PYSEC-2026-1129

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/apache-airflow/PYSEC-2026-1129.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2026-1129

Aliases

Published

2026-07-07T16:03:09Z

Modified

2026-07-07T17:56:19Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Apache Airflow `/api/v2/dagReports` executes DAG Python in API

Details

API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.

References

Affected packages

PyPI / apache-airflow

Package

Name: apache-airflow; View open source insights on deps.dev
Purl: pkg:pypi/apache-airflow

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.0.0

Fixed

3.1.1

Affected versions

3.*

3.0.0

3.0.1rc1

3.0.1

3.0.2rc1

3.0.2rc2

3.0.2

3.0.3rc1

3.0.3rc2

3.0.3rc3

3.0.3rc4

3.0.3rc5

3.0.3rc6

3.0.3

3.0.4rc1

3.0.4rc2

3.0.4

3.0.5rc1

3.0.5rc2

3.0.5rc3

3.0.5

3.0.6rc1

3.0.6rc2

3.0.6

3.1.0b1

3.1.0b2

3.1.0rc1

3.1.0rc2

3.1.0

3.1.1rc1

3.1.1rc2

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/apache-airflow/PYSEC-2026-1129.yaml"