CVE-2026-68968

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1

Description An authorization flaw exists in the Backfill API where a discrepancy in how the backfill id path segment is parsed allows an authenticated user with edit permissions on any single Dag to perform unauthorized actions on other Dags. The authorization dependency uses int() for parsing, while the route handler uses pydantic's NonNegativeInt, which accepts values that int() rejects (for example, 1.0 is coerced to 1). Because FastAPI resolves dependencies before endpoint validation, the authorization check and the actual operation act on different Dags. This allows users to read, pause, and cancel backfills of other Dags, or move queued runs to a failed state. Since backfill ids are sequential, identifying targets is trivial.

Recommendations Upgrade to version 3.3.1 or later.