A bug in Apache Airflow’s /ui/dependencies scheduling graph endpoint propagates the caller’s readable‑Dag filter to the top‑level serialized Dag key while still emitting referenced Dag identifiers through the dep.source and dep.target fields of trigger and sensor dependency entries. The result is that an authenticated UI user with read permission on any set of Dags can enumerate identifiers of other Dags they are not authorized to read by examining the dependency graph for trigger or sensor references. This flaw is an information‑disclosure vulnerability that undermines the per‑Dag read scoping protection intended to keep DAG identifiers private across teams.

The affected product is Apache Airflow, distributed by the Apache Software Foundation. Versions that do not include the fix shipped with apache-airflow 3.3.0 are vulnerable; users who upgraded for CVE‑2026‑28563 must additionally update to 3.3.0 or later.

The flaw can be exploited by any authenticated UI user who has read access to at least one DAG. The attacker can enumerate the identifiers of all DAGs referenced by that user’s trigger or sensor dependencies, even if they lack direct read permissions on those DAGs. The CVSS score is 4.3 and the EPSS score is low but nonzero likelihood of exploitation; it is not listed in the CISA KEV catalog. While the attack does not provide direct code execution or denial of service, it materially weakens the isolation of DAG metadata across teams and could aid in further privilege escalation or reconnaissance.