THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-48891 (MEDIUM 4.3) — A bug in Apache Airflow's `/ui/dependencies` scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the `dep.source` and `dep.target` fields of trigger / sensor dependency entries. An aut

[NVD] CVE-2026-48891 (MEDIUM 4.3) — A bug in Apache Airflow's `/ui/dependencies` scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the `dep.source` and `dep.target` fields of trigger / sensor dependency entries. An aut

lownvdPublished 2026-07-07

CVE-2026-48891 CVSS: 4.3 MEDIUM Published: 2026-07-07T10:16:41.373

A bug in Apache Airflow's `/ui/dependencies` scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the `dep.source` and `dep.target` fields of trigger / sensor dependency entries. An authenticated UI user with read permission on some Dags

Indicators of compromise

CVE-2026-48891cve
CVE-2026-28563cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-48891