---
id: "CVE-2026-40913"
page: "https://infrastack.ai/live/CVE-2026-40913"
kind: "vulnerability"
aliases: ["CVE-2026-40913"]
title: "Apache Airflow: Import Errors API leaks parse-failure stack traces to readers"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["apache-airflow", "rbac", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting", "single-user-deployment"]
published_at: "2026-11-09T10:17:10+00:00"
first_seen_at: "2026-11-09T10:25:49+00:00"
updated_at: "2026-11-09T10:26:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40913", "first_seen_at": "2026-11-09T10:25:49+00:00"}]
exploit_sources: []
---

# Apache Airflow: Import Errors API leaks parse-failure stack traces to readers

Link for people: https://infrastack.ai/live/CVE-2026-40913 (this .md is for agents)

Airflow's public Import Errors API returns the raw stack trace of a DAG file that failed to parse, to any user holding the ImportError.can_read permission, when that file has no registered DAG. An attacker with that read permission can see file paths and code from files they should not see.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `airflow version` and compare it to the fixed range below.
- Look at which roles hold `ImportError.can_read` in the Airflow access control configuration.

## Fix

- Apache Airflow: upgrade to `3.4.0` or later, which limits these stack traces to users with the new `IMPORT_ERRORS_ALL` permission.

## Timeline

- 2026-11-09T10:25:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-40913

## From the sources

Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the `ImportError.can_read` permission when the failing file has no registered DAG. This happens when a file fails to parse before any DAG is defined, or when all of its previously registered DAGs are removed but the parse error remains. Users who should not see that file's details can read stack traces that may expose file paths and code.

Users are advised to upgrade to Apache Airflow 3.4.0 or later, which restricts these stack traces to users with the new `IMPORT_ERRORS_ALL` permission.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_