GHSA-8x34-9q3v-h7g8

Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization

At a glance

Published: 2026-03-17 12:30 UTC
Updated: 2026-06-05 14:30 UTC
CVE: CVE-2026-30911
Aliases: BIT-airflow-2026-30911, PYSEC-2026-17
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Description

Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

Affected packages

Package	Versions
PyPI · apache-airflow	introduced 3.1.0, fixed 3.1.8

References

https://nvd.nist.gov/vuln/detail/CVE-2026-30911 ADVISORY
https://github.com/apache/airflow/pull/62886 WEB
https://github.com/apache/airflow PACKAGE
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-17.yaml WEB
https://lists.apache.org/thread/1rs2v7fcko2otl6n9ytthcj87cmsgx51 WEB
http://www.openwall.com/lists/oss-security/2026/03/17/2 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database