CVE-2026-30911CWE-862

Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization

High · published March 17, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
54.1
In the wild
Unconfirmed
What it is

Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance.

Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00739 · 54.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-03-17T10:53Z
EPSS history
Timeline
  • 17 MAR 10:53Z
    Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization
    cvelistv5