CVE-2026-40861

A Dag author could either a create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process read-path attack — e.g. "/etc/passwd" or "airflow.cfg" or b supply a "taskid" containing ".." sequences accepted by the Task SDK's "KEYREGEX" write-path...