CVE-2026-68971

Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...

CVE-2026-68971 Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints

Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...

CVE-2026-68971

Apache Airflow is vulnerable to a cross-team authorization bypass in the asset materialization endpoint (POST /api/v2/assets/{asset_id}/materialize) and the XCom result check on wait_dag_run_until_finished. The root cause is that these specific sites authorize the target Dag without considering i...