Airflow async connection test can overwrite later connections
Original title: CVE-2026-111455: Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit
A create-only user can replace a connection created by someone else when commit_on_success runs after the test.
Apache Airflow 3.3.0 before 3.4.0 checks the asynchronous connection test at enqueue time, requiring only create permission if the connection ID does not yet exist. With commit_on_success, the completed test writes the tested connection under that ID. A user allowed to create but not edit connections could overwrite a connection created later by someone else. The advisory rates the issue low.
Unconfirmed: The mailing-list text is cut off before naming who created the overwritten connection.
- CVE-2026-111455 affects Apache Airflow 3.3.0 before 3.4.0.
- Permission is checked when the test is queued, not when it commits.
- Create-only users can overwrite connections they are not allowed to edit.
- The posted severity is low.
Impact: Overwrite a connection the user cannot edit
| Product | Affected | Fixed in |
|---|---|---|
| Apache Airflow | 3.3.0 before 3.4.0 | 3.4.0 |
- 1.Upgrade Apache Airflow 3.3.0 installations to 3.4.0.
- CVEs
- CVE-2026-111455
- Vendors
- Apache
- Products
- Apache Airflow
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111455 | Connection overwrite in Apache Airflow before 3.4.0 | — | — |
From the original article
Posted by Rahul Vats on Nov 08 Severity: low Affected versions: - Apache Airflow 3. 3. 0 before 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.