CVE-2026-30911 - Vulnerability Analysis

Overview

Apache Airflow 3.1.0 through 3.1.7 contains a broken access control vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints, letting any authenticated task instance read, approve, or reject HITL workflows of other task instances, exploit requires authentication as a task instance.

Severity & Score

Impact

Authenticated task instances can manipulate or view HITL workflows of other tasks, leading to unauthorized workflow control.

Mitigation

Upgrade to Apache Airflow 3.1.8 or later.

References

• https://github.com/apache/airflow/pull/62886
• https://lists.apache.org/thread/1rs2v7fcko2otl6n9ytthcj87cmsgx51
• http://www.openwall.com/lists/oss-security/2026/03/17/2

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner