EUVD-2026-57271
GHSA-j4jc-cq9h-xrhr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Requires authenticated DAG edit permission (PR:L); impact covers confidentiality, integrity, and availability of any DAG's backfills (C:L/I:L/A:L), not confidentiality alone.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
6Blast Radius
ecosystem impact- 463 pypi packages depend on apache-airflow (431 direct, 36 indirect)
Ecosystem-wide dependent count for version 3.3.1.
DescriptionCVE.org
Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfill_id path segment failed to parse. The authorization dependency parsed it with int() while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int() rejects (1.0 coerces to 1); FastAPI resolves dependencies before endpoint validation, so the two acted on different Dags. An authenticated user holding edit permission on any single Dag could therefore read, pause and cancel backfills belonging to any other Dag, including moving another Dag's queued runs to failed. No non-default configuration is required and backfill ids are sequential, so finding a target is trivial. Users are advised to upgrade to apache-airflow 3.3.1 or later, which parses the backfill id with the same type the routes declare.
Articles & Coverage 2
AnalysisAI
Authorization bypass in Apache Airflow's Backfill API (all versions prior to 3.3.1) allows any authenticated user holding edit permission on a single DAG to read, pause, cancel, and fail backfills belonging to any other DAG. The flaw is a type-parsing mismatch in FastAPI's dependency resolution layer: the authorization dependency parsed the backfill_id path parameter with Python's int() while the route handler declared NonNegativeInt via Pydantic, which in lax mode coerces inputs like '42.0' that int() rejects-causing the two components to authorize and act on different DAGs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Airflow user account with edit permission on at least one DAG-this is the minimum privilege level that grants Backfill API write access and is not an elevated or administrative role. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-published CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) contains two material errors: it assigns PR:N (no privileges required) despite the description explicitly requiring an authenticated user with at least one DAG edit permission, and it limits impact to C:H while the actual impact includes integrity (pausing and canceling backfills) and availability (moving queued runs to `failed`). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Airflow user with edit permission on their own DAG (`dag_a`) submits a PUT request to the Backfill API using a float-formatted backfill ID such as `42.0` that actually belongs to a victim DAG (`dag_b`). The authorization dependency's `int('42.0')` call raises `ValueError`, causing it to fall back to authorizing against `dag_a` (which the attacker controls and passes), while FastAPI coerces `42.0` to `42` for the handler, which then reads, pauses, or moves `dag_b`'s backfill runs to `failed`. … |
| Remediation | Upgrade to Apache Airflow 3.3.1 or later, which resolves the type-parsing mismatch by using a shared `TypeAdapter[NonNegativeInt]` in the authorization dependency-ensuring the dependency and handler parse the `backfill_id` path parameter identically. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Apache Airflow deployments and identify instances running versions prior to 3.3.1; document affected systems and user populations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Airflow
View allRemote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controll
Unsafe deserialization in Apache Airflow 3.3.0's Task SDK allows an authenticated DAG author to cause arbitrary module i
Unsafe deserialization in Apache Airflow 3.0.0 through 3.3.0 allows any DAG author to achieve arbitrary code execution i
Command injection in Apache Airflow's BashOperator documentation example allows authenticated attackers to escalate priv
We need to produce a JSON object per the instructions. Let's analyze each field. First, product_name: "1-3 words ONLY.
CVE-2026-30911 is a security vulnerability (CVSS 8.1) that allows any authenticated task instance. High severity vulnera
Information disclosure in Apache Airflow 3.0.0 through 3.1.x stems from incomplete secret masking and under-documented w
Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI
CVE-2026-28779 is a security vulnerability (CVSS 7.5) that allows any application co-hosted under the same domain. High
Apache Airflow 3.0.x prior to 3.2.0 allows remote unauthenticated attackers to trigger unauthorized DAG (Directed Acycli
Remote code execution and scheduler-process disruption in Apache Airflow 3.3.0 stems from unguarded deserialization of t
Unauthorized source code disclosure in Apache Airflow before 3.3.0 allows authenticated users to read the source of DAGs
Same weakness CWE-436 – Interpretation Conflict
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today