criticalInvestigatingApache

Apache Airflow Import Errors API Exposes Raw Stack Traces via CVE-2026-40913

Investigating(current)
Trending(upcoming)
Workaround available(upcoming)
Resolved(upcoming)

Executive summary

Apache Airflow's public Import Errors API returns raw parse-failure stack traces to users with the 'ImportError.can_read' permission when a failing file lacks a registered DAG. This vulnerability may expose internal file paths and source code to unauthorized users.

No verified workaround yet

None of the linked reports describe a mitigation. Follow this incident to hear when one appears.

Official fix

Technical root cause

The public Import Errors API exposes raw parse-failure stack traces for files lacking registered DAGs to users possessing the 'ImportError.can_read' permission.

Evidence

1 report · 1 CVEShow

[1]
CVE First report21 hours ago
Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the `ImportError.can_read` permission when the failing file: CVE-2026-40913 (Critical)(opens security advisory in a new tab)
Critical severity. Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the `ImportError.can_read` permission when the failing file has no registered DAG. This happens when a file fails to parse before any DAG is defined, or when all of its previously registered DAGs are removed but the parse error remains. Users who should not see that file's details can read stack traces that may expose file paths and code. Users are advised to upgrade to…
by Tenable 0upvotes 0comments

Timeline

First report on security advisoryNov 9, 10:17 UTC
Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the `ImportError.can_read` permission when the failing file: CVE-2026-40913 (Critical)
Source