VULNERABILITY INTELLIGENCE

CVE-2026-30911

CVSS score8.1 HIGH
EPSS probability0.56%
CISA KEVNot currently listed
Published2026-03-17
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Description

Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

Weakness classification

  • security@apache.org: CWE-862

Primary references