CVE-2026-41084

A bug in Apache Airflow's bulk Task Instances API "PATCH/DELETE /api/v2/dags/dagid/dagRuns/dagrunid/taskInstances" evaluated authorization against the "dagid" resolved from the URL path while operating on the "dagid" / "dagrunid" extracted from request-body entity fields. An authenticated UI/API...

CVE-2026-41084: Authorization Bypass Through User-Controlled Key

A bug in Apache Airflow's bulk Task Instances API PATCH/DELETE /api/v2/dags/dagid/dagRuns/dagrunid/taskInstances evaluated authorization against the dagid resolved from the URL path while operating on the dagid / dagrunid extracted from request-body entity fields. An authenticated UI/API user wit...