---
id: CVE-2026-28563
title: >-
  Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns
  the full DAG dependency graph without filtering by authorized DAG IDs
summary: >-
  Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns
  the full DAG dependency graph without filtering by authorized DAG IDs. This
  allows an authenticated user with only DAG Dependencies permission to
  enumerate DAG…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-732
vendor: apache
product: airflow
affected:
  - 'airflow >= 3.0.0, < 3.1.8'
patched:
  - airflow 3.1.8
published: '2026-03-17'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T07:18:50.063'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-28563'
references:
  - url: 'https://github.com/apache/airflow/pull/62046'
    label: security@apache.org
  - url: 'https://lists.apache.org/thread/dwzf62qg9z8wvfsjknpfd8bvtwghd49s'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/03/17/5'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-03-17T15:41:12.455979Z'
epss: 0.00457
epssPercentile: 0.39796
ingestedAt: '2026-11-05T06:38:03.607Z'
---

## Overview

Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authorized to view.


Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

## Affected

- `airflow >= 3.0.0, < 3.1.8`

## Remediation

Upgrade past the affected range:

- `airflow 3.1.8`