CVE-2026-41014

The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization. An authenticated UI/API user with global Asset:read permission could enumerate partition run state, schedule configuration, and asset wiring for Dags they were not authorized to read. Affects deployments that rely on per-Dag read scoping while granting users broader Asset access. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.

• CWE-862

• https://github.com/apache/airflow/pull/65344Issue Tracking, Patch
• https://lists.apache.org/thread/12nbzwwby7g883w2j13gn7ny1545xob9Mailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2026/05/31/4Mailing List, Third Party Advisory

Published

Jun 1, 2026

Last Modified

Jul 21, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41008Spring Security Authorization Server's authorization endpoin…6.1
• CVE-2026-41009When the director sends a long-running request (e.g. compile…5.8
• CVE-2026-4101IBM Verify Identity Access Container 11.0 through 11.0.2 and…9.8
• CVE-2026-41010ReleaseJob#unpack builds job_dir = File.join(@release_dir, '…8.7
• CVE-2026-41011PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" w…8.7
• CVE-2026-41013Input validation bypass in SMB volume mount handling in Clou…8.1
• CVE-2026-41015radare2 before 9236f44, when configured on UNIX without SSL,…7.4
• CVE-2026-41016Apache Airflow's SMTP provider `SmtpHook` called Python's `s…5.9
• CVE-2026-41017Apache Airflow's `JWTRefreshMiddleware` set the JWT auth coo…5.9
• CVE-2026-41018The Elasticsearch logging provider, when configured with a `…6.5
• CVE-2026-41030In ONLYOFFICE DesktopEditors before 9.3.0, the update servic…6.2
• CVE-2026-41031A Stored Cross-Site Scripting vulnerability in Vinna Process…9.3