Airflow Backfill API: any Dag editor can read and cancel backfills belonging to other Dags

Impact

The Backfill API's authorization dependency parsed backfill_id with int() while the route handler parsed it as pydantic NonNegativeInt, which accepts values int() rejects - 1.0 coerces to 1. FastAPI resolves dependencies before endpoint validation, so the authorization check ran against a caller-supplied Dag id while the handler acted on a different Dag entirely. An authenticated user with edit permission on any one Dag could read, pause and cancel other tenants' backfills, including pushing another Dag's queued runs to failed. No non-default configuration is needed and backfill ids are sequential, so targets are trivial to find. On a shared Airflow that schedules GPU work, this is one team killing another team's queued training runs. Fixed in apache-airflow 3.3.1.

Who can reach it

Any authenticated Airflow user holding edit permission on at least one Dag, reaching the Backfill API over the network. Authentication is required; no special configuration is.

What to do

Upgrade to apache-airflow 3.3.1 or later, which parses the backfill id with the type the routes declare, and restart the API server. Until then, review who holds Dag edit permission on shared instances - the flaw is reachable by every such user.

References

Related entries

• GitLab CE/EE: improper input validation lets an unauthenticated user cause a denial of serviceCVE-2026-7427 · GitLab CE/EE (unauthenticated request path, improper input validation)High
• Apache Airflow: asset queued-event deletion gated on READ instead of EDIT permissionCVE-2026-75157 · Apache Airflow (asset queued-events DELETE endpoints)High
• Splunk Enterprise Edge Processor sidecar: Prometheus metrics endpoint served without authenticationCVE-2026-76262 · Splunk Enterprise Edge Processor SPL2 Preview sidecar (Prometheus metrics endpoint)High
• Dell OpenManage Server Administrator (network-facing management service): OMSA is the in-band hardware management agentCVE-2026-81438 · Dell OpenManage Server Administrator (network-facing management service)High
• Linux kernel nfsd: uncapped POSIX ACL entry count drives an O(n^2) sort in the NFS serverCVE-2026-89695 · Linux kernel nfsd (NFSv4 POSIX ACL decoder, sort_pacl_range)High
• Linux kernel nfsd: crafted inter-server COPY compound reaches ops with a NULL filehandle and panics nfsdCVE-2026-89696 · Linux kernel nfsd (inter-server COPY, NFSD4_FH_FOREIGN compound dispatch)High