CVE-2026-40690
Apache Airflow ≤ 3.2.1
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2026-40690 is a medium-severity Insufficient Granularity of Access Control (CWE-1220) vulnerability in Apache Airflow. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique System Information Discovery (T1082); ranked at the 28th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25419
Vulnerability Data
The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment and learn the existence…
more
and names of DAGs and assets outside their authorized scope. Users are recommended to upgrade to version 3.2.1, which fixes this issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vuln enables unauthorized enumeration of system assets/DAGs via the dependency graph (T1082 System Information Discovery) and access to data in an information repository beyond granted permissions (T1213).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces DAG read permissions on every node of the asset dependency graph so unauthorized users cannot traverse or discover out-of-scope assets.
Enforces information-flow rules that block the graph view from returning DAG or asset metadata the requesting user is not authorized to read.
Limits each user to the minimal set of DAG read permissions, reducing the attack surface even if graph-level enforcement is incomplete.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.IR-01's segmentation + zero-trust rules directly enforce minimum-necessary access at network boundaries, removing most instances of overly broad policy; CWE-1220 can still exist in application-layer or intra-segment controls that this single outcome does not address.
PR.PS-06's general SDLC practices can surface granularity issues during design/review (partial prevention) but do not specifically target access-control policy breadth, so they remove only part of CWE-1220's risk.
CWE-1220 permits unauthorized access to sensitive assets but neither prevents nor impairs the delivery of adverse-event information to authorized recipients.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Directly requires information-access restriction at the level of individual assets and operations, addressing the granularity gap.
Establishes the overarching access-control policy whose granularity directly determines whether the weakness exists.
Defines the assignment and review of access rights; insufficient granularity in those rights is the root of CWE-1220.
Specifies management of privileged access rights, where overly broad privileges are a common manifestation of the weakness.
Limits use of privileged utilities; overly coarse access rules can still allow unauthorized utility access.