CVE-2026-40913
— UNSCOREDpublic exploit availablePublished 2026-11-09 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the `ImportError.can_read` permission when the failing file has no registered DAG. This happens when a file fails to parse before any DAG is defined, or when all of its previously registered DAGs are removed but the parse error remains. Users who should not see that file's details can read stack traces that may expose file paths and code. Users are advised to upgrade to Apache Airflow 3.4.0 or later, which restricts these stack traces to users with the new `IMPORT_ERRORS_ALL` permission.
Weaknesses
CWE-285
Public exploit & PoC references
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2023-54410PoC
- CRITICALCVE-2025-11969
- HIGHCVE-2025-71426PoC
- HIGHCVE-2026-10030
- MEDIUMCVE-2026-100878PoC
- HIGHCVE-2026-100885PoC
- MEDIUMCVE-2026-100897
- MEDIUMCVE-2026-101006
Related by shared AI tags and CWE weakness class. Browse the full archive.