CVE-2026-30911

HIGH

Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization

Title source: cna
STIX 2.1

Description

Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

References (3)

Core 3

Scores

CVSS v3 8.1
EPSS 0.0004
EPSS Percentile 13.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (3)
apache/airflow 3.1.0 - 3.1.8
Apache Software Foundation/Apache Airflow 3.1.0 - 3.1.8
pypi/apache-airflow 3.0.0 - 3.1.8PyPI
Published Mar 17, 2026
Tracked Since Mar 17, 2026