Vulnerability · low
Apache Airflow async connection test overwrites later connection (CVE-2026-111455)
Tier C · Keep an eye on it – Check if you’re affected
Who’s exposed: Airflow 3.3.x deployments that expose the Connections API
Tier C because: Hits tech teams
Reach
Attack
Damage
Fix
Popular tool
What to do
- Upgrade Apache Airflow to 3.4.0 or later.
The Brief
- Apache Airflow 3.3.0 before 3.4.0 has CVE-2026-111455 in its Connections API.
- The asynchronous connection test checks permissions when it is queued, not when it commits.
- If a connection ID is created after the test is queued, the test can overwrite that later connection at commit.
Why it matters
On affected Airflow versions, a user who can queue a connection test can overwrite a connection created afterwards, which could change credentials or settings that DAGs rely on.
The checklist behind the tier
Checklist · 2 of 10 yes
| Yes | Hits tech teams | Judgment: Apache Airflow is a workflow orchestrator that data and ops teams build with and run. |
| No | Core infrastructure | Judgment: Airflow is a single widely used framework, not software nearly every team runs. |
| Yes | Popular tool | Judgment: Apache Airflow is a widely used mainstream data orchestration platform. |
| No | Exploited in the wild | Open Source Security: advisory describes a flaw only; no observed attacks reported. |
| No | Public exploit | Open Source Security: advisory gives a description with no exploit code or PoC mentioned. |
| No | Remote, no login | Open Source Security: flaw involves a permission check on an authorized API user; no unauthenticated access stated. |
| No | Full takeover | Open Source Security: described as an authorization flaw overwriting a connection; no code execution or admin takeover stated. |
| No | Secrets exposed | Open Source Security: describes connection overwrite; no stolen or exposed credentials reported. |
| No | Supply chain | Open Source Security: a normal authorization bug in legitimate code; no malicious code shipped. |
| No | No fix yet | Open Source Security: affects Airflow 3.3.0 before 3.4.0, implying a fixed version exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
- Exploited
- Not in CISA’s exploited catalog
Timeline
Vulnerability disclosed on the oss-sec mailing list by Rahul Vats
Open Source Security
CVE-2026-111455: Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit
Source
CVE-2026-111455: Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit ↗ Open Source Security · 2h ago
First seen · 1 source · Full story page · How tiers are decided