CVE-2026-111455Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit

Descripción

Apache Airflow's asynchronous connection test checked permissions when the test was queued — only create permission when the connection ID did not exist yet — but, when the test completed with `commit_on_success`, wrote the tested connection under that ID. A user allowed to create but not edit connections could overwrite a connection someone else had created in the meantime. Only deployments that enable the non-default `[core] test_connection` setting are affected. Users are advised to upgrade to apache-airflow 3.4.0 or later.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• https://github.com/apache/airflow/pull/74837 patch
• https://lists.apache.org/thread.html/j3tqo8wd53mcyvkkw4z5pnt9tckks0j2 vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/11/09/18