Database/Control plane, storage & DevOps
Apache Airflow: Import Errors API shows raw DAG parse stack traces to users who should not see that file
Impact
When a DAG file fails to parse and has no registered DAG, Airflow's public Import Errors API returns the raw stack trace to any user with ImportError.can_read. Normally the DAG's own permissions would limit who sees it. The trace can expose file paths and pieces of pipeline code, so on a shared Airflow that runs ML pipelines, one team can read details of another team's DAG files. The record describes information disclosure only, with no code execution.
Who can reach it
Authenticated Airflow user holding the ImportError.can_read permission, with network access to the Airflow API.
What to do
Upgrade to Apache Airflow 3.4.0 or later, which limits these stack traces to the new IMPORT_ERRORS_ALL permission. Then restart the Airflow API/webserver components. After upgrading, check which roles get IMPORT_ERRORS_ALL. If you cannot upgrade yet, remove ImportError.can_read from roles that should not see every DAG file.
References
Related entries
- Cisco Intersight Device Connector for Nutanix Prism Central: The device connector exposes an unauthenticated APICVE-2026-5944 · Cisco Intersight Device Connector for Nutanix Prism CentralHigh
- OpenChoreo Backstage backend: hardcoded auth bypass exposes /api/* to unauthenticated callersCVE-2026-73666 · OpenChoreo Backstage backend (default auth policy)High
- HPE OneView: remotely exploitable session hijacking against the infrastructure management consoleCVE-2026-76718 · HPE OneView (web interface, session handling)High
- GitLab CE/EE: unsanitized Markdown JSON table content induces state-changing requests as a targeted userCVE-2026-78252 · GitLab CE/EE (Markdown JSON table renderer)High
- Ansible automation-controller: unauthenticated debug endpoints grab the scheduler lock and stall job dispatchCVE-2026-84486 · Red Hat Ansible Automation Platform automation-controller (unauthenticated scheduler debug views)High
- Ceph RGW (SigV4 signature verifier): Anyone handed a single presigned PUT URL gets more authority than whoever signedNCVD-2026-039-ceph-rgw-sigv4-signature-verifie · Ceph RGW (SigV4 signature verifier)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.