Authorization Bypass Through User-Controlled Key Affecting apache-airflow-core package, versions [,3.2.2)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Authorization Bypass Through User-Controlled Key vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PYTHON-APACHEAIRFLOWCORE-17137559
- published3 Jun 2026
- disclosed1 Jun 2026
- creditPirikara
Introduced: 1 Jun 2026
CVE-2026-41084 (opens in a new tab)How to fix?
Upgrade apache-airflow-core to version 3.2.2 or higher.
Overview
Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the bulk Task Instances API (PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances) that evaluates authorization against the dag_id resolved from the URL path while operating on the dag_id / dag_run_id extracted from request-body entity fields. An authenticated UI/API user with edit permission on one Dag could mutate Task Instance state in any other Dag by keeping the authorized Dag's ID in the URL path and naming the target Dag's IDs in the request body entities.
Note:
This is only exploitable in deployments that rely on per-Dag edit-scope to keep Task Instance state isolated between teams.