Airflow: async connection test lets a create-only user overwrite another user's connection

Impact

The asynchronous connection test checks permissions when the test is queued, and only checks create permission if the connection ID does not exist yet. When the test completes with commit_on_success, it writes the tested connection under that ID. A user who may create but not edit connections can therefore overwrite a connection that someone else created in the meantime, which could point pipelines at a host the attacker controls.

Who can reach it

An authenticated user with create but not edit permission on connections. Only deployments that enable the non-default [core] test_connection setting are affected.

What to do

Upgrade apache-airflow to 3.4.0 or later and restart the API server. Until then, leave [core] test_connection disabled (the default).

References

Related entries

• Airflow secrets masker: secrets nested more than five levels deep shown in cleartextCVE-2026-113504 · Apache Airflow secrets masker (nesting depth limit)Unscored
• Airflow: failed token revocation at logout is ignored, so the token stays validCVE-2026-113508 · Apache Airflow API logout (server-side token revocation)Unscored
• Gitea: Helm chart upload decompresses without a size limit before the quota check, allowing CPU exhaustionCVE-2026-117677 · Gitea (Helm chart package upload)Unscored
• Apache CloudStack: unsanitized backup repository options inject OS commands onto the KVM hypervisor hostCVE-2026-47359 · Apache CloudStack NAS backup provider (addBackupRepository / updateBackupRepository)Unscored
• Apache Airflow: Connection and Variable secrets stored in cleartext in audit log rowsCVE-2026-50204 · Apache Airflow (audit log / event-log API)Unscored
• DMTF SPDM specification DSP0274 1.4 (FINISH transcript definition): A specification-level defect rather thanCVE-2026-61810 · DMTF SPDM specification DSP0274 1.4 (FINISH transcript definition)Unscored