CVE-2026-30911 - Vulnerability Analysis

Overview

Apache Airflow 3.1.0 through 3.1.7 contains a broken access control vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints, letting any authenticated task instance read, approve, or reject HITL workflows of other task instances, exploit requires authentication as a task instance.

Severity & Score

Impact

Authenticated task instances can manipulate or view HITL workflows of other tasks, leading to unauthorized workflow control.

Mitigation

Upgrade to Apache Airflow 3.1.8 or later.

References

• http://www.openwall.com/lists/oss-security/2026/03/17/2
• https://github.com/apache/airflow/pull/62886
• https://lists.apache.org/thread/1rs2v7fcko2otl6n9ytthcj87cmsgx51

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 17, 2026

🟠 CVE-2026-30911 - High (8.1) Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30911/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner