CLEANSTART-2026-OM50067 Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse

Security vulnerability affects the airflow-3 package. Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse...

CLEANSTART-2026-IX15108 Security fix for CVE-2024-6104 applied in: prometheus 2.47.2-r0, rekor-backfill-index 1.2.2-r0

CVE-2024-6104 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-QY94875 Security fixes in rekor-backfill-index 1.4.3-r0

Package rekor-backfill-index version 1.4.3-r0 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...

CLEANSTART-2026-ME27346 Security fixes in rekor-backfill-index 1.4.3-r1

Package rekor-backfill-index version 1.4.3-r1 fixes 1 vulnerabilities: ghsa-fcv2-xgw5-pqxf...

CLEANSTART-2026-EN93855 Security fixes in rekor-backfill-index 1.4.3-r2

Package rekor-backfill-index version 1.4.3-r2 fixes 3 vulnerabilities: ghsa-fw7p-63qq-7hpr, CVE-2026-26958, ghsa-mqqf-5wvp-8fh8...

CLEANSTART-2026-HZ27786 Security fixes in rekor-backfill-index 1.2.2-r0

Package rekor-backfill-index version 1.2.2-r0 fixes 7 vulnerabilities: CVE-2026-56864, CVE-2026-56865, CVE-2024-6104, ghsa-pmwq-pjrm-6p5r, CVE-2026-2303...

PT-2026-89958

Package rekor-backfill-index version 1.4.3-r1 fixes 1 vulnerabilities: ghsa-fcv2-xgw5-pqxf...

PT-2026-89964

Package rekor-backfill-index version 1.4.3-r0 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...

BIT-AIRFLOW-2026-68968 Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

PT-2026-73240

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfill id path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

GHSA-J4JC-CQ9H-XRHR Apache Airflow Backfill API parser discrepancy permits cross-DAG authorization bypass

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

Apache Airflow Backfill API parser discrepancy permits cross-DAG authorization bypass

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

PYSEC-2026-3710

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

PYSEC-2026-3710

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

CVE-2026-68968

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

CVE-2026-68968

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the "backfillid" path segment failed to parse. The authorization dependency parsed it with "int" while the route handler parsed it as pydantic's "NonNegativeInt", which accepts values "int" rejects...

EUVD-2026-57271

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

CVE-2026-68968 Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

CVE-2026-68968

Apache Airflow's Backfill API is vulnerable to an authorization bypass due to an interpretation conflict in how the backfill_id path segment is parsed. The authorization dependency uses int(), while the route handler uses pydantic's NonNegativeInt; this allows values like 1.0 (which coerces to 1 ...

CVE-2026-68968 Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...