CVE-2026-30911: Apache Airflow Execution API HITL Endpoints Lacking Per-Task Authorization
Summary
CVE-2026-30911: Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization. Affects airflow versions >= 3.1.0, < 3.1.8. Fixed in 3.1.8. How to fix ↓
Also tracked for
- apache-airflow · PyPI
- apache-airflow · PyPI
The same CVE-2026-30911 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed for orchestrating complex workflows and data processing pipelines. It allows users to programmatically author, schedule, and monitor workflows. The platform is widely used in data engineering and data science for its flexibility and scalability. However, certain versions of Airflow have been found to have a security vulnerability that affects the Execution API's Human-in-the-Loop (HITL) endpoints, potentially compromising the integrity of task instance workflows.
Vulnerability Detail
The vulnerability in Apache Airflow versions 3.1.0 through 3.1.7 arises from missing authorization checks in the Execution API's HITL endpoints. This flaw allows any authenticated task instance to access, approve, or reject HITL workflows associated with other task instances. The lack of proper authorization can lead to unauthorized access to sensitive workflows, potentially resulting in data breaches or workflow manipulation.
How To Fix
Minimum fixed version
3.1.8
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to upgrade to the patched version as soon as possible.
Conclusion
The vulnerability identified as CVE-2026-30911 in Apache Airflow poses a significant risk due to the lack of per-task authorization in HITL endpoints. Users are strongly advised to upgrade to version 3.1.8 or later to safeguard their workflows and data integrity.
See every vulnerability recorded for airflow →
FAQ
Apache Airflow versions 3.1.0 through 3.1.7 are affected by this vulnerability.
The vulnerability has a CVSS v3 score indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
The vulnerability could lead to unauthorized access to sensitive workflows, which may result in data breaches or manipulation of task instances.
While there are no specific workarounds, ensuring that access controls are tightly managed can help mitigate risks until an upgrade is performed.
Related vulnerabilities
Recent vulnerabilities recorded for airflow.
