Airflow: asset materialization authorizes the Dag without its team, letting one team trigger another's runs

Impact

POST /api/v2/assets/{asset_id}/materialize and the XCom result check in wait_dag_run_until_finished authorize the target Dag without resolving its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global one by that field - the Keycloak manager checks the DAG resource rather than DAG:<team> - so the permission meant to gate the call is never consulted. In a multi-team deployment an authenticated user in one team can trigger another team's Dag runs with their own dag_run_id and conf, and read another team's XCom values. On a shared fleet that means running arbitrary configured work under another tenant's pipeline identity and consuming its scheduled capacity. Deployments on the FAB auth manager are unaffected, as it has no multi-team support.

Who can reach it

Any authenticated user in a multi-team Airflow deployment running a team-aware auth manager (for example Keycloak). Network access to the Airflow API plus ordinary credentials is enough.

What to do

Upgrade apache-airflow to 3.3.1 or later, which resolves the Dag's team at both sites, and restart the API server and scheduler. No node-level maintenance required. Review audit and Dag-run history for materialize calls that crossed teams.

References

Related entries

• GitLab CE/EE: authenticated user can stall background job processing via missing object count limitsCVE-2026-77801 · GitLab CE/EE (background job processing)Medium
• Schneider Electric Data Center Expert - SOAP service endpoints: XML external entity processing on DCE SOAP endpointsCVE-2026-8045 · Schneider Electric Data Center Expert - SOAP service endpointsMedium
• Airflow Akeyless provider: path-shaped Variable key bypasses the team-scope guard on secret lookupCVE-2026-86465 · Apache Airflow Akeyless provider (secrets backend, team-scope guard)Medium
• Jenkins Bitbucket Push and Pull Request Plugin: webhook payload can redirect credentialed requestsCVE-2026-92139 · Jenkins Bitbucket Push and Pull Request Plugin (webhook-supplied URLs)Medium
• Ceph (Python bindings, IMAP4_SSL/SMTP_SSL TLS clients): Ceph's Python code constructs imaplib.IMAP4_SSL andNCVD-2024-010-ceph-python-bindings-imap4-ssl-s · Ceph (Python bindings, IMAP4_SSL/SMTP_SSL TLS clients)Medium
• rclone (serve s3): Path traversal in rclone's S3 gateway lets a caller read and overwrite files above the served root.NCVD-2026-042-rclone-serve-s3 · rclone (serve s3)Medium