SecurityFan score 21 · Tier C
CVE-2026-111455: Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit
The Brief
- Apache Airflow 3.3.0 before 3.4.0 has CVE-2026-111455 in its Connections API.
- The asynchronous connection test checks permissions when it is queued, not when it commits.
- If a connection ID is created after the test is queued, the test can overwrite that later connection at commit.
Why it matters
On affected Airflow versions, a user who can queue a connection test can overwrite a connection created afterwards, which could change credentials or settings that DAGs rely on.
Who’s affected
- Teams running Apache Airflow 3.3.0 before 3.4.0
- Operators who expose the Airflow Connections API
What to do
- Upgrade Apache Airflow to 3.4.0 or later.
- Apache Airflow 3.3.0
- Apache Airflow 3.4.0
- CVE-2026-111455
- #apache-airflow
- #security
- #cve-2026-111455
- #connections-api
- #authorization
Posted by Rahul Vats on Nov 08 Severity: low Affected versions: - Apache Airflow 3.3.0 before 3.4.0 Description: Apache Airflow's asynchronous connection test checked permissions when the test was queued — only create permission when the connection ID did not exist yet —…
Timeline
Vulnerability disclosed on the oss-sec mailing list by Rahul Vats
Open Source Security
CVE-2026-111455: Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit