GHSA-5g2w-9f8g-g5q7

Description

### Impact **Exposure of Sensitive Information:** An information disclosure vulnerability exists in the Apache Airflow UI that allows authenticated users to view `Import Errors` for DAGs they are not authorized to access. In affected versions, the **Import Errors** view does not correctly filter errors based on granular DAG permissions. This means a user with access to only `DAG_A` can view import errors generated by `DAG_B`, `DAG_C`, or system-level DAGs. These error logs often contain file paths, code snippets, or stack traces that reveal the internal structure and logic of restricted DAGs. ### Patches Users should upgrade to Apache Airflow **3.1.7** or later. This version strictly enforces DAG-level permissions on the Import Errors view. ### Workarounds There are no known workarounds other than upgrading. ### Resources * [CVE-2026-24098](https://nvd.nist.gov/vuln/detail/CVE-2026-24098) * [Pull Request #60801](https://github.com/apache/airflow/pull/60801) * [Mailing List Announcement](https://lists.apache.org/thread/nx96435v77xdst7ls5lk57kqvqyj095x)