# CVE-2026-111455: Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/598) · 2026-11-09 · Security
Page: https://themorning.dev/story/cve-2026-111455-apache-airflow-connections-api-async-connection-test-authorizes-8f08a73c169d610a
Kind: security · Impact: low

## In brief

- Apache Airflow 3.3.0 before 3.4.0 has CVE-2026-111455 in its Connections API.
- The asynchronous connection test checks permissions when it is queued, not when it commits.
- If a connection ID is created after the test is queued, the test can overwrite that later connection at commit.

## Why it matters

On affected Airflow versions, a user who can queue a connection test can overwrite a connection created afterwards, which could change credentials or settings that DAGs rely on.

## What to do

- Upgrade Apache Airflow to 3.4.0 or later.

## Versions

- Apache Airflow 3.3.0
- Apache Airflow 3.4.0

## CVEs

- CVE-2026-111455

## Timeline

- 2026-11-08: Vulnerability disclosed on the oss-sec mailing list by Rahul Vats

## Coverage

- [CVE-2026-111455: Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit](https://seclists.org/oss-sec/2026/q4/598) — Open Source Security, 2026-11-09

Tags: apache-airflow, security, cve-2026-111455, connections-api, authorization

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev