{"action":"Upgrade apache-airflow to 3.1.7 or later.","affected":[{"fixed":"3.1.7","introduced":"3.0.0"}],"component":"apache-airflow","cve_ids":["CVE-2026-24098"],"ecosystem":"PyPI","epss":0.00827,"exploited":false,"fixed_versions":["3.1.7"],"ghsa_id":"GHSA-5g2w-9f8g-g5q7","id":"tcs_01M5KGR5CK9S3F7GAD9ADQ9GT5","modified_at":"2026-06-10T17:00:26.540320259Z","published_at":"2026-02-09T11:16:14.660Z","references":["https://osv.dev/vulnerability/PYSEC-2026-12","http://www.openwall.com/lists/oss-security/2026/02/09/3","https://lists.apache.org/thread/nx96435v77xdst7ls5lk57kqvqyj095x","https://github.com/apache/airflow/pull/60801","https://github.com/advisories/GHSA-5g2w-9f8g-g5q7"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-12","url":"https://osv.dev/vulnerability/PYSEC-2026-12"}],"summary":"Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have"}