CVE-2026-86473 – Apache Airflow
“When a read-only user can stop your schedules and logging out ends nothing, your access controls are only for show.”
Apache Airflow 3.3.2 fixes two access-control flaws that weaken authorization and session handling in the platform. CVE-2026-86473 has a CVSS score of 9.1, Critical severity. The Core API logout endpoint revokes a session token only when the token arrives as the _token cookie. API clients that send a bearer token in the Authorization header get a normal logout response, but the token is not revoked. Anyone who already holds a copy of that token keeps the victim's access for the rest of its lifetime, which is 24 hours by default.
CVE-2026-75157 has a CVSS score of 7.5, High severity. The asset queued-events DELETE endpoints check for READ permission on a Dag when they should check for EDIT. Any authenticated user who can read a Dag can delete its queued asset events and quietly stop asset-triggered scheduling. Standard RBAC setups are exposed with no special configuration needed. Upgrade to apache-airflow 3.3.2 or later to close both issues.
Key Details
- Affected Product
- Apache Airflow
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-613