~ / search / GHSA-8x34-9q3v-h7g8

GHSA-8x34-9q3v-h7g8

Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization

Source: GitHub Advisory Database (reviewed) High CVE-2026-30911

Packages

EcosystemPackageAffectedFixed in
PyPI apache-airflow >= 3.1.0, < 3.1.8 3.1.8

Details

As written in the advisory (Markdown source, shown as plain text).

Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

References

External links from the advisory. They lead to third-party sites.