CVE-2026-30911

HighCVSS 8.1/10Last modified Nov 3, 2026

Description

Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance.

Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Airflow	>= 3.1.0, < 3.1.8

References

https://github.com/apache/airflow/pull/62886Issue Tracking, Patch
https://lists.apache.org/thread/1rs2v7fcko2otl6n9ytthcj87cmsgx51Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/03/17/2Mailing List, Third Party Advisory

Timeline

Published: Mar 17, 2026
Last modified: Nov 3, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-309127.5In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lea CVE-2026-309134.6Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string t CVE-2026-309148.1SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between t CVE-2026-309154.3SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handli CVE-2026-309178.8Bucket is a MediaWiki extension to store and retrieve structured data on articles. Prior to 2.1.1, a stored XSS can be inserted into any Buc CVE-2026-309186.1facileManager is a modular suite of web apps built with the sysadmin in mind. Prior to 6.0.4 , a reflected XSS occurs when an application re CVE-2026-309195.4facileManager is a modular suite of web apps built with the sysadmin in mind. Prior to 6.0.4 , stored XSS (also known as persistent or secon CVE-2026-309208.6OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-contr CVE-2026-309219.9OneUptime is a solution for monitoring and managing online services. Prior to 10.0.20, OneUptime Synthetic Monitors allow low-privileged pro CVE-2026-309227.5pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused CVE-2026-309237.5ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Libmodsecurity is one compone CVE-2026-309249.6qui is a web interface for managing qBittorrent instances. Versions 1.14.1 and below use a permissive CORS policy that reflects arbitrary or