Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization
Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-30911US | —OT elevated | — | ||
Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instanc… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2026/03/17/2WEB
- https://github.com/apache/airflowPACKAGE
- https://github.com/apache/airflow/pull/62886WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-17.yamlWEB
- https://lists.apache.org/thread/1rs2v7fcko2otl6n9ytthcj87cmsgx51WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-30911ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan