What’s Vulnerable › Vulnerabilities

CVE-2026-30911: Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-17 · updated 2026-06-17
• Weakness: CWE-862

Description

Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

Affected products

• Apache Airflow: from 3.1.0 before 3.1.8 — fixed in 3.1.8

How to fix

Upgrade to a fixed version: Apache Airflow 3.1.8. Check the vendor advisory for mitigations.

References

• https://github.com/apache/airflow/pull/62886
• https://lists.apache.org/thread/1rs2v7fcko2otl6n9ytthcj87cmsgx51
• http://www.openwall.com/lists/oss-security/2026/03/17/2

Get alerted when CVE-2026-30911 or the next vulnerability affects your stack