CVE-2026-68968: 
Apache Airflow vulnerability analysis and mitigation

CVE-2026-68968 is an authorization bypass vulnerability in Apache Airflow's Backfill API caused by conflicting interpretations of the backfill_id path parameter. The authorization dependency parsed the parameter using Python's int(), while the route handler used Pydantic's NonNegativeInt, which accepts values like 1.0 that int() rejects — causing the two components to act on different DAGs. All versions of Apache Airflow before 3.3.1 are affected. It was disclosed on August 12, 2026, with a fix released in version 3.3.1. The CVSS v3.1 base score is 7.5 (High) (Apache Advisory, GitHub Advisory).

The root cause is an interpretation conflict (CWE-436) between the FastAPI authorization dependency (requires_access_backfill) and the route handler. The dependency used int() to parse the backfill_id path segment, while the route declared backfill_id: NonNegativeInt (Pydantic). Because FastAPI resolves dependencies before endpoint parameter validation, submitting a value like 42.0 caused the dependency's int() parse to fail — leaving the DAG unresolved and falling back to a caller-supplied DAG ID — while the handler successfully coerced 42.0 to 42 and served the request against backfill 42. This mismatch allowed an attacker to steer the authorization check toward a DAG they control while the handler operated on a different, unauthorized DAG. Since backfill IDs are sequential integers, enumerating targets requires no special knowledge (GitHub PR, oss-security).

An authenticated user holding edit permission on any single DAG can read, pause, cancel, and fail backfills belonging to any other DAG in the Airflow instance — including moving another DAG's queued runs to failed status. This constitutes unauthorized cross-DAG access affecting confidentiality (reading backfill details of other DAGs) and integrity (disrupting or terminating scheduled pipeline runs). No non-default configuration is required to exploit the flaw, and the impact extends across the entire Airflow instance's backfill operations (Apache Advisory, GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires authentication but no elevated privileges beyond edit access to at least one DAG, which is a common permission in multi-tenant Airflow deployments. The EPSS score is approximately 0.154% (0.416% per GitHub Advisory), placing it in the 35th percentile for exploitation likelihood. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The sequential nature of backfill IDs makes target enumeration trivial once access is obtained (GitHub Advisory).

1. Authenticate: Obtain valid credentials for an Apache Airflow instance running a version before 3.3.1, with at least edit permission on one DAG.
2. Identify a target backfill: Since backfill IDs are sequential integers, enumerate candidate IDs by sending requests to the Backfill API (e.g., GET /api/v1/backfills/{id}) starting from 1 and incrementing.
3. Craft a malformed backfill_id: Construct a request using a decimal-formatted integer string (e.g., 42.0 or 42.00) as the backfill_id path segment — values that Pydantic's NonNegativeInt accepts but Python's int() rejects.
4. Supply an authorized DAG ID: Include a DAG ID in the request body or query parameter that the attacker has edit permission on, to pass the authorization check.
5. Trigger the mismatch: FastAPI resolves the authorization dependency first; int('42.0') raises ValueError, leaving the DAG unresolved and falling back to the attacker-supplied DAG ID. The handler then parses 42.0 as 42 via Pydantic and serves the request against backfill 42.
6. Perform unauthorized actions: Read backfill details, pause, cancel, or move queued runs of the target DAG to failed status — all without holding permissions on that DAG (GitHub PR, oss-security).

• Network: HTTP requests to Backfill API endpoints (e.g., GET /api/v1/backfills/<id>, POST /api/v1/backfills/<id>/cancel) where the backfill_id path segment contains a decimal-formatted integer (e.g., 42.0, 42.00) rather than a plain integer.
• Logs: Airflow API access logs showing a single authenticated user accessing backfill IDs associated with multiple different DAGs, particularly DAGs the user does not normally interact with; sequential enumeration of backfill IDs in a short time window.
• Logs: Unexpected DAG run state transitions to failed for backfills not initiated or managed by the authenticated user making the API calls.
• Behavioral: A user with edit permission on only one DAG performing pause or cancel operations on backfills belonging to other DAGs, which would be anomalous under normal authorization controls.

The primary remediation is to upgrade Apache Airflow to version 3.3.1 or later, which fixes the issue by parsing backfill_id using the same TypeAdapter(NonNegativeInt) that the route handlers declare, eliminating the divergence (Apache Advisory, GitHub PR). If an immediate upgrade is not feasible, administrators should restrict DAG edit permissions to only fully trusted users and implement network-level access controls to limit exposure of the Backfill API endpoints. Monitoring API logs for anomalous cross-DAG backfill access patterns can help detect exploitation attempts in the interim.

The vulnerability was credited to Jarek Potiuk (Apache Airflow committer) as the remediation developer, and the fix was merged into the Airflow main branch on August 4, 2026, ahead of the public disclosure on August 12, 2026 (oss-security, GitHub PR). The NixOS security tracker also flagged the issue for the apache-airflow package in nixpkgs. Community reaction has been measured, consistent with the moderate severity and authentication requirement of the flaw.