CVE-2026-40861 Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler

A Dag author could either a create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process read-path attack — e.g. /etc/passwd or airflow.cfg or b supply a taskid containing .. sequences accepted by the Task SDK's KEYREGEX write-path attack, and...

CVE-2026-40861

In Apache Airflow , a Dag author can exploit a path resolution flaw in the FileTaskHandler to leak or overwrite arbitrary files. This occurs because the handler resolves log paths outside the configured base_log_folder. Vulnerable paths can be accessed via two methods: (a) creating a symlink in a...

CVE-2026-40861: Improper Link Resolution Before File Access

A Dag author could either a create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process read-path attack — e.g. /etc/passwd or airflow.cfg or b supply a taskid containing .. sequences accepted by the Task SDK's KEYREGEX write-path attack, and...