CVE-2026-30911: Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization
Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance.
Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30911?
The severity of CVE-2026-30911 is classified as medium due to the unauthorized access it allows to HITL workflows.
How do I fix CVE-2026-30911?
To fix CVE-2026-30911, upgrade Apache Airflow to version 3.1.8 or later where the per-task authorization vulnerability is addressed.
Which versions of Apache Airflow are affected by CVE-2026-30911?
Apache Airflow versions 3.1.0 through 3.1.7 are affected by CVE-2026-30911.
What impact does CVE-2026-30911 have on Apache Airflow's security?
CVE-2026-30911 allows any authenticated task instance to read, approve, or reject HITL workflows, posing a risk of unauthorized actions.
Is authentication enough to protect against CVE-2026-30911?
No, simply having authentication is not sufficient to protect against CVE-2026-30911 due to the lack of per-task authorization.