CVE-2026-40913

Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the `ImportError.can_read` permission when the failing file has no registered DAG. This happens when a file fails to parse before any DAG is defined, or when all of its previously registered DAGs are removed but the parse error remains. Users who should not see that file's details can read stack traces that may expose file paths and code. Users are advised to upgrade to Apache Airflow 3.4.0 or later, which restricts these stack traces to users with the new `IMPORT_ERRORS_ALL` permission.

• CWE-285

• https://github.com/apache/airflow/pull/69790
• https://lists.apache.org/thread.html/t04l76dtx12m5cw8zfsnzo9r5rqnw0qv
• https://www.openwall.com/lists/oss-security/2026/11/09/3

Published

Nov 9, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40908WWBN AVideo is an open source video platform. In versions 29…5.3
• CVE-2026-40909WWBN AVideo is an open source video platform. In versions 29…6.5
• CVE-2026-4091The OPEN-BRAIN plugin for WordPress is vulnerable to Cross-S…6.1
• CVE-2026-40910frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp cont…9.1
• CVE-2026-40911WWBN AVideo is an open source video platform. In versions 29…10
• CVE-2026-40912Traefik is an HTTP reverse proxy and load balancer. Prior to…8.2
• CVE-2026-40914A vulnerability exists in Apache Artemis whereby an applicat…4.3
• CVE-2026-40915A flaw was found in GIMP. A remote attacker could exploit an…7.8
• CVE-2026-40916A flaw was found in GIMP. A stack buffer overflow vulnerabil…5.5
• CVE-2026-40917A flaw was found in GIMP. This vulnerability, a heap buffer …7.1
• CVE-2026-40918A flaw was found in GIMP. Processing a specially crafted PVR…5.5
• CVE-2026-40919A flaw was found in GIMP. This vulnerability, a buffer overf…5.5