PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-41084 Apache Software Foundation CVE debrief

A CWE-639 authorization bypass in Apache Airflow's bulk Task Instances API allows authenticated users with edit permission on one DAG to mutate Task Instance state in any other DAG. The vulnerability exists because the `PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances` endpoint evaluates authorization against the `dag_id` in the URL path while applying mutations to `dag_id` and `dag_run_id` values extracted from request-body entity fields. An attacker can keep an authorized DAG's ID in the URL path while specifying target DAG and DAG run IDs in the request body entities, thereby bypassing per-DAG access controls. This affects deployments that rely on per-DAG edit scopes to isolate Task Instance state between teams. The vulnerability was disclosed on 2026-06-01. Users should upgrade to `apache-airflow` 3.2.2 or later.

Vendor
Apache Software Foundation
Product
Apache Airflow
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-06-01
Advisory published
2026-06-01
Advisory updated
2026-06-01

Who should care

Organizations running Apache Airflow with per-DAG permission scoping for team isolation, particularly those using the REST API for bulk Task Instance operations in automated workflows or custom tooling.

Technical summary

The bulk Task Instances API endpoints (`PATCH` and `DELETE`) for `/api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances` contain an authorization bypass where the permission check is performed against the `dag_id` from the URL path parameter, but the actual bulk mutation operations are executed against `dag_id` and `dag_run_id` values parsed from individual entities within the request body. This identifier mismatch enables an authenticated attacker with edit permissions on any single DAG to construct requests that pass authorization (using an allowed DAG in the URL) while targeting arbitrary DAGs and DAG runs by embedding their identifiers in the request body entities. The vulnerability undermines per-DAG access control boundaries in multi-tenant or multi-team Airflow deployments.

Defensive priority

high

Recommended defensive actions

  • Upgrade to apache-airflow 3.2.2 or later to remediate this authorization bypass
  • Audit Task Instance state changes in multi-team deployments that rely on per-DAG edit scopes for isolation
  • Review access logs for bulk Task Instances API calls where URL path dag_id differs from body entity dag_id values
  • Validate that authorization checks in custom API endpoints consistently use the same entity identifiers for both permission evaluation and operation execution
  • Apply principle of least privilege for DAG-level permissions and monitor for anomalous cross-DAG Task Instance mutations

Evidence notes

Authorization check uses URL path `dag_id`; mutation uses body entity `dag_id`/`dag_run_id`. CWE-639 (Authorization Bypass Through User-Controlled Key) identified by Apache security team. Fix available in apache-airflow 3.2.2 per vendor advisory.

Official resources

2026-06-01