Authorization Flaw in Apache Airflow's Backfill API Allows Unauthorized Access to Workflows

CVE-2026-68968

What is CVE-2026-68968?

A vulnerability exists in Apache Airflow's Backfill API that compromises user permissions, allowing authenticated users with edit rights on any DAG to access and manipulate backfills associated with other DAGs. This flaw occurs because the backfill identifier parsing differs between the authorization mechanism and the route handler, which can lead to unauthorized reading, pausing, and canceling of backfills. Additional concerns arise from the sequential nature of backfill IDs, making it easy for users to identify and target specific backfills without needing non-default configurations. To mitigate this risk, it is recommended that users upgrade to Apache Airflow version 3.3.1 or later, where this issue has been addressed.

References