IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-03-17 11:16

MODIFIED

2026-03-17 11:16

EPSS (Prob. Exploit)

0.74%

Top 45.9%

DATA SOURCES:

NVD 🔗 2026-03-17 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-05

> DESCRIPTION

Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-862

> CWE DETAILED DESCRIPTIONS

CWE-862: Missing Authorization - The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

> GITHUB SECURITY ADVISORY

GHSA-8x34-9q3v-h7g8 HIGH

Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization

AFFECTED PACKAGES:

PIP / apache-airflow

>= 3.1.0, < 3.1.8

Fixed in: 3.1.8

> HISTORIQUE DES MODIFICATIONS

Première apparition

17/03/2026 11:16

Source: NVD

📊 ENRICHISSEMENT 01/04/2026 06:02

CWE

Champ modifié: Description CWE

Ancienne valeur:

N/A

Nouvelle valeur:

CWE-862: Missing Authorization - The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Total des modifications: 1 Dernière mise à jour: 7 months ago

> REFERENCES

https://github.com/apache/airflow/pull/62886

https://lists.apache.org/thread/1rs2v7fcko2otl6n9ytthcj87cmsgx51