PT-2026-25893 · Apache · Apache Airflow

Aritra Basu + 1 · Published 2026-03-17 · Updated 2026-03-17 · CVE-2026-30911

NVD

CVSS v3.1

8.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance.

Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-30911

Affected Products

Apache Airflow

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-30911 · Security Note
• https://github.com/apache/airflow/pull/62886 · Patch
• https://lists.apache.org/thread/1rs2v7fcko2otl6n9ytthcj87cmsgx51 · Vendor Advisory
• http://openwall.com/lists/oss-security/2026/03/17/2 · Note