Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-111455 EUVD-2026-119885GHSA-f43c-9rwr-7mfg

Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit

Published Nov 9, 2026 · Updated Nov 12, 2026 · Assigned by apache

Description

Apache Airflow's asynchronous connection test checked permissions when the test was queued — only create permission when the connection ID did not exist yet — but, when the test completed with `commit_on_success`, wrote the tested connection under that ID. A user allowed to create but not edit connections could overwrite a connection someone else had created in the meantime. Only deployments that enable the non-default `[core] test_connection` setting are affected. Users are advised to upgrade to apache-airflow 3.4.0 or later.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Airflow 3.3.0 – < 3.4.0 3.4.0

Advisories 1

References