Permission Overwrite in Apache Airflow by Apache
CVE-2026-111455

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Airflow
Vendor
CVE Published:
9 November 2026

What is CVE-2026-111455?

A potential vulnerability in Apache Airflow arises from an improper permission check during asynchronous connection tests. When testing a connection, if the connection ID was absent, the system only checked for create permissions at the queue stage. However, upon completion, if the connection creation was successful with commit_on_success, the system inadvertently overwrote any existing connection associated with that ID. This issue primarily affects deployments that have enabled the non-default [core] test_connection setting. Users without edit permissions could unintentionally modify connections established by others. It is advised for users to upgrade to Apache Airflow version 3.4.0 or later to mitigate this risk.

Affected Version(s)

Apache Airflow 3.3.0 < 3.4.0

References

https://github.com/apache/airflow/pull/74837
patch
https://lists.apache.org/thread.html/j3tqo8wd53mcyvkkw4z5...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Evan Ricafort (@evanricafort) of Invalid Web Security
Jarek Potiuk
.