PT-2026-45367 · Apache · Apache Airflow

Pirikara · Published 2026-06-01 · Updated 2026-06-05 · CVE-2026-41084

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.2

Description A bug in the bulk Task Instances API allows an authenticated UI or API user to bypass authorization and mutate Task Instance states across different DAGs. The system evaluates authorization based on the dag id provided in the URL path but performs operations using the dag id and dag run id extracted from the request body. Consequently, a user with edit permissions for one DAG can modify Task Instances in any other DAG by specifying the authorized ID in the URL and the target IDs in the request body. This issue impacts deployments that use per-DAG edit-scope to isolate Task Instance states between teams. The affected endpoint is 'PATCH/DELETE /api/v2/dags/{dag id}/dagRuns/{dag run id}/taskInstances', and the vulnerable variables are dag id and dag run id.

Recommendations Upgrade to version 3.2.2 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BIT-AIRFLOW-2026-41084

CVE-2026-41084

PYSEC-2026-183

Affected Products

Apache Airflow

References · 7

• https://github.com/apache/airflow/pull/64288 · Patch
• https://osv.dev/vulnerability/PYSEC-2026-183 · Vendor Advisory
• https://lists.apache.org/thread/w0hdcqfr71hf9rl1bwvpjs7q9yp1bldk · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41084 · Security Note
• https://osv.dev/vulnerability/BIT-airflow-2026-41084 · Vendor Advisory
• https://t.me/CVEtracker/55448 · Telegram Post
• http://openwall.com/lists/oss-security/2026/05/31/7 · Note