CVE-2026-41084 Details
Description
A bug in Apache Airflow's bulk Task Instances API (`PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances`) evaluated authorization against the `dag_id` resolved from the URL path while operating on the `dag_id` / `dag_run_id` extracted from request-body entity fields. An authenticated UI/API user with edit permission on one Dag could mutate Task Instance state in any other Dag by keeping the authorized Dag's ID in the URL path and naming the target Dag's IDs in the request body entities. Affects deployments that rely on per-Dag edit-scope to keep Task Instance state isolated between teams. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.
An authorization bypass vulnerability has been identified in Apache Airflow's bulk Task Instances API, specifically in versions 3.2.0 prior to 3.2.2. The issue arises because the API evaluated authorization based on the DAG ID in the URL path, while the actual operation was performed using DAG IDs extracted from the request body. This flaw allowed an authenticated user with edit permissions on one DAG to modify the Task Instance state of any other DAG by manipulating the request body. The vulnerability impacts deployments that use per-DAG edit scopes to maintain Task Instance state separation between teams.
Users are advised to upgrade to Apache Airflow version 3.2.2 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/05/31/7 | CVE | Mailing ListThird Party Advisory |
| https://github.com/apache/airflow/pull/64288 | [email protected] | Issue TrackingPatch |
| https://lists.apache.org/thread/w0hdcqfr71hf9rl1bwvpjs7q9yp1bldk | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache airflow | >= 3.2.0, < 3.2.2 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 2, 2026 | Initial Analysis | [email protected] |
| Jun 2, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | CVE Modified | CVE |
| Jun 1, 2026 | New CVE Received | [email protected] |