PYSEC-2026-17

vendorUSosv

view advisory published 2026-03-17Licence: CC-BY-4.0

Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-30911US	—OT elevated	0.56% (46th)	—	2026-03-17
Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instanc…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2026/03/17/2ADVISORY
https://github.com/advisories/GHSA-8x34-9q3v-h7g8ADVISORY
https://github.com/apache/airflow/pull/62886FIX
https://lists.apache.org/thread/1rs2v7fcko2otl6n9ytthcj87cmsgx51ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan