Apache Airflow 3.4.0 Fixes Authorization and Secret-Handling Flaws
Tech GuruQuick Answer
Plan the supported Airflow 3.4.0 upgrade and confirm Task SDK 1.4.0. Review DAG-author trust, Celery broker access, multi-team caching and secrets in existing logs; validate access checks and operational workflows.
Confirm Scope And Apply The Supported Remediation
What to do now: Record Airflow and Task SDK versions, executor, DAG-author roles, broker access, auth manager, deadline alerts, connection tests, example DAGs and multi-team/cache settings. Use the per-CVE version matrix. Celery callback execution requires broker write access; cross-team cache disclosure requires both core.multi_team=True and secrets.use_cache=True. The connection-test race requires non-default test_connection; example-DAG injection requires load_examples. Upgrade through the supported Airflow procedure to 3.4.0 or later and verify Task SDK 1.4.0 or later. Pending upgrade, disable example DAGs in production and, for the multi-team secret-cache issue, set secrets.use_cache=False. These targeted workarounds do not correct the other flaws. Test scheduler, workers, API and Triggerer health, representative DAGs, XCom handling, callback execution, logout revocation and authorized versus unauthorized access. Verify secret masking without exposing real credentials in test records; retain versions, configuration and results.
Last verified: 2026-11-09 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Apache Airflow and Apache Airflow Task SDK |
|---|---|
| Advisory | CVE-2026-40913 / CVE-2026-50204 / CVE-2026-68982 / CVE-2026-76185 / CVE-2026-86829 / CVE-2026-82337 / CVE-2026-86468 / CVE-2026-96285 / CVE-2026-113508 / CVE-2026-101031 / CVE-2026-113504 / CVE-2026-107474 / CVE-2026-111395 / CVE-2026-111421 / CVE-2026-111452 / CVE-2026-111453 / CVE-2026-111454 / CVE-2026-111455 |
| CVEs | CVE-2026-101031, CVE-2026-107474, CVE-2026-111395, CVE-2026-111421, CVE-2026-111452, CVE-2026-111453, CVE-2026-111454, CVE-2026-111455, CVE-2026-113504, CVE-2026-113508, CVE-2026-40913, CVE-2026-50204, CVE-2026-68982, CVE-2026-76185, CVE-2026-82337, CVE-2026-86468, CVE-2026-86829, CVE-2026-96285 |
| Authoritative release date | November 9, 2026; the 18 Apache advisories were published between 05:51:05 and 06:12:16 UTC. This grouped notice uses the latest advisory time for ordering. |
| Authority revision date | No separate material revision is stated in the retained Apache notices. |
| Affected versions | Apache Airflow before 3.4.0, subject to the per-CVE starting versions and configuration prerequisites below; Task SDK 1.2.0 before 1.4.0 for CVE-2026-76185. |
| Fixed version | Apache Airflow 3.4.0 or later; Task SDK 1.4.0 or later |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Apache does not confirm exploitation in these advisories.; no exploitation claim is inferred. |
Authority Version and Impact Matrix
| CVE-2026-40913 | Apache Airflow before 3.4.0; Apache impact: Low; released 2026-11-09T05:51:05+00:00 |
|---|---|
| CVE-2026-50204 | Apache Airflow before 3.4.0; Apache impact: Moderate; released 2026-11-09T05:54:27+00:00 |
| CVE-2026-68982 | Apache Airflow before 3.4.0; Apache impact: Important; released 2026-11-09T05:54:42+00:00 |
| CVE-2026-76185 | Apache Airflow Task SDK 1.2.0 before 1.4.0; Apache impact: Important; released 2026-11-09T05:56:26+00:00 |
| CVE-2026-86829 | Apache Airflow before 3.4.0; Apache impact: Important; released 2026-11-09T05:57:58+00:00 |
| CVE-2026-82337 | Apache Airflow before 3.4.0; Apache impact: Moderate; released 2026-11-09T06:00:09+00:00 |
| CVE-2026-86468 | Apache Airflow before 3.4.0; Apache impact: Low; released 2026-11-09T06:03:00+00:00 |
| CVE-2026-96285 | Apache Airflow 3.3.0 before 3.4.0; Apache impact: Moderate; released 2026-11-09T06:03:40+00:00 |
| CVE-2026-113508 | Apache Airflow before 3.4.0; Apache impact: Low; released 2026-11-09T06:04:38+00:00 |
| CVE-2026-101031 | Apache Airflow 3.0.5 before 3.4.0; Apache impact: Low; released 2026-11-09T06:05:41+00:00 |
| CVE-2026-113504 | Apache Airflow before 3.4.0; Apache impact: Moderate; released 2026-11-09T06:06:32+00:00 |
| CVE-2026-107474 | Apache Airflow before 3.4.0; Apache impact: Important; released 2026-11-09T06:06:50+00:00 |
| CVE-2026-111395 | Apache Airflow 3.2.0 before 3.4.0; Apache impact: Moderate; released 2026-11-09T06:08:27+00:00 |
| CVE-2026-111421 | Apache Airflow 3.0.0 before 3.4.0; Apache impact: Moderate; released 2026-11-09T06:10:05+00:00 |
| CVE-2026-111452 | Apache Airflow before 3.4.0; Apache impact: Low; released 2026-11-09T06:10:38+00:00 |
| CVE-2026-111453 | Apache Airflow 3.3.2 before 3.4.0; Apache impact: Low; released 2026-11-09T06:10:57+00:00 |
| CVE-2026-111454 | Apache Airflow before 3.4.0; Apache impact: Low; released 2026-11-09T06:11:29+00:00 |
| CVE-2026-111455 | Apache Airflow 3.3.0 before 3.4.0; Apache impact: Low; released 2026-11-09T06:12:16+00:00 |
Apache uses Low, Moderate and Important impact labels for these issues and does not supply CVSS scores. Airflow 3.3.0–3.3.x is the stated range for CVE-2026-111455 and CVE-2026-96285; 3.3.2–3.3.x for CVE-2026-111453; 3.0.0–3.3.x for CVE-2026-111421; 3.2.0–3.3.x for CVE-2026-111395; and 3.0.5–3.3.x for CVE-2026-101031. Other core advisories state before 3.4.0 without a lower boundary. Deadline-alert and task-controlled XCom issues require the relevant workflows; do not assume every deployment exposes every route.
What Changed
Apache published 18 advisories covering access checks, unsafe object reconstruction, worker callback authentication and disclosure of secrets in APIs and logs. Several fixes close routes left by earlier security updates. The common supported remedy is Airflow 3.4.0; the Task SDK cache flaw is fixed in 1.4.0.
What To Validate Now
- Inventory. Record Airflow and Task SDK versions, executor, DAG-author roles, broker access, auth manager, deadline alerts, connection tests, example DAGs and multi-team/cache settings.
- Establish applicability. Use the per-CVE version matrix. Celery callback execution requires broker write access; cross-team cache disclosure requires both core.multi_team=True and secrets.use_cache=True. The connection-test race requires non-default test_connection; example-DAG injection requires load_examples.
- Remediate. Upgrade through the supported Airflow procedure to 3.4.0 or later and verify Task SDK 1.4.0 or later. Pending upgrade, disable example DAGs in production and, for the multi-team secret-cache issue, set secrets.use_cache=False. These targeted workarounds do not correct the other flaws.
- Validate. Test scheduler, workers, API and Triggerer health, representative DAGs, XCom handling, callback execution, logout revocation and authorized versus unauthorized access. Verify secret masking without exposing real credentials in test records; retain versions, configuration and results.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
An upgrade does not remove secrets already written to audit logs. Apache directs operators to purge affected entries and rotate their secrets. Coordinate protected evidence retention and approved log removal with incident-response and retention owners before rotation. Test database and component compatibility using the supported upgrade procedure.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
- CVE-2026-40913
- CVE-2026-50204
- CVE-2026-68982
- CVE-2026-76185
- CVE-2026-86829
- CVE-2026-82337
- CVE-2026-86468
- CVE-2026-96285
- CVE-2026-113508
- CVE-2026-101031
- CVE-2026-113504
- CVE-2026-107474
- CVE-2026-111395
- CVE-2026-111421
- CVE-2026-111452
- CVE-2026-111453
- CVE-2026-111454
- CVE-2026-111455
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
