CVE-2026-111455
Apache Airflow's asynchronous connection test checked permissions when the test was queued — only create permission when the connection ID did not exist yet — but, when the test completed with commit_on_success, wrote the tested connection under that ID. A user allowed to create but not edit connections could overwrite a connection someone else had created in the meantime. Only deployments that enable the non-default [core] test_connection setting are affected. Users are advised to upgrade to apache-airflow 3.4.0 or later.
AI analysis
Not analysed yet.
Claude analyses new vulnerabilities after each morning's collection, most important first, up to a daily limit. The verified data on this page is complete without it.
The sources do not list affected products or versions for this vulnerability yet.
Published
First publication at the source
Collected
First seen by Baba Yaga Security