CVE-2026-68968: Apache Airflow Auth Bypass Vulnerability

CVE-2026-68968 Overview

CVE-2026-68968 is an authorization bypass in the Apache Airflow Backfill API. The flaw stems from an inconsistency in how the backfill_id path segment is parsed between the authorization dependency and the route handler. The authorization dependency uses Python's built-in int(), while the route handler uses pydantic's NonNegativeInt. Because FastAPI resolves dependencies before endpoint validation, values such as 1.0 bypass the authorization check while still resolving to a valid Dag id in the handler. An authenticated user with edit permission on any single Dag can read, pause, and cancel backfills for any other Dag.

Critical Impact
An authenticated user holding edit rights on one Dag can manipulate backfills on any other Dag, including moving queued runs to failed.

Affected Products

Apache Airflow versions prior to 3.3.1
Apache Airflow Backfill API endpoints
Deployments using default configuration (no special settings required for exploitation)

Discovery Timeline

2026-08-12 - CVE CVE-2026-68968 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-68968

Vulnerability Analysis

The vulnerability is a parser differential [CWE-436] between two layers of the FastAPI request pipeline. Apache Airflow's Backfill API declares backfill_id as a path parameter typed as pydantic's NonNegativeInt in the route handler. The authorization dependency, however, parses the same segment with Python's built-in int() function.

The two parsers disagree on inputs that pydantic accepts but int() rejects. For example, the value 1.0 coerces to 1 under pydantic but raises a ValueError under int(). When int() fails inside the authorization dependency, the check falls back to authorizing against a Dag id supplied by the caller rather than the Dag id associated with the requested backfill.

Because FastAPI resolves dependencies before endpoint validation runs, the authorization decision and the route handler operate on two different Dag identities. Backfill ids are sequential, so an attacker does not need to guess targets.

Root Cause

The root cause is inconsistent input interpretation between security-critical and functional code paths. Authorization is enforced against a caller-controlled Dag id whenever int() parsing fails, while the handler proceeds to act on the actual backfill resource.

Attack Vector

An authenticated user with edit permission on any single Dag crafts a Backfill API request using a backfill_id value that pydantic accepts but int() rejects, such as 1.0. The authorization layer approves the request against the attacker's own Dag id, while the handler executes against the targeted backfill. The attacker can then read, pause, cancel, or fail backfills belonging to arbitrary Dags. See the GitHub Pull Request for the corrective code changes.

Detection Methods for CVE-2026-68968

Indicators of Compromise

Backfill API requests where the backfill_id path segment contains non-integer characters such as a decimal point (for example 1.0, 2.0).
Backfill state transitions to failed or cancelled initiated by users who do not own the associated Dag.
Unexpected pause or cancel actions on backfills correlated with authentication sessions holding edit rights on unrelated Dags.

Detection Strategies

Parse Airflow API access logs for Backfill endpoint paths containing characters outside [0-9] in the backfill_id segment.
Correlate authenticated user identity against the Dag ownership of each modified backfill; flag mismatches for review.
Alert on bursts of backfill state changes originating from a single user session across multiple Dags.

Monitoring Recommendations

Enable verbose audit logging on the Airflow API server and forward logs to a centralized SIEM.
Monitor the backfill table for unexpected status transitions and record the acting user for each change.
Track the deployed Airflow version across environments and alert when instances remain below 3.3.1.

How to Mitigate CVE-2026-68968

Immediate Actions Required

Upgrade Apache Airflow to version 3.3.1 or later, which parses backfill_id with the same type declared by the routes.
Inventory all Airflow deployments and prioritize public-facing or multi-tenant instances for patching first.
Review recent backfill state changes and validate them against expected owner activity.

Patch Information

Apache Airflow 3.3.1 aligns the authorization dependency with the route handler by parsing backfill_id using the same pydantic type. Details of the fix are available in the Apache Airflow GitHub pull request and the Apache mailing list announcement.

Workarounds

Restrict network access to the Airflow API server so that only trusted operators can reach Backfill endpoints.
Reduce the number of users granted Dag edit permissions until patching completes.
Place an API gateway or reverse proxy in front of Airflow that rejects backfill_id path segments containing non-digit characters.

bash

# Upgrade Apache Airflow to the patched release
pip install --upgrade "apache-airflow>=3.3.1"

# Verify the installed version
airflow version