Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-bv7f-s53t-uqe4
Vulnerability ID VCID-bv7f-s53t-uqe4
Aliases BIT-airflow-2026-34538
CVE-2026-34538
GHSA-r7vr-m4jw-r794
PYSEC-2026-21
Summary Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security model documentation that defines the Viewer role as read-only. Airflow uses the FAB Auth Manager to manage access control on a per-resource basis. The Viewer role is intended to be read-only by default, and the security model documentation defines Viewer users as those who can inspect DAGs without accessing sensitive execution results. Users are recommended to upgrade to Apache Airflow 3.2.0 which resolves this issue.
Status Published
Exploitability 0.5
Weighted Severity 5.9
Risk 3.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-668 Exposure of Resource to Wrong Sphere
System Score Found at
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2026-34538
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-r7vr-m4jw-r794
cvssv3.1 6.5 https://github.com/apache/airflow
generic_textual MODERATE https://github.com/apache/airflow
cvssv3.1 6.5 https://github.com/apache/airflow/pull/64415
generic_textual MODERATE https://github.com/apache/airflow/pull/64415
ssvc Track https://github.com/apache/airflow/pull/64415
cvssv3.1 6.5 https://github.com/apache/airflow/releases/tag/3.2.0
generic_textual MODERATE https://github.com/apache/airflow/releases/tag/3.2.0
cvssv3.1 6.5 https://lists.apache.org/thread/9mq3msqhmgjwdzbr6bgthj4brb3oz9fl
generic_textual MODERATE https://lists.apache.org/thread/9mq3msqhmgjwdzbr6bgthj4brb3oz9fl
ssvc Track https://lists.apache.org/thread/9mq3msqhmgjwdzbr6bgthj4brb3oz9fl
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2026-34538
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-34538
cvssv3.1 6.5 http://www.openwall.com/lists/oss-security/2026/04/09/9
generic_textual MODERATE http://www.openwall.com/lists/oss-security/2026/04/09/9
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-34538
https://github.com/apache/airflow
https://github.com/apache/airflow/pull/64415
https://github.com/apache/airflow/releases/tag/3.2.0
https://lists.apache.org/thread/9mq3msqhmgjwdzbr6bgthj4brb3oz9fl
https://nvd.nist.gov/vuln/detail/CVE-2026-34538
http://www.openwall.com/lists/oss-security/2026/04/09/9
GHSA-r7vr-m4jw-r794 https://github.com/advisories/GHSA-r7vr-m4jw-r794
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/apache/airflow
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/apache/airflow/pull/64415
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-09T14:05:44Z/ Found at https://github.com/apache/airflow/pull/64415
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/apache/airflow/releases/tag/3.2.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://lists.apache.org/thread/9mq3msqhmgjwdzbr6bgthj4brb3oz9fl
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-09T14:05:44Z/ Found at https://lists.apache.org/thread/9mq3msqhmgjwdzbr6bgthj4brb3oz9fl
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-34538
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at http://www.openwall.com/lists/oss-security/2026/04/09/9
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.052
EPSS Score 0.00018
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T20:38:08.252264+00:00 Pypa Importer Import https://github.com/pypa/advisory-database/blob/main/vulns/apache-airflow/PYSEC-2026-21.yaml 38.6.0