UNKNOWN NVD
CVE-2026-111455
Apache Airflow's asynchronous connection test checked permissions when the test was queued — only create permission when the connection ID did not exist yet — b
Apache Airflow's asynchronous connection test checked permissions when the test was queued — only create permission when the connection ID did not exist yet — but, when the test completed with `commit_on_success`, wrote the tested connection under that ID. A user allowed to create but not edit connections could overwrite a connection someone else had created in the meantime. Only deployments that enable the non-default `[core] test_connection` setting are affected. Users are advised to upgrade to apache-airflow 3.4.0 or later.
References
- https://github.com/apache/airflow/pull/74837
- https://lists.apache.org/thread.html/j3tqo8wd53mcyvkkw4z5pnt9tckks0j2
- http://www.openwall.com/lists/oss-security/2026/11/09/18
- https://www.openwall.com/lists/oss-security/2026/11/09/18
This unknown severity vulnerability was published on 2026-11-09 via NVD.
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.