Report: CVE-2026-30911 - Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization

Report: CVE-2026-30911 - Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization

CVE ID :CVE-2026-30911 Published : March 17, 2026, 11:16 a.m. | 1 hour, 5 minutes ago Description :Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE Details

Published
March 17, 2026
Affected Product: Apache