CVE-2026-41084: Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation
A bug in Apache Airflow's bulk Task Instances API (PATCH/DELETE /api/v2/dags/{dagid}/dagRuns/{dagrunid}/taskInstances) evaluated authorization against the dagid resolved from the URL path while operating on the dagid / dagrunid extracted from request-body entity fields. An authenticated UI/API user with edit permission on one Dag could mutate Task Instance state in any other Dag by keeping the authorized Dag's ID in the URL path and naming the target Dag's IDs in the request body entities. Affects deployments that rely on per-Dag edit-scope to keep Task Instance state isolated between teams. Users are advised to upgrade to apache-airflow 3.2.2 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache-airflowto a version that resolves this vulnerability.Fixed in 3.2.2Patch CVE-2026-41084
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41084?
The severity of CVE-2026-41084 is rated high with a score of 7.5 according to CVSS 3.1.
How do I fix CVE-2026-41084?
To fix CVE-2026-41084, apply the available patch provided by Apache Airflow.
What systems are affected by CVE-2026-41084?
CVE-2026-41084 affects Apache Airflow instances utilizing the bulk Task Instances API.
What kind of vulnerability is CVE-2026-41084?
CVE-2026-41084 is an API authorization bypass vulnerability that allows cross-DAG mutations.
When was CVE-2026-41084 published?
CVE-2026-41084 was published on May 31, 2026.