PT-2026-25893 · Apache · Apache Airflow

Aritra Basu + 1 · Publicado 2026-03-17 · Atualizado 2026-03-18 · CVE-2026-30911

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 3.1.0 through 3.1.7

Description Apache Airflow versions 3.1.0 through 3.1.7 contain a missing authorization issue within the Human-in-the-Loop (HITL) endpoints of the Execution API. This allows any authenticated task instance to perform actions—reading, approving, or rejecting—on HITL workflows belonging to other task instances. The HITL endpoints are part of the Execution API, which manages the execution of tasks within Airflow workflows. The issue stems from a lack of proper access controls, enabling unauthorized access and manipulation of HITL workflows.

Recommendations Upgrade to Apache Airflow version 3.1.8 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

BDU:2026-05615

BIT-AIRFLOW-2026-30911

CVE-2026-30911

GHSA-8X34-9Q3V-H7G8

PYSEC-2026-17

Produtos afetados

Apache Airflow

Referências · 19

• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/pull/62886 · Correção
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-17.yaml · Nota
• http://openwall.com/lists/oss-security/2026/03/17/2 · Nota
• https://bdu.fstec.ru/vul/2026-05615 · Nota de Segurança
• https://twitter.com/CVEarity/status/2033955421728477385 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-8x34-9q3v-h7g8 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2033871354043285857 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-30911 · Aviso do Fabricante
• https://twitter.com/oss_security/status/2033945930496442553 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2033994283238506830 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-30911 · Nota de Segurança
• https://lists.apache.org/thread/1rs2v7fcko2otl6n9ytthcj87cmsgx51 · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2034027208357171505 · Publicação no Twitter
• https://github.com/advisories/GHSA-8x34-9q3v-h7g8 · Nota