Improper Authorization in Apache Airflow - CVE-2026-68971
Published: August 24, 2026
Vulnerability identifier: #VU144883
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-68971
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to trigger dag runs for another team and disclose another team's XCom values.
The vulnerability exists due to improper access control in the asset materialization endpoint and the XCom result check on wait_dag_run_until_finished when handling requests for team-scoped dags. A remote user can send crafted requests with their own dag_run_id and conf to trigger dag runs for another team and disclose another team's XCom values.
Only deployments running multi-team mode with a team-aware auth manager are vulnerable. Deployments using the FAB auth manager are unaffected.
Affected software
Apache Airflow
How to mitigate CVE-2026-68971
Install security update from vendor's website.
Apache Airflow - update to 3.3.1