CVE-2026-41084: Apache Airflow Authorization Bypass Vulnerability
Summary
CVE-2026-41084: Apache Airflow Vulnerable to Authorization Bypass Through User-Controlled Key. Affects apache-airflow versions >= 3.2.0, < 3.2.2. Fixed in 3.2.2. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2026-41084 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. It allows users to define workflows as Directed Acyclic Graphs (DAGs) and provides a rich user interface to manage and visualize these workflows. The platform is widely used in data engineering and data science for orchestrating complex data pipelines. However, a recent vulnerability has been identified that could allow unauthorized manipulation of task instances across different DAGs, compromising the integrity of workflow management.
Vulnerability Detail
A bug in Apache Airflow's bulk Task Instances API allows an authenticated user with edit permissions on one DAG to manipulate Task Instance states in other DAGs. This occurs because the authorization check is based on the dag_id from the URL path, while the target dag_id can be specified in the request body. This flaw can lead to unauthorized access and modification of task instances, potentially affecting deployments that rely on per-DAG edit scopes to isolate task states between teams.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2.2
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==3.2.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the API endpoints or implement additional checks in their application logic to ensure that users can only modify task instances within their authorized DAGs.
Conclusion
The CVE-2026-41084 vulnerability in Apache Airflow poses a significant risk by allowing unauthorized access to task instance modifications across different DAGs. Users are strongly encouraged to upgrade to version 3.2.2 or later to mitigate this risk and ensure the integrity of their workflows.
See every vulnerability recorded for apache-airflow →
FAQ
CVE-2026-41084 is a vulnerability in Apache Airflow that allows an authenticated user to bypass authorization checks and manipulate task instances across different DAGs.
This vulnerability can lead to unauthorized modifications of task instances, potentially compromising the integrity of your workflows and data pipelines.
Apache Airflow versions 3.2.0 and 3.2.1 are affected. Users are advised to upgrade to version 3.2.2 or later.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application without signup using the Vulert playground at Vulert Scanner.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
