{"id":"CVE-2026-111455","published":"2026-11-09T10:17:05.133","lastModified":"2026-11-10T21:12:54.063","description":"Apache Airflow's asynchronous connection test checked permissions when the test was queued — only create permission when the connection ID did not exist yet — but, when the test completed with `commit_on_success`, wrote the tested connection under that ID. A user allowed to create but not edit connections could overwrite a connection someone else had created in the meantime. Only deployments that enable the non-default `[core] test_connection` setting are affected. Users are advised to upgrade to apache-airflow 3.4.0 or later.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://github.com/apache/airflow/pull/74837","tags":[]},{"url":"https://lists.apache.org/thread.html/j3tqo8wd53mcyvkkw4z5pnt9tckks0j2","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/11/09/18","tags":[]}],"exploitRefs":[{"url":"https://github.com/apache/airflow/pull/74837","tags":[]}],"hasPoc":true,"ai":null}