https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T20:08:49.554910+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-airflow-2026-41084 BIT-airflow-2026-41084 — Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation 2026-10-04T20:08:49.633409+00:00

Affected: Bitnami: airflow

A bug in Apache Airflow's bulk Task Instances API (`PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances`) evaluated authorization against the `dag_id` resolved from the URL path while operating on the `dag_id` / `dag_run_id` extracted from request-body entity fields. An authenticated UI/API user with edit permission on one Dag could mutate Task Instance state in any other Dag by keeping the authorized Dag's ID in the URL path and naming the target Dag's IDs in the request body entities. Affects deployments that rely on per-Dag edit-scope to keep Task Instance state isolated between teams. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.

 https://cve.radiocsirt.org/vuln/cleanstart-2026-bm42810 CLEANSTART-2026-BM42810 — Security fix for CVE-2026-41084 applied in: airflow-3 3.1.8-r5 2026-10-04T20:08:49.633483+00:00

Affected: CleanStart: airflow-3

Security vulnerability affects the airflow-3 package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-324047 EUVD-2026-324047 2026-10-04T20:08:49.633506+00:00 EUVD-2026-324047 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41084 fkie_cve-2026-41084 2026-10-04T20:08:49.633520+00:00

A bug in Apache Airflow's bulk Task Instances API (`PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances`) evaluated authorization against the `dag_id` resolved from the URL path while operating on the `dag_id` / `dag_run_id` extracted from request-body entity fields. An authenticated UI/API user with edit permission on one Dag could mutate Task Instance state in any other Dag by keeping the authorized Dag's ID in the URL path and naming the target Dag's IDs in the request body entities. Affects deployments that rely on per-Dag edit-scope to keep Task Instance state isolated between teams. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.

 https://cve.radiocsirt.org/vuln/ghsa-mxq5-f9c5-w4p5 GHSA-mxq5-f9c5-w4p5 — Apache Airflow Vulnerable to Authorization Bypass Through User-Controlled Key 2026-10-04T20:08:49.633546+00:00

Affected: PyPI: apache-airflow

A bug in Apache Airflow's bulk Task Instances API (`PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances`) evaluated authorization against the `dag_id` resolved from the URL path while operating on the `dag_id` / `dag_run_id` extracted from request-body entity fields. An authenticated UI/API user with edit permission on one Dag could mutate Task Instance state in any other Dag by keeping the authorized Dag's ID in the URL path and naming the target Dag's IDs in the request body entities. Affects deployments that rely on per-Dag edit-scope to keep Task Instance state isolated between teams. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.

 https://cve.radiocsirt.org/vuln/pysec-2026-183 PYSEC-2026-183 2026-10-04T20:08:49.633570+00:00

Affected: PyPI: apache-airflow

A bug in Apache Airflow's bulk Task Instances API (`PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances`) evaluated authorization against the `dag_id` resolved from the URL path while operating on the `dag_id` / `dag_run_id` extracted from request-body entity fields. An authenticated UI/API user with edit permission on one Dag could mutate Task Instance state in any other Dag by keeping the authorized Dag's ID in the URL path and naming the target Dag's IDs in the request body entities. Affects deployments that rely on per-Dag edit-scope to keep Task Instance state isolated between teams. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1761 WID-SEC-W-2026-1761 — Apache Airflow: Mehrere Schwachstellen 2026-10-04T20:08:49.633591+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um beliebigen Programmcode auszuführen, um Informationen offenzulegen, um Dateien zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.