CVE-2026-48891

{
  "id": "CVE-2026-48891",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-07T10:16:41.373",
  "lastModified": "2026-10-25T20:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A bug in Apache Airflow's `/ui/dependencies` scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the `dep.source` and `dep.target` fields of trigger / sensor dependency entries. An authenticated UI user with read permission on some Dags could enumerate the identifiers of other Dags they were not authorized to read by inspecting the dependency graph for trigger / sensor references. Affects deployments that rely on per-Dag read scoping to keep Dag identifiers private across teams. This is a residual gap in the fix for CVE-2026-28563, which filtered the top-level Dag key but did not propagate the filter into the trigger / sensor dep-source / dep-target fields. Users who already upgraded for CVE-2026-28563 should additionally upgrade to `apache-airflow` 3.3.0 or later to cover the residual trigger / sensor dependency leak."
    },
    {
      "lang": "es",
      "value": "Un error en el endpoint del grafo de programación “/ui/dependencies” de Apache Airflow aplicó el filtro de Dags legibles del llamador a la clave Dag serializada de nivel superior, pero aún emitía IDs de Dag referenciados a través de los campos “dep.source” y “dep.target” de las entradas de dependencia de disparador / sensor. Un usuario autenticado de la interfaz de usuario con permiso de lectura en algunos Dags podía enumerar los identificadores de otros Dags que no estaba autorizado a leer, inspeccionando el grafo de dependencias en busca de referencias de disparador / sensor. Afecta a los despliegues que dependen del alcance de lectura por Dag para mantener los identificadores de Dag privados entre equipos. Esta es una brecha residual en la corrección para CVE-2026-28563, que filtró la clave Dag de nivel superior pero no propagó el filtro a los campos dep-source / dep-target de disparador / sensor. Los usuarios que ya actualizaron para CVE-2026-28563 deberían actualizar adicionalmente a “apache-airflow” 3.3.0 o posterior para cubrir la fuga residual de dependencia de disparador / sensor."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Airflow",
          "defaultStatus": "unaffected",
          "collectionURL": "https://pypi.python.org",
          "packageName": "apache-airflow",
          "packageURL": "pkg:pypi/apache-airflow",
          "versions": [
            {
              "version": "0",
              "lessThan": "3.3.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-07T13:24:41.564185Z",
          "id": "CVE-2026-48891",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "3.3.0",
              "matchCriteriaId": "6E334749-0D93-4319-9286-B9AC590F4698"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/apache/airflow/pull/67627",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking"
      ]
    },
    {
      "url": "https://lists.apache.org/thread/wzc8nflg94rq6w8f5tvtlo0o3g4wjrfl",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28563",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}