Apache Airflow: Dag source endpoint returns the whole file, exposing co-located Dags the caller cannot read

Impact

The Dag source endpoint and the equivalent UI view returned the entire source file without stripping Dags the caller is not authorized to read, so per-DAG access control was bypassed for anyone authorized on a single Dag in that file. Pipeline source routinely carries connection ids, bucket names, cluster endpoints and inline logic that a tenant was not meant to see. On a multi-tenant scheduler in front of a GPU fleet this turns one granted Dag into visibility of a neighbour's whole pipeline definition. Only deployments that co-locate multiple Dags in one file and rely on per-DAG access control are affected; one-Dag-per-file deployments are not.

Who can reach it

Network access to the Airflow UI or REST API as an authenticated user with read permission on at least one Dag in the target source file.

What to do

Upgrade to apache-airflow 3.3.0 or later and restart the API server. As a structural mitigation, split Dags belonging to different tenants into separate source files so per-DAG authorization matches file boundaries. No worker or GPU node change.

References

Related entries

• Apache Airflow: task-instance API returns deferred trigger kwargs unmasked, exposing secrets passed to triggersCVE-2026-49487 · Apache Airflow (REST API task-instance endpoints, deferred trigger kwargs)Medium
• Dell OpenManage Server Administrator (relative path traversal): A low-privileged remote attacker reads arbitrary filesCVE-2026-56794 · Dell OpenManage Server Administrator (relative path traversal)Medium
• Apache Airflow: JSON Variable secrets shown in cleartext in the Rendered Templates viewCVE-2026-59244 · Apache Airflow secrets masker (Rendered Templates view, var.json dict values)Medium
• Apache Airflow: masker misses team-prefixed config sections, exposing team Celery broker URLs with credentialsCVE-2026-65017 · Apache Airflow (secrets masker, team-scoped config sections in multi-team mode)Medium
• Airflow Google provider: team scope dropped in Secret Manager backend, so one team resolves another's credentialsCVE-2026-68868 · Apache Airflow Google provider (Google Cloud Secret Manager secrets backend, team scoping)Medium
• Apache Airflow Yandex provider (Lockbox secrets backend, team-scope lookup): When the team-scoped lookup for aCVE-2026-68871 · Apache Airflow Yandex provider (Lockbox secrets backend, team-scope lookup)Medium