https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T20:20:44.281823+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-41014 CVE-2026-41014 — Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints 2026-10-02T20:20:44.283451+00:00

Affected: Apache Software Foundation Apache Airflow

The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization. An authenticated UI/API user with global Asset:read permission could enumerate partition run state, schedule configuration, and asset wiring for Dags they were not authorized to read. Affects deployments that rely on per-Dag read scoping while granting users broader Asset access. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.

 https://cve.radiocsirt.org/vuln/ghsa-x2x7-p37c-43cr GHSA-x2x7-p37c-43cr — Apache Airflow has a Missing Authorization issue 2026-10-02T20:20:44.283505+00:00

Affected: PyPI: apache-airflow

The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization. An authenticated UI/API user with global Asset:read permission could enumerate partition run state, schedule configuration, and asset wiring for Dags they were not authorized to read. Affects deployments that rely on per-Dag read scoping while granting users broader Asset access. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.