EUVD-2026-57268
GHSA-5247-m8w9-2v4m
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network vector (API endpoint), high complexity (requires multi-team mode plus team-aware auth manager), low privilege (any authenticated user), no availability impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
Apache Airflow's asset materialization endpoint (POST /api/v2/assets/{asset_id}/materialize) and the XCom result check on wait_dag_run_until_finished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global one by that field -- the Keycloak auth manager, for example, checks the DAG resource instead of DAG:<team> -- so the team-scoped permission that should gate the request was never consulted. In a deployment running multi-team mode with a team-aware auth manager, an authenticated user in one team could trigger Dag runs belonging to another team, supplying their own dag_run_id and conf, and could read another team's XCom values. Deployments using the FAB auth manager are unaffected, as it has no multi-team support. Users are advised to upgrade to apache-airflow 3.3.1 or later, which resolves the Dag's team at both sites.
AnalysisAI
Cross-team DAG authorization bypass in Apache Airflow versions prior to 3.3.1 allows authenticated users in one team to trigger DAG runs and read XCom values belonging to other teams. The asset materialization endpoint (POST /api/v2/assets/{asset_id}/materialize) and the XCom check in wait_dag_run_until_finished both passed DagDetails without resolving the DAG's team_name, causing team-aware auth managers (e.g., Keycloak) to evaluate the permission against the global DAG resource instead of the team-scoped DAG:<team> resource. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the Airflow deployment must be running in multi-team mode; (2) a team-aware auth manager must be configured - the vulnerability description explicitly names the Keycloak auth manager as an example, and confirms FAB auth manager deployments are entirely unaffected; (3) the attacker must hold a valid authenticated session in Airflow (any team membership suffices); (4) the target DAG must be team-scoped (i.e., have a non-null team_name). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is conditional: exploitation requires an authenticated session, a non-default multi-team deployment, and a team-aware auth manager - FAB deployments (the default for most Airflow installations) are completely unaffected. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Apache Airflow to version 3.3.1 or later, which resolves the DAG's team at both affected authorization sites by calling DagModel.get_team_name() before constructing the DagDetails object. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Airflow
View allRemote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controll
Unsafe deserialization in Apache Airflow 3.3.0's Task SDK allows an authenticated DAG author to cause arbitrary module i
Unsafe deserialization in Apache Airflow 3.0.0 through 3.3.0 allows any DAG author to achieve arbitrary code execution i
Command injection in Apache Airflow's BashOperator documentation example allows authenticated attackers to escalate priv
We need to produce a JSON object per the instructions. Let's analyze each field. First, product_name: "1-3 words ONLY.
CVE-2026-30911 is a security vulnerability (CVSS 8.1) that allows any authenticated task instance. High severity vulnera
Information disclosure in Apache Airflow 3.0.0 through 3.1.x stems from incomplete secret masking and under-documented w
Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI
CVE-2026-28779 is a security vulnerability (CVSS 7.5) that allows any application co-hosted under the same domain. High
Apache Airflow 3.0.x prior to 3.2.0 allows remote unauthenticated attackers to trigger unauthorized DAG (Directed Acycli
Authorization bypass in Apache Airflow's Backfill API (all versions prior to 3.3.1) allows any authenticated user holdin
Remote code execution and scheduler-process disruption in Apache Airflow 3.3.0 stems from unguarded deserialization of t
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today