BIT-AIRFLOW-2026-68968 Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

CVE-2026-68968

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

CVE-2026-68968

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

CVE-2026-68968 Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

EUVD-2026-57271

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

CVE-2026-68968 Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

CVE-2026-68968

The CVE affects Apache Airflow (Backfill API). A mismatch between dependency parsing and endpoint validation for backfill_id (int() vs NonNegativeInt) allows an authenticated user with edit rights on one Dag to read, pause, and cancel backfills for other Dags. FastAPI resolves dependencies before...

CVE-2026-68968 Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

BIT-MASTODON-2026-27468 Mastodon may allow unconfirmed FASP to make subscriptions

Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versions 4.4.0 through 4.4.13 and 4.5.0 through 4.5.6, actions performed by a FASP to subscribe to account/content lifecycle events or to backfill content...

CVE-2026-27468

Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versions 4.4.0 through 4.4.13 and 4.5.0 through 4.5.6, actions performed by a FASP to subscribe to account/content lifecycle events or to backfill content...

CVE-2026-27468 Mastodon may allow unconfirmed FASP to make subscriptions

Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versions 4.4.0 through 4.4.13 and 4.5.0 through 4.5.6, actions performed by a FASP to subscribe to account/content lifecycle events or to backfill content...

CVE-2026-27468 Mastodon may allow unconfirmed FASP to make subscriptions

Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versions 4.4.0 through 4.4.13 and 4.5.0 through 4.5.6, actions performed by a FASP to subscribe to account/content lifecycle events or to backfill content...

CVE-2026-27468

Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versions 4.4.0 through 4.4.13 and 4.5.0 through 4.5.6, actions performed by a FASP to subscribe to account/content lifecycle events or to backfill content...

PT-2026-21779

Name of the Vulnerable Software and Affected Versions Mastodon versions 4.4.0 through 4.4.13 Mastodon versions 4.5.0 through 4.5.6 Description Mastodon is a free, open-source social network server based on ActivityPub. The issue relates to FASP Federated Actor Subscription Protocol registration,...

Timewarrior - Commandline Time Reporting

Timewarrior is a time tracking utility that offers simple stopwatch features as well as sophisticated calendar-based backfill, along with flexible reporting. It is a portable, well supported and very active Open Source project. Installing From Package Thanks to the community, there are binary...