CVE-2026-68971

Apache Airflow versions prior to 3.3.1 contain a cross-team authorization bypass in two API sites: the asset materialization endpoint (POST /api/v2/assets/{asset_id}/materialize) and the XCom result check on wait_dag_run_until_finished. Unlike all other authorization points, these two sites resol...