PT-2026-45363 · Apache · Apache Airflow

Jarek Potiuk + 2 · Published 2026-06-01 · Updated 2026-06-05 · CVE-2026-40861

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.2

Description A flaw in the FileTaskHandler allows a DAG author to access or modify files outside the configured base log folder when the worker log folder is shared with the API server. This can be achieved through a read-path attack by creating a symlink in the task's log directory pointing to an arbitrary file readable by the API server process, such as /etc/passwd or airflow.cfg. Alternatively, a write-path attack can be performed by providing a task id containing .. sequences that are accepted by the Task SDK's KEY REGEX. These actions can lead to the leakage or overwriting of arbitrary files.

Recommendations Upgrade to version 3.2.2 or later. Deploy the worker and API server with separate log volumes to ensure worker-controlled paths cannot reach the API server's filesystem.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

BIT-AIRFLOW-2026-40861

CVE-2026-40861

PYSEC-2026-181

Affected Products

Apache Airflow

References · 8

• https://github.com/apache/airflow/pull/65325 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40861 · Security Note
• https://lists.apache.org/thread/823334db2559xjlwt59gpzjz47thnscl · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-181 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2026-40861 · Vendor Advisory
• https://twitter.com/vuldb/status/2061395987583861109 · Twitter Post
• https://t.me/cveNotify/165432 · Telegram Post
• http://openwall.com/lists/oss-security/2026/05/31/1 · Note