Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization

CVE-2026-30911 · Published Mar 17, 2026 · updated Jun 5, 2026

High8.1

Fix: upgrade to 3.1.8 or later

Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance.

Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

Affected versions

Package	Affected	Fixed in
apache-airflow PyPI	>= 3.1.0, < 3.1.8	3.1.8

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Severity from: GitHub (reviewed advisory)
Weakness: CWE-862
Also known as: BIT-airflow-2026-30911, CVE-2026-30911, PYSEC-2026-17

More Apache Airflow advisories

All Apache Airflow

Medium 4.8Mar 31

Apache Airflow: improper certificate validationCVE-2026-32794fixed in 1.12.0 High 7.5Mar 17

Apache Airflow: resource exposureCVE-2026-28779fixed in 3.1.8 Medium 4.3Mar 17

Apache Airflow: DAG authorization bypassCVE-2026-28563fixed in 3.1.8 High 7.5Mar 17

Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks MetadataCVE-2026-26929fixed in 3.1.8 Medium 6.5Feb 24

Apache Airflow exposes sensitive information in its log filesCVE-2025-27555fixed in 2.11.1 High 8.4Feb 24

Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate tableCVE-2024-56373fixed in 2.11.1