GitHub Advisoryadvisory · PyPI

GHSA-8x34-9q3v-h7g8 Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization

HIGH Published 2026-03-17 Modified 2026-06-05 Official page ↗
Aliases
CVE-2026-30911
Ecosystem
PyPI
Packages
apache-airflow
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-862
Reviewed
2026-03-18

Affected packages

• PyPI apache-airflow: >= 3.1.0, < 3.1.8 → fixed in 3.1.8

Description

Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

Related

Alias · CVE (1)

  • CVE-2026-30911 Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References