Executive brief
Apache Airflow is a workflow orchestration platform used to schedule and monitor data pipelines. In multi-team deployments with team-aware authentication, an authenticated user in one team could trigger DAG runs and read data belonging to other teams by exploiting missing team validation in two API endpoints. This allows unauthorized access to sensitive workflow data and the ability to execute unintended jobs across team boundaries.
Technical details
The vulnerability is an authorization bypass in the asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check in `wait_dag_run_until_finished`. Both endpoints authorize the target DAG without resolving its team attribute, causing team-aware auth managers (such as Keycloak) to check the generic `DAG` resource instead of the team-scoped `DAG:<team>` resource. An authenticated user in one team can exploit this by providing a DAG run ID and configuration from another team, then supply arbitrary `conf` values and read XCom outputs. The FAB auth manager is unaffected due to its lack of multi-team support. A fix resolving the DAG's team at both authorization sites was merged in Apache Airflow 3.3.1.
Affected products
- Apache Airflow before 3.3.1
Timeline
- 2026-08-12: disclosed
- 2026-08-04: patched: Fix merged in PR #70893