Unauthorized Task Mutation in Apache Airflow Affects Multiple Deployments

CVE-2026-41084

What is CVE-2026-41084?

A flaw in the Apache Airflow's bulk Task Instances API allows an authenticated user with edit permissions on one DAG to manipulate the states of Task Instances in other DAGs. This occurs because the authorization check improperly evaluates the dag_id from the URL instead of the intended request body, leading to potential unauthorized alterations. This vulnerability impacts deployments that utilize specific permissions to isolate Task Instance states among different teams. Users should upgrade to Apache Airflow version 3.2.2 or later to mitigate this issue.

References