Airflow async connection test can overwrite later connections
A create-only user can replace a connection created by someone else when commit_on_success runs after the test.
32
CVE-2026-111455
Connection overwrite in Apache Airflow before 3.4.0
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Airflow's async connection test checks create permissions at queue time but overwrites a connection at commit if one exists meanwhile, when test_connection is enabled. Users with create but not edit access can race to overwrite others' connections. Only deployments with the non-default setting are affected.
What to do: Upgrade to Apache Airflow 3.4.0 or later. No workaround provided.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Airflow | before 3.4.0 | 3.4.0 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Apache Airflow's asynchronous connection test checked permissions when the test was queued — only create permission when the connection ID did not exist yet — but, when the test completed with `commit_on_success`, wrote the tested connection under that ID. A user allowed to create but not edit connections could overwrite a connection someone else had created in the meantime. Only deployments that enable the non-default `[core] test_connection` setting are affected. Users are advised to upgrade to apache-airflow 3.4.0 or later.
- Weakness
- CWE-863