CVE-2026-40861 Details
Description
A Dag author could either (a) create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process (read-path attack — e.g. `/etc/passwd` or `airflow.cfg`) or (b) supply a `task_id` containing `..` sequences accepted by the Task SDK's `KEY_REGEX` (write-path attack), and in both cases the FileTaskHandler resolves the log path outside the configured `base_log_folder`, leaking or overwriting arbitrary files. Only affects deployments where the worker log folder is shared with the API server. Users are advised to upgrade to `apache-airflow` 3.2.2 or later. As a defense-in-depth mitigation, deploy the worker and API server with separate log volumes so that worker-controlled paths cannot reach the API server's filesystem.
A vulnerability exists in Apache Airflow versions prior to 3.2.2, allowing a DAG author to create a symlink in their task's log directory that points to an arbitrary file readable by the API server process. This read-path attack could target files like '/etc/passwd' or 'airflow.cfg'. Alternatively, the author could supply a 'task_id' with '..' sequences that bypass the Task SDK's 'KEY_REGEX', leading to a write-path attack. In both scenarios, the FileTaskHandler resolves the log path outside the designated 'base_log_folder', causing unauthorized leakage or overwriting of files. This issue arises only in deployments where the worker log folder is shared with the API server.
Users are advised to upgrade to Apache Airflow version 3.2.2 or later. As an additional precaution, deploy the worker and API server with separate log volumes to prevent worker-controlled paths from accessing the API server's filesystem.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/05/31/1 | CVE | Mailing ListThird Party Advisory |
| https://github.com/apache/airflow/pull/65325 | [email protected] | Issue TrackingPatch |
| https://lists.apache.org/thread/823334db2559xjlwt59gpzjz47thnscl | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache airflow | < 3.2.2 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 2, 2026 | Initial Analysis | [email protected] |
| Jun 2, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | CVE Modified | CVE |
| Jun 1, 2026 | New CVE Received | [email protected] |