Database/Control plane, storage & DevOps
Apache Airflow: bulk Task Instance API authorizes the URL dag_id but acts on the body dag_id
Impact
The bulk Task Instance endpoint checked permissions against the dag_id in the URL path while operating on the dag_id and dag_run_id taken from request-body entities. A user with edit rights on a single Dag can therefore clear, fail or otherwise mutate Task Instance state in any other Dag by keeping their own Dag in the path and naming the target in the body. On a shared GPU cluster that uses per-Dag edit scope to keep teams apart, this lets one tenant restart or kill another tenant's training and batch work, consuming their allocation and destroying run state. Integrity only - no data is read out through this path.
Who can reach it
Any authenticated UI/API user holding edit permission on at least one Dag, over the network. Affects deployments relying on per-Dag edit scope for isolation.
What to do
Upgrade to apache-airflow 3.2.2 or later and restart the API server. No configuration-only mitigation is published; until the upgrade, the only effective control is narrowing who holds Dag edit permission at all.
References
Related entries
- JFrog Artifactory: internal anonymous-user token returned to unauthenticated callersCVE-2026-42018 · JFrog Artifactory (anonymous-user token disclosure)High
- Prometheus: Azure AD remote-write client secret served in plaintext from the /-/config endpointCVE-2026-42151 · Prometheus (Azure AD remote-write OAuth client_secret in /-/config)High
- Prometheus: unvalidated snappy decoded length on /api/v1/read lets a small request exhaust server memoryCVE-2026-42154 · Prometheus (/api/v1/read snappy decompression length handling)High
- Jenkins Credentials Binding Plugin: unsanitized credential file names write files anywhere on the nodeCVE-2026-42520 · Jenkins Credentials Binding Plugin (file and zip credential file names)High
- OpenTelemetry JS Prometheus exporter: a malformed request URI crashes the whole Node.js processCVE-2026-44902 · OpenTelemetry JS Prometheus exporter (@opentelemetry/exporter-prometheus, also via sdk-node)High
- Suricata: unbounded NFS parser state lets crafted traffic exhaust sensor memoryCVE-2026-45766 · Suricata (NFS application-layer parser)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.