Skip to content
OpenAdvisories
High WID-SEC-2026-0755 4 CVEs

Apache Airflow: Mehrere Schwachstellen

Published Mar 16, 2026 · Updated Mar 17, 2026 · Revision 2 · de-DE

Vendor: Apache Product: Airflow Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um Informationen offenzulegen.

Product

Apache Airflow ist eine Plattform zur programmatischen Erstellung, Planung und Überwachung von Workflows.

Vulnerabilities 4

  • High 8.1
    CVE-2026-30911

    Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization

    Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instan…

    Apache Software Foundation Apache Airflow apache-airflow PyPI
  • High 7.5
    CVE-2026-28779

    Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications

    Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url. This allows any application co-hosted under the same domain to capture valid Airflow session to…

    Apache Software Foundation Apache Airflow apache-airflow PyPI
  • Medium 6.5
    CVE-2026-26929

    Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata

    Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). As a result, version metadata of DAGs that the requester is not …

    Apache Software Foundation Apache Airflow apache-airflow PyPI
  • Medium 4.3
    CVE-2026-28563

    Apache Airflow: DAG authorization bypass

    Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authori…

    Apache Software Foundation Apache Airflow apache-airflow PyPI

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-12562, EUVD-2026-12558, EUVD-2026-12564, EUVD-2026-12566

  2. #1

    Initiale Fassung

References