CVE-2026-68968: Apache Airflow Backfill API Authorization Bypass Vulnerability
Summary
CVE-2026-68968: Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfill_id path segment failed to parse. Affects airflow versions < 3.3.1. Fixed in 3.3.1. How to fix ↓
Also tracked for
- apache-airflow · PyPI
- apache-airflow · PyPI
The same CVE-2026-68968 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. It is widely used for orchestrating complex data pipelines and managing task dependencies. The platform allows users to define workflows as Directed Acyclic Graphs (DAGs) and provides a rich user interface for monitoring and managing these workflows. However, a recent vulnerability has been identified in the Backfill API, which could potentially allow unauthorized access to sensitive operations across different DAGs.
Vulnerability Detail
The vulnerability arises from an authorization bypass in the Backfill API due to conflicting interpretations of the backfill ID. When the backfill_id path segment fails to parse, the API authorizes requests against a DAG ID supplied by the caller. The authorization mechanism uses int() for parsing, while the route handler uses pydantic's NonNegativeInt, which can accept values that int() rejects (e.g., 1.0 coerces to 1). This discrepancy allows an authenticated user with edit permissions on one DAG to manipulate backfills of any other DAG, including reading, pausing, and canceling backfills, as well as moving queued runs to a failed state. The sequential nature of backfill IDs makes it easy for malicious users to target specific DAGs.
How To Fix
Minimum fixed version
3.3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to upgrade to the patched version as soon as possible.
Conclusion
The CVE-2026-68968 vulnerability in Apache Airflow's Backfill API poses a significant risk by allowing unauthorized access to manipulate backfills across different DAGs. Users are strongly encouraged to upgrade to version 3.3.1 or later to secure their applications against this issue.
See every vulnerability recorded for airflow →
FAQ
CVE-2026-68968 is a vulnerability in Apache Airflow's Backfill API that allows unauthorized access to manipulate backfills across different DAGs.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without needing to sign up.
The vulnerability can lead to unauthorized access to sensitive operations on other DAGs, allowing users to read, pause, cancel backfills, and manipulate queued runs.
Yes, users are advised to upgrade to Apache Airflow version 3.3.1 or later to address this vulnerability.
While there are no specific workarounds, it is crucial to prioritize upgrading to the patched version to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for airflow.
