EUVD-2026-57271
GHSA-j4jc-cq9h-xrhr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Requires authenticated DAG edit permission (PR:L); impact covers confidentiality, integrity, and availability of any DAG's backfills (C:L/I:L/A:L), not confidentiality alone.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
6Blast Radius
ecosystem impact- 12 pypi packages depend on apache-airflow (1 direct, 11 indirect)
Ecosystem-wide dependent count for version 3.3.1.
DescriptionCVE.org
Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfill_id path segment failed to parse. The authorization dependency parsed it with int() while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int() rejects (1.0 coerces to 1); FastAPI resolves dependencies before endpoint validation, so the two acted on different Dags. An authenticated user holding edit permission on any single Dag could therefore read, pause and cancel backfills belonging to any other Dag, including moving another Dag's queued runs to failed. No non-default configuration is required and backfill ids are sequential, so finding a target is trivial. Users are advised to upgrade to apache-airflow 3.3.1 or later, which parses the backfill id with the same type the routes declare.
Articles & Coverage 2
AnalysisAI
Authorization bypass in Apache Airflow's Backfill API (all versions prior to 3.3.1) allows any authenticated user holding edit permission on a single DAG to read, pause, cancel, and fail backfills belonging to any other DAG. The flaw is a type-parsing mismatch in FastAPI's dependency resolution layer: the authorization dependency parsed the backfill_id path parameter with Python's int() while the route handler declared NonNegativeInt via Pydantic, which in lax mode coerces inputs like '42.0' that int() rejects-causing the two components to authorize and act on different DAGs. Backfill IDs are sequential, making cross-DAG enumeration trivial; no public exploit code has been identified at time of analysis, though the technique is directly reproducible from the published patch diff.
Technical ContextAI
The root cause is CWE-436 (Interpretation Conflict), a vulnerability class where two components parse the same input differently and reach conflicting security decisions. In Apache Airflow's FastAPI-based REST API (airflow-core/src/airflow/api_fastapi/core_api/security.py), the requires_access_backfill dependency resolved the backfill_id path parameter using Python's built-in int(), while every Backfill route handler declared it as Pydantic's NonNegativeInt. FastAPI resolves Depends() before executing endpoint validation; Pydantic's lax coercion mode accepts float-string representations such as '42.0' and '42.00', coercing them to integer 42, whereas int('42.0') raises a ValueError. When int() raised, the dependency fell back to authorizing against the caller-supplied dag_id in the request body or query string, then FastAPI passed the original string to the endpoint which Pydantic silently coerced-the dependency and handler acted on entirely different DAGs. The fix in PR #70889 introduces a shared TypeAdapter[NonNegativeInt] instance (_BACKFILL_ID_ADAPTER) used identically in both the security dependency and the routes, eliminating the coercion divergence. Affected CPE: cpe:2.3:a:apache_software_foundation:apache_airflow:*:*:*:*:*:*:*:* with version range < 3.3.1.
RemediationAI
Upgrade to Apache Airflow 3.3.1 or later, which resolves the type-parsing mismatch by using a shared TypeAdapter[NonNegativeInt] in the authorization dependency-ensuring the dependency and handler parse the backfill_id path parameter identically. The upstream fix is available in GitHub PR #70889 (https://github.com/apache/airflow/pull/70889). For deployments unable to upgrade immediately, restrict Backfill API write access by scoping role-based permissions so users hold DAG edit rights only on the minimum required set of DAGs; this limits blast radius but does not close the bypass, since any user with any DAG edit permission can exploit the flaw. Blocking untrusted network clients from reaching the Airflow REST API is an additional layer of defense, though it may interrupt legitimate automation. There is no configuration flag to disable Backfill API endpoint routing without patching.
More in Apache Airflow
View allRemote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controll
Unsafe deserialization in Apache Airflow 3.3.0's Task SDK allows an authenticated DAG author to cause arbitrary module i
Unsafe deserialization in Apache Airflow 3.0.0 through 3.3.0 allows any DAG author to achieve arbitrary code execution i
Remote code execution in Apache Airflow 3.1.x allows authenticated DAG Authors to execute arbitrary code in the webserve
Command injection in Apache Airflow's BashOperator documentation example allows authenticated attackers to escalate priv
Unsafe XCom templating in Apache Airflow's documented example DAG (`example_xcom.py`) allowed an authenticated UI user w
CVE-2026-30911 is a security vulnerability (CVSS 8.1) that allows any authenticated task instance. High severity vulnera
Information disclosure in Apache Airflow 3.0.0 through 3.1.x stems from incomplete secret masking and under-documented w
Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI
CVE-2026-28779 is a security vulnerability (CVSS 7.5) that allows any application co-hosted under the same domain. High
Apache Airflow before 3.2.0 exposes SQL exception stack traces through API responses despite api/expose_stack_traces=fal
Apache Airflow 3.0.x prior to 3.2.0 allows remote unauthenticated attackers to trigger unauthorized DAG (Directed Acycli
Same weakness CWE-436 – Interpretation Conflict
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today