CVE-2026-68971

Apache Airflow contains a cross‑team authorization bypass in the asset materialization endpoint (POST /api/v2/assets/{asset_id}/materialize) and the XCom wait result check. In multi‑team deployments with a team‑aware auth manager, an authenticated user can trigger Dags and read another team’s XCo...