Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-0212

NIXPKGS-2026-0212
published on
Permalink CVE-2026-24098
6.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
updated 2 months ago by @LeSuisse Activity log
  • Created automatic suggestion 2 months ago
  • @LeSuisse accepted 2 months ago
  • @LeSuisse published on GitHub 2 months ago
Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors

Apache Airflow versions before 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. Users are advised to upgrade to 3.1.7 or later, which resolves this issue

Affected products

apache-airflow
  • <3.1.7

Matching in nixpkgs

pkgs.apache-airflow

Programmatically author, schedule and monitor data pipelines

Package maintainers

Upstream announcement: https://lists.apache.org/thread/nx96435v77xdst7ls5lk57kqvqyj095x