CVE-2026-40963 Overview
CVE-2026-40963 is a broken access control flaw in Apache Airflow's structure_data endpoint. The endpoint returned external dependency graph nodes for linked Dags without verifying whether the caller held read permission on those linked Dags. An authenticated UI or API user authorized for a single Dag could enumerate linked Dag IDs and dependency metadata across other Dags. The flaw breaks per-Dag read scoping that multi-tenant Airflow deployments use to isolate dependency topology between teams. The issue is tracked under [CWE-285] Improper Authorization and is fixed in apache-airflow 3.2.2.
Critical Impact
Authenticated tenants can enumerate cross-team Dag identifiers and dependency relationships, exposing internal pipeline topology that per-Dag access control was intended to hide.
Affected Products
- Apache Airflow versions prior to 3.2.2
- Multi-tenant Airflow deployments relying on per-Dag read scoping
- Airflow UI and REST API consumers of the structure_data endpoint
Discovery Timeline
- 2026-06-01 - CVE-2026-40963 published to NVD
- 2026-06-01 - Last updated in NVD database
Technical Details for CVE-2026-40963
Vulnerability Analysis
The structure_data endpoint in the Airflow UI serves graph data used to render Dag dependency diagrams. When a Dag has external dependencies on other Dags, the endpoint includes nodes describing those linked Dags. The endpoint correctly authorized access to the primary Dag but omitted the same permission check on linked Dags returned in the response.
An authenticated user with read access to one Dag can query structure_data and receive identifiers and dependency metadata for Dags they are not entitled to view. This violates the per-Dag authorization model that operators rely on to segment workloads across teams in shared Airflow instances.
The exposure is metadata-only and does not reveal task code, Dag source, or execution data. However, leaked Dag IDs and dependency edges can reveal organizational structure, naming conventions, and pipeline relationships that aid further reconnaissance.
Root Cause
The endpoint enforced authorization on the requested Dag but did not filter linked Dag nodes through the same access control layer. Linked Dags were resolved and serialized into the response regardless of the caller's permission set.
Attack Vector
Exploitation requires an authenticated session with read permission on at least one Dag. The attacker sends an authenticated request to the structure_data endpoint and parses the returned graph for linked Dag identifiers and dependency edges. No special tooling or elevated privileges are required. See the Apache Airflow pull request for the corrective patch and the Apache mailing list advisory for vendor notes.
Detection Methods for CVE-2026-40963
Indicators of Compromise
- Authenticated requests to the Airflow structure_data endpoint that reference Dag IDs the caller has not previously interacted with through normal UI navigation.
- API access patterns showing a single user enumerating structure_data responses across many Dags in short succession.
- Unexpected Dag ID strings appearing in client-side logs or HTTP archives captured from low-privilege tenants.
Detection Strategies
- Review Airflow webserver access logs for high-frequency or scripted access to structure_data endpoints from non-administrative accounts.
- Correlate authenticated user permissions against the Dag IDs referenced in their structure_data responses to identify scope mismatches.
- Baseline normal user-to-Dag access ratios and alert on outliers indicating enumeration behavior.
Monitoring Recommendations
- Ingest Airflow application and reverse-proxy logs into a centralized analytics platform for query-level review.
- Monitor for repeated 200 OK responses from structure_data paired with subsequent requests targeting newly discovered Dag IDs.
- Track changes to role and Dag-level permission assignments to detect lateral expansion following enumeration.
How to Mitigate CVE-2026-40963
Immediate Actions Required
- Upgrade apache-airflow to version 3.2.2 or later across all webserver, scheduler, and worker components.
- Audit recent structure_data request logs for evidence of cross-tenant Dag enumeration before patching.
- Rotate any Dag IDs or naming patterns that disclose sensitive organizational information.
Patch Information
Apache addressed the flaw in apache-airflow 3.2.2. The fix applies the same per-Dag read permission filter to linked Dag nodes returned by structure_data. Refer to the GitHub pull request and the OpenWall oss-security update for change details.
Workarounds
- Restrict UI and API access to trusted networks where multi-tenant separation is not a security boundary.
- Limit authenticated user access to Dags that do not declare external dependencies on sensitive pipelines until the upgrade is applied.
- Place a reverse proxy in front of Airflow that blocks or rate-limits the structure_data endpoint for non-administrative roles.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
