---
id: CVE-2026-30911
title: >-
  Apache Airflow versions 3.1.0 through 3.1.7 missing authorization
  vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that
  allows any authenticated task instance to read, approve, or reject HITL
  workflows belonging to…
summary: >-
  Apache Airflow versions 3.1.0 through 3.1.7 missing authorization
  vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that
  allows any authenticated task instance to read, approve, or reject HITL
  workflows belonging to…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-862
vendor: apache
product: airflow
affected:
  - 'airflow >= 3.1.0, < 3.1.8'
patched:
  - airflow 3.1.8
published: '2026-03-17'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T07:19:09.360'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-30911'
references:
  - url: 'https://github.com/apache/airflow/pull/62886'
    label: security@apache.org
  - url: 'https://lists.apache.org/thread/1rs2v7fcko2otl6n9ytthcj87cmsgx51'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/03/17/2'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-03-17T13:41:43.644872Z'
epss: 0.00558
epssPercentile: 0.46683
ingestedAt: '2026-11-05T06:38:03.608Z'
---

## Overview

Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance.


Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

## Affected

- `airflow >= 3.1.0, < 3.1.8`

## Remediation

Upgrade past the affected range:

- `airflow 3.1.8`