Is CVE-2026-34538 actively exploited?

No active exploitation of CVE-2026-34538 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-34538 be exploited remotely?

Yes. CVE-2026-34538 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-34538?

CVE-2026-34538 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2026-34538

MEDIUM

CVE-2026-34538

CWE-668Published: April 9, 2026· Updated: Apr 15, 2026

6.5

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:11.0th

Official Description

Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security model documentation that defines the Viewer role as read-only.

Airflow uses the FAB Auth Manager to manage access control on a per-resource basis. The Viewer role is intended to be read-only by default, and the security model documentation defines Viewer users as those who can inspect DAGs without accessing sensitive execution results.

Users are recommended to upgrade to Apache Airflow 3.2.0 which resolves this issue.

NVD Source

Technical Analysis

CVE-2026-34538 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 6.5.