CVE-2026-34538
2 advisories.
PyPI/apache-airflow CVE-2026-34538: medium 6.5
Apache Airflow has an authorization bypass in DagRun wait endpoint
Action: Upgrade apache-airflow to 3.2.0 or later.
pip install apache-airflow==3.2.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 3.2.0 | - |
Fixed versions
| 3.2.0 |
Sources
- osv: GHSA-r7vr-m4jw-r794
- https://nvd.nist.gov/vuln/detail/CVE-2026-34538
- https://github.com/apache/airflow/pull/64415
- https://github.com/apache/airflow
- https://github.com/apache/airflow/releases/tag/3.2.0
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-21.yaml
- https://lists.apache.org/thread/9mq3msqhmgjwdzbr6bgthj4brb3oz9fl
- http://www.openwall.com/lists/oss-security/2026/04/09/9
CVE-2026-34538 · published · modified · JSON
PyPI/apache-airflow CVE-2026-34538: medium 6.5
Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with t
Action: Upgrade apache-airflow to 3.2.0 or later.
pip install apache-airflow==3.2.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 3.2.0 | - |
Fixed versions
| 3.2.0 |
Sources
- osv: PYSEC-2026-21
- http://www.openwall.com/lists/oss-security/2026/04/09/9
- https://lists.apache.org/thread/9mq3msqhmgjwdzbr6bgthj4brb3oz9fl
- https://github.com/apache/airflow/pull/64415
- https://github.com/advisories/GHSA-r7vr-m4jw-r794
CVE-2026-34538 · published · modified · JSON