{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-111455", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-10-16T04:01:39.077Z", "datePublished": "2026-11-09T09:06:33.573Z", "dateUpdated": "2026-11-09T09:07:20.025Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-09T09:06:33.573Z"}, "title": "Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit", "problemTypes": [{"descriptions": [{"description": "CWE-863: Incorrect Authorization", "lang": "en", "cweId": "CWE-863", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow", "packageURL": "pkg:pypi/apache-airflow-core", "versions": [{"status": "affected", "version": "3.3.0", "lessThan": "3.4.0", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://pypi.python.org", "packageName": "apache-airflow-core"}], "descriptions": [{"value": "Apache Airflow's asynchronous connection test checked permissions when the test was queued \u2014 only create permission when the connection ID did not exist yet \u2014 but, when the test completed with `commit_on_success`, wrote the tested connection under that ID. A user allowed to create but not edit connections could overwrite a connection someone else had created in the meantime. Only deployments that enable the non-default `[core] test_connection` setting are affected. Users are advised to upgrade to apache-airflow 3.4.0 or later.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Apache Airflow's asynchronous connection test checked permissions when the test was queued \u2014 only create permission when the connection ID did not exist yet \u2014 but, when the test completed with `commit_on_success`, wrote the tested connection under that ID. A user allowed to create but not edit connections could overwrite a connection someone else had created in the meantime. Only deployments that enable the non-default `[core] test_connection` setting are affected. Users are advised to upgrade to apache-airflow 3.4.0 or later."}]}], "references": [{"url": "https://github.com/apache/airflow/pull/74837", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread.html/j3tqo8wd53mcyvkkw4z5pnt9tckks0j2", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Evan Ricafort (@evanricafort) of Invalid Web Security", "type": "finder"}, {"lang": "en", "value": "Jarek Potiuk", "type": "remediation developer"}], "x_generator": {"engine": "airflow-s/generate_cve_json.py"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/11/09/18"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-09T09:07:20.025Z"}}]}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected", "packageName": "apache-airflow-core", "packageURL": "pkg:pypi/apache-airflow-core", "product": "Apache Airflow", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "3.4.0", "status": "affected", "version": "3.3.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Apache Airflow's asynchronous connection test checked permissions when the test was queued \u2014 only create permission when the connection ID did not exist yet \u2014 but, when the test completed with `commit_on_success`, wrote the tested connection under that ID. A user allowed to create but not edit connections could overwrite a connection someone else had created in the meantime. Only deployments that enable the non-default `[core] test_connection` setting are affected. Users are advised to upgrade to apache-airflow 3.4.0 or later."}], "id": "CVE-2026-111455", "lastModified": "2026-11-09T10:17:05.133", "metrics": {}, "published": "2026-11-09T10:17:05.133", "references": [{"source": "security@apache.org", "url": "https://github.com/apache/airflow/pull/74837"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/j3tqo8wd53mcyvkkw4z5pnt9tckks0j2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/11/09/18"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security@apache.org", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.3.0,3.4.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Airflow", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "airflow", "vendor": "apache"}], "created": "2026-11-09T10:30:09.042957+00:00", "updated": "2026-11-09T10:45:07.801750+00:00", "vendors": ["apache", "apache$PRODUCT$airflow"]}