Database/Control plane, storage & DevOps
Apache Airflow: any authenticated task instance can read or decide another task instance's HITL approvals
Impact
The Execution API's Human-in-the-Loop endpoints in Airflow 3.1.0 through 3.1.7 do not check that the calling task instance owns the HITL record it is acting on. Any authenticated task instance can read, approve or reject HITL workflows belonging to any other task instance. On a shared Airflow instance that orchestrates fleet work - dataset builds, training job submission, model promotion - one tenant's DAG can approve another tenant's gated step, which turns a human approval gate into something any task on the cluster can flip. Confidentiality goes with it: the HITL payloads of other teams' workflows are readable.
Who can reach it
Anyone who can run a task on the Airflow deployment, i.e. anyone able to author or trigger a DAG. Authentication as a task instance is required; no operator or admin role is needed.
What to do
Upgrade to Apache Airflow 3.1.8 or later and restart the API server and schedulers. Workers pick up the change with the new image. No node reboot or fleet drain is involved; running DAGs need the usual Airflow upgrade window.
References
Related entries
- Airflow Google provider: GCS object names with .. segments write outside the destination pathCVE-2026-49297 · Apache Airflow Google provider (GCSToSFTPOperator, GCSTimeSpanFileTransformOperator path handling)High
- OpenStack glance_store: VMware datastore driver sends authentication headers to an attacker-supplied image location hostCVE-2026-51773 · OpenStack glance_store (VMware datastore driver, _retry_request)High
- Ceph RGW: unsigned x-amz-* headers on presigned URLs are honored, letting a URL holder escalate privilegesCVE-2026-54330 · Ceph Object Gateway (RGW SigV4 presigned-URL header validation)High
- Apache Airflow Git provider: SSH host-key verification disabled by default when cloning DAG bundlesCVE-2026-58065 · Apache Airflow Git provider (apache-airflow-providers-git, git-over-SSH host key checking)High
- Apache Airflow FAB provider: a DAG named 'DAGs' collides with the global all-DAGs permission and escalates privilegesCVE-2026-59245 · Apache Airflow FAB auth manager (apache-airflow-providers-fab, resource_name collision)High
- Linux MACsec (replay protection at XPN lower-PN wrap): MACsec replay protection fails at the extended-packet-numberCVE-2026-63925 · Linux MACsec (replay protection at XPN lower-PN wrap)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.