Vulnerability Description
Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Airflow | >= 3.1.0, < 3.1.8 |
Related Weaknesses (CWE)
References
- https://github.com/apache/airflow/pull/62886Issue TrackingPatch
- https://lists.apache.org/thread/1rs2v7fcko2otl6n9ytthcj87cmsgx51Mailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/03/17/2Mailing ListThird Party Advisory
FAQ
What is CVE-2026-30911?
CVE-2026-30911 is a vulnerability with a CVSS score of 8.1 (HIGH). Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, ...
How severe is CVE-2026-30911?
CVE-2026-30911 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-30911?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Airflow.