{"id":"CVE-2026-111455","kind":"vulnerability","aliases":["CVE-2026-111455"],"related":[],"title":"Apache Airflow: connection test can overwrite another user's connection","description":"Apache Airflow's asynchronous connection test checked permissions when the test was queued — only create permission when the connection ID did not exist yet — but, when the test completed with `commit_on_success`, wrote the tested connection under that ID. A user allowed to create but not edit connections could overwrite a connection someone else had created in the meantime. Only deployments that enable the non-default `[core] test_connection` setting are affected. Users are advised to upgrade to apache-airflow 3.4.0 or later.","summary":"Apache Airflow's asynchronous connection test checked permissions only when queued, so a user with create-only rights can overwrite a connection someone else created in the meantime. The overwrite happens when a test completes with commit_on_success.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-airflow","python","runtime","self-hosted"],"not_affected_if":["default-config","test-connection-disabled"],"how_to_check":"- Check whether `[core] test_connection` is enabled in airflow.cfg or the `AIRFLOW__CORE__TEST_CONNECTION` environment variable; only enabled deployments are affected.\n- Check the installed version with `airflow version` or `pip show apache-airflow`; versions before `3.4.0` are affected.","fix":"- apache-airflow: upgrade to `3.4.0` or later","status":"open","published_at":"2026-11-09T10:17:05+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","triaged_at":"2026-11-09T10:26:46+00:00","updated_at":"2026-11-09T10:26:46+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-09T10:26:46Z","model":"claude-haiku-5-5","output":{"fix":"- apache-airflow: upgrade to `3.4.0` or later","reach":"network","title":"Apache Airflow: connection test can overwrite another user's connection","impact":"medium","summary":"Apache Airflow's asynchronous connection test checked permissions only when queued, so a user with create-only rights can overwrite a connection someone else created in the meantime. The overwrite happens when a test completes with commit_on_success.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["apache-airflow","self-hosted","python"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"a create-only user overwrites another user's stored connection credentials","analyst_note":"Attack path to the connection store is not spelled out; the sources give no CVSS score.","how_to_check":"- Check whether `[core] test_connection` is enabled in airflow.cfg or the `AIRFLOW__CORE__TEST_CONNECTION` environment variable; only enabled deployments are affected.\n- Check the installed version with `airflow version` or `pip show apache-airflow`; versions before `3.4.0` are affected.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","test-connection-disabled"],"who_is_affected":"Only Airflow deployments that turn on the non-default `[core] test_connection` setting are exposed. The risk is to teams where some users can create connections but not edit them, since those users can overwrite connections made by others.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000735,"input_tokens":4602,"output_tokens":550,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111455':13A,16A '-2026':12A,15A '3.4.0':148C 'advis':141C 'affect':138C 'airflow':2A,19B,26B,66C,147C 'allow':107C 'anoth':7A 'apach':1A,18B,25B,65C,146C 'apache-airflow':17B,145C 'asynchron':28B,68C 'check':31B,71C 'commit':62B,95C 'complet':60B,93C 'connect':3A,10A,29B,47B,69C,83C,101C,113C,117C,135C 'core':133C 'could':114C 'creat':41B,50B,79C,109C,121C 'create-on':40B 'cve':11A,14A 'default':132C 'deploy':126C 'edit':112C 'els':49B,119C 'enabl':128C 'exist':87C 'happen':56B 'host':24B 'id':84C,104C 'later':150C 'meantim':53B,124C 'non':131C 'non-default':130C 'overwrit':6A,45B,55B,115C 'permiss':32B,72C,80C 'python':20B 'queu':35B,77C 'right':43B 'runtim':21B 'self':23B 'self-host':22B 'set':136C 'someon':48B,118C 'success':64B,97C 'test':4A,30B,59B,70C,75C,92C,100C,134C 'upgrad':143C 'user':8A,38B,106C,139C 'wrote':98C 'yet':88C","nicknames":[],"mitigations":[],"who_affected":"Only Airflow deployments that turn on the non-default `[core] test_connection` setting are exposed. The risk is to teams where some users can create connections but not edit them, since those users can overwrite connections made by others.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheairflow","medium","python","runtime","selfhosted"],"campaign_type":null,"search_a":"'-111455':13A,16A '-2026':12A,15A 'airflow':2A 'anoth':7A 'apach':1A 'connect':3A,10A 'cve':11A,14A 'overwrit':6A 'test':4A 'user':8A","search_b":"'airflow':19B,26B 'apach':18B,25B 'apache-airflow':17B 'asynchron':28B 'check':31B 'commit':62B 'complet':60B 'connect':29B,47B 'creat':41B,50B 'create-on':40B 'els':49B 'happen':56B 'host':24B 'meantim':53B 'overwrit':45B,55B 'permiss':32B 'python':20B 'queu':35B 'right':43B 'runtim':21B 'self':23B 'self-host':22B 'someon':48B 'success':64B 'test':30B,59B 'user':38B","search_c":"'3.4.0':148C 'advis':141C 'affect':138C 'airflow':66C,147C 'allow':107C 'apach':65C,146C 'apache-airflow':145C 'asynchron':68C 'check':71C 'commit':95C 'complet':93C 'connect':69C,83C,101C,113C,117C,135C 'core':133C 'could':114C 'creat':79C,109C,121C 'default':132C 'deploy':126C 'edit':112C 'els':119C 'enabl':128C 'exist':87C 'id':84C,104C 'later':150C 'meantim':124C 'non':131C 'non-default':130C 'overwrit':115C 'permiss':72C,80C 'queu':77C 'set':136C 'someon':118C 'success':97C 'test':70C,75C,92C,100C,134C 'upgrad':143C 'user':106C,139C 'wrote':98C 'yet':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T10:17:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111455","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111455","severity":null,"published_at":"2026-11-09T10:17:05+00:00","modified_at":"2026-11-09T10:17:05+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","fetched_at":"2026-11-09T10:25:48+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}