Executive brief
Apache Airflow is a platform used to automate and manage complex data workflows. A security flaw in its 'Human-in-the-Loop' (HITL) feature allows a user or automated task to interfere with workflows they do not own. This could lead to unauthorized individuals approving or rejecting critical business processes, potentially causing data integrity issues or unauthorized operational changes.
Technical details
A missing authorization vulnerability (CWE-862) exists in the Apache Airflow Execution API, specifically within the Human-in-the-Loop (HITL) endpoints. The root cause is a failure to validate that an incoming request for a HITL action (such as approval or rejection) originates from the specific task instance authorized to perform that action. An attacker with low-privileged network access—specifically any authenticated task instance—can exploit this to manipulate HITL workflows belonging to any other task instance. This allows for unauthorized reading of workflow data and the ability to bypass intended manual intervention steps. The issue is resolved in version 3.1.8.
Affected products
- Apache Airflow 3.1.0 to 3.1.7
Timeline
- 2026-03-17: disclosed
- 2026-03-17: advisory
- 2026-03-18: patched: GitHub advisory reviewed date