CVE-2026-40861: Apache Airflow Symlink Vulnerability Leading to File Leakage and Overwrite
Summary
CVE-2026-40861: Apache Airflow has a Link Following issue. Affects apache-airflow versions < 3.2.2. Fixed in 3.2.2. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2026-40861 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. It allows users to define complex workflows as Directed Acyclic Graphs (DAGs) and manage task execution. However, a recent vulnerability has been identified that could allow malicious DAG authors to exploit symlink capabilities, leading to potential file leakage or overwriting of critical files.
Vulnerability Detail
The vulnerability arises from the ability of a DAG author to create a symlink in their task's log directory that points to an arbitrary file accessible by the API server process. This can lead to a read-path attack, where sensitive files such as '/etc/passwd' or 'airflow.cfg' can be accessed. Additionally, by supplying a 'task_id' containing '..' sequences, a write-path attack can occur, allowing the overwriting of files outside the configured 'base_log_folder'. This issue primarily affects deployments where the worker log folder is shared with the API server, posing a significant risk of data exposure and integrity compromise.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2.2
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==3.2.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a defense-in-depth mitigation, it is recommended to deploy the worker and API server with separate log volumes. This ensures that worker-controlled paths cannot access the API server's filesystem, thereby reducing the risk of exploitation.
Conclusion
The CVE-2026-40861 vulnerability in Apache Airflow poses significant risks due to the potential for file leakage and overwriting through symlink exploitation. Users are strongly advised to upgrade to version 3.2.2 or later and consider implementing workarounds to enhance security.
See every vulnerability recorded for apache-airflow →
FAQ
CVE-2026-40861 is a vulnerability in Apache Airflow that allows DAG authors to exploit symlink capabilities, potentially leading to file leakage or overwriting.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities.
The risks include unauthorized access to sensitive files and the possibility of overwriting critical configuration files, which can compromise the integrity and security of the application.
You can upgrade Apache Airflow by running the command: pip install --upgrade apache-airflow==3.2.2.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using just the Pipfile.lock. It provides real-time alerts without requiring code access or installation.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
