CVE-2026-30911

CVE-2026-30911 affects Apache Airflow versions 3.1.0–3.1.7, where the Execution API’s Human-in-the-Loop (HITL) endpoints lack proper authorization. This allows any authenticated task instance to read, approve, or reject HITL workflows belonging to other task instances. Root cause: missing access ...