CVE-2026-68968: Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backf

This month

HIGH 7.5REMOTEWATCHLISTUPGRADE

CVE-2026-68968 is a high-severity flaw (CVSS 7.5) affecting airflow. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse. The authorization dependency parsed it with `int()` while the route handler parsed it as pydantic's `NonNegativeInt`, which accepts values `int()` rejects (`1.0` coerces to `1`); FastAPI resolves dependencies before endpoint validation, so the two acted on different Dags. An authenticated user holding

Why this priority

High severity
Remotely exploitable, no login, no user action
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	7.5 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.4% (top 65%)
CISA exploited list	No
Weakness	CWE-436
Published	2026-08-12
Last modified	2026-10-23

Publisher (CNA): Apache Software Foundation · Vendor: apache

Last updated 2026-10-23 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-08-12 16:17 UTCPublished CVE record published
2026-10-23 20:10 UTCUpdated Record last modified

apache airflow UPGRADE

Affected: < 3.3.1

Fixed in: 3.3.1

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy airflow || rpm -q airflow || airflow --version

2. UPGRADE to 3.3.1 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade airflow

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade airflow

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

Python (pip) · apache-airflow · FIXED · 3.3.1 · vulnerable: < 3.3.1 · source

pip install --upgrade "apache-airflow>=3.3.1" pip show apache-airflow

Fedora 46 · clementine · FIXED · 1.4.2-1.fc46 · FEDORA-2026-3e748ef4d3 · source

sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-68968?

airflow: upgrade to 3.3.1. Exact commands for each OS are on this page.

Is CVE-2026-68968 being exploited?

CVE-2026-68968 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-68968 affect?

CVE-2026-68968 affects airflow. Severity is high (CVSS 7.5). Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse. The authorization dependency parsed it with `int()` while the route handler parsed it as pyd

How urgent is CVE-2026-68968?

Priority 45/100. High severity; Remotely exploitable, no login, no user action; On your watchlist

Related CVEs

CVE-2026-67260 HIGH 7.3 UPGRADE Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swe
CVE-2026-67587 HIGH 8.8 UPGRADE Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, whic
CVE-2026-58076 HIGH 8.8 UPGRADE Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class nam
CVE-2026-65017 MEDIUM 6.5 UPGRADE Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments
CVE-2026-59242 MEDIUM 5.4 UPGRADE Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal

References

← Back to latest CVEs