DAGs and restrict read access to those source endpoints to only users who need it. Consider refactoring deployments to use one DAG per file if possible, which eliminates the architectural precondition for this flaw.

Patch guidance

Apply Apache Airflow 3.3.0 or later. Verify the upgrade by confirming that requesting a DAG source you have access to does not expose co-located DAGs you do not have permission to view. Test in a staging environment first to ensure no integration issues with custom DAG definitions or plugins. After upgrade, invalidate any cached or exported DAG source files that may have been disclosed prior to patching.

Detection guidance

Monitor API logs for `GET /api/v2/dagSources/` requests from accounts that access multiple DAGs or from users whose role should restrict them to specific DAGs. Compare the DAG they request against the DAG identifiers they are authorized to view; discrepancies indicate potential exploitation. Review UI access logs if per-DAG source viewing is tracked. Scan any downloaded or archived DAG source files for the presence of multiple DAG definitions from a single file and correlate user access rights. In forensic investigations, check for repeated source requests across different DAG IDs by the same user over a short timeframe.

Why prioritize this

This vulnerability merits timely but not emergency patching. CVSS 6.5 (Medium) reflects moderate confidentiality risk without integrity or availability impact. Organizations with strict per-DAG access control policies and multi-DAG files face higher risk and should prioritize patching. Those with single-DAG-per-file architectures can schedule the upgrade during a normal maintenance window. The lack of KEV designation and no public weaponized exploits reduce urgency, but the simplicity of exploitation and the nature of the data at risk (secrets, business logic) argue against deferral. Target patching within 30–60 days depending on your DAG architecture and sensitivity of DAG sources.

Risk score, explained

CVSS 3.1 score of 6.5 is driven by High confidentiality impact (source code and secrets exposed), no integrity or availability impact, low attack complexity, low privilege requirement, and network accessibility. The score assumes a default Airflow setup with authentication enabled. Organizations with looser network segmentation or higher-privilege default accounts may experience higher practical risk. The scope is unchanged (no privilege escalation outside Airflow itself), keeping severity in the Medium band.

Frequently asked questions