Symlink and Path Traversal Vulnerability in Apache Airflow by Apache

CVE-2026-40861

What is CVE-2026-40861?

A vulnerability exists in Apache Airflow that allows an attacker to exploit log directory configurations. By creating a symlink, an attacker can point to an arbitrary file that is accessible to the API server process. This read-path attack could expose sensitive files such as /etc/passwd or airflow.cfg. Additionally, a crafted task_id can contain sequences that bypass restrictions, leading to potential overwriting of files. This issue primarily affects installations where the worker log folder is shared with the API server. It is recommended that users upgrade to Apache Airflow version 3.2.2 or later. Implementing separate log volumes for workers and the API server adds an additional layer of security to mitigate risks.

References