CVE-2026-30911: Apache Airflow Execution API HITL Endpoints Lacking Per-Task Authorization
Summary
CVE-2026-30911: Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization. Affects apache-airflow versions >= 3.0.0, < 3.1.8. Fixed in 3.1.8. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2026-30911 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. It is widely used for orchestrating complex data pipelines and automating tasks. The platform provides a rich set of features, including a web interface, a command-line interface, and an API for interacting with workflows. However, certain versions of Apache Airflow have been found to have a security vulnerability that affects the Execution API's Human-in-the-Loop (HITL) endpoints, compromising the integrity of task instance authorizations.
Vulnerability Detail
The vulnerability in Apache Airflow versions 3.1.0 through 3.1.7 arises from missing authorization checks in the Execution API's HITL endpoints. This flaw allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance. The absence of proper authorization can lead to unauthorized access and manipulation of workflows, potentially resulting in data breaches or unintended modifications to critical processes.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.8
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==3.1.8"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to upgrade to the fixed version as soon as possible.
Conclusion
In summary, the vulnerability identified as CVE-2026-30911 in Apache Airflow poses a significant risk due to the lack of per-task authorization in the Execution API's HITL endpoints. Users are strongly advised to upgrade to version 3.1.8 or later to mitigate this risk and ensure the security of their workflows.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow versions 3.1.0 through 3.1.7 are affected by this vulnerability.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The consequences include unauthorized access to workflows, potential data breaches, and the ability to manipulate critical processes.
Yes, Vulert can monitor and alert in real-time for open-source vulnerabilities in your software by using just the Pipfile.lock.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
