Airflow: asset materialization authorizes the Dag without its team, letting one team trigger another's runs

Impact

POST /api/v2/assets/{asset_id}/materialize and the XCom result check in wait_dag_run_until_finished authorize the target Dag without resolving its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global one by that field - the Keycloak manager checks the DAG resource rather than DAG:<team> - so the permission meant to gate the call is never consulted. In a multi-team deployment an authenticated user in one team can trigger another team's Dag runs with their own dag_run_id and conf, and read another team's XCom values. On a shared fleet that means running arbitrary configured work under another tenant's pipeline identity and consuming its scheduled capacity. Deployments on the FAB auth manager are unaffected, as it has no multi-team support.

Who can reach it

Any authenticated user in a multi-team Airflow deployment running a team-aware auth manager (for example Keycloak). Network access to the Airflow API plus ordinary credentials is enough.

What to do

Upgrade apache-airflow to 3.3.1 or later, which resolves the Dag's team at both sites, and restart the API server and scheduler. No node-level maintenance required. Review audit and Dag-run history for materialize calls that crossed teams.

References

Related entries

• GitLab CE/EE: authenticated user can stall background job processing via missing object count limitsCVE-2026-77801 · GitLab CE/EE (background job processing)Medium
• Fortra BoKS Manager: oversized digest name in a KSL start message overflows a fixed 16-byte checksum fieldCVE-2026-79900 · Fortra BoKS Manager boks_ksllogsd (KSL start message digest name)Medium
• Schneider Electric Data Center Expert - SOAP service endpoints: XML external entity processing on DCE SOAP endpointsCVE-2026-8045 · Schneider Electric Data Center Expert - SOAP service endpointsMedium
• Dell OpenManage Server Administrator (authorization checks): A second, distinct flaw in the same OMSA versionsCVE-2026-81439 · Dell OpenManage Server Administrator (authorization checks)Medium
• Ansible automation-controller: REST filter oracle on workflow artifacts leaks no_log secrets across organizationsCVE-2026-84720 · Red Hat Ansible Automation Platform automation-controller (REST filter on WorkflowJobNode.ancestor_artifacts)Medium
• Airflow Akeyless provider: path-shaped Variable key bypasses the team-scope guard on secret lookupCVE-2026-86465 · Apache Airflow Akeyless provider (secrets backend, team-scope guard)Medium