Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance.
Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 17 Mar 2026 11:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue. | |
| Title | Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization | |
| Weaknesses | CWE-862 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: apache
Published:
Updated: 2026-03-17T10:53:02.587Z
Reserved: 2026-03-07T13:31:56.372Z
Link: CVE-2026-30911
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-03-17T11:16:11.940
Modified: 2026-03-17T11:16:11.940
Link: CVE-2026-30911
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses