Auth bypass in Apache Airflow
CVE-2026-41084
A bug in Apache Airflow's bulk Task Instances API (`PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances`) evaluated authorization against the `dag_id` resolved from the URL path while operating on the `dag_id` / `dag_run_id` extracted from request-body entity fields. An authenticated UI/API user with edit permission on one Dag could mutate Task Instance state in any other Dag by keeping the authorized Dag's ID in the URL path and naming the target Dag's IDs in the request body entities. Affects deployments that rely on per-Dag edit-scope to keep Task Instance state isolated between teams. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.
Vulnerability class: IDOR (Insecure Direct Object Reference)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.008 (53.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 54th percentile — 53.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.008 · change: +0.003
Affected products
- Apache Airflow
- Apache Software Foundation Airflow — versions 3.2.0
Weakness classification (CWE)
References
- github.com/apache/airflow/pull/64288 (Patch, patch, Issue Tracking)
- lists.apache.org/thread/w0hdcqfr71hf9rl1bwvpjs7q9yp1bldk (vendor-advisory, Mailing List, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2026-41084?
- CVE-2026-41084 is a high-severity vulnerability in Apache Airflow, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 7.5/10. Published 2026-06-01.
- How severe is CVE-2026-41084?
- High severity. CVSS v3 base score is 7.5 out of 10.