{"items":[{"id":"NVI-00018377","kind":"vulnerability","title":"Apache Airflow has an authorization bypass in DagRun wait endpoint","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-r7vr-m4jw-r794","CVE-2026-34538"],"plain_summary":"GitHub lists this reviewed advisory for apache-airflow. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-19910369a5a979dfb119967ba612d3e9"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-05T14:27:18.000Z","value":"6.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-19910369a5a979dfb119967ba612d3e9"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-19910369a5a979dfb119967ba612d3e9","url":"https://github.com/advisories/GHSA-r7vr-m4jw-r794","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-r7vr-m4jw-r794","publisher":"GitHub Advisory Database","observed_at":"2026-11-07T00:52:58.259Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-19910369a5a979dfb119967ba612d3e9"],"technology":"apache-airflow","known_exclusions":[],"conditions_summary":"Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security model documentation that defines the Viewer role as read-only.\n\nAirflow uses the FAB Auth Manager to manage access control on a per-resource basis. The Viewer role is intended to be read-only by default, and the security model documentation defines Viewer users as those who can inspect DAGs without accessing sensitive execution results.\n\nUsers are recommended to upgrade to Apache Airflow 3.2.0 which resolves this issue.","public_affected_ranges":[">= 3.0.0, < 3.2.0"]}],"null_published_at":"2026-11-07T07:07:39.828Z","source_updated_at":"2026-06-05T14:27:18.000Z","source_disclosed_at":"2026-04-09T12:31:10.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-07T00:52:58.259Z"}],"next_cursor":null,"snapshot_revision":"42594"}