Title: Apache Airflow de Apache Software Foundation, Description: Un autor de Dag podría (a) crear un enlace simbólico bajo el directorio de logs de su tarea apuntando a un archivo arbitrario legible por el proceso del servidor API (ataque de ruta de lectura - p. ej. '/etc/pass1d' o 'airflow.cfg') o (b) proporcionar un 'task_id' que contenga secuencias '..' aceptadas por el 'KEY_REGEX' del SDK de Tareas (ataque de ruta de escritura), y en ambos casos el FileTaskHandler resuelve la ruta del log fuera de la 'base_log_folder' configurada, filtrando o sobrescribiendo archivos arbitrarios. Solo afecta a despliegues donde la carpeta de logs del worker es compartida con el servidor API. Se aconseja a los usuarios actualizar a 'apache-airflow' 3.2.2 o posterior. Como mitigación de defensa en profundidad, despliegue el worker y el servidor API con volúmenes de log separados para que las rutas controladas por el worker no puedan alcanzar el sistema de archivos del servidor API.

{"timestamp":"2026-06-02T16:33:03.378849Z","id":"CVE-2026-40861","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Apache Software Foundation","product":"Apache Airflow","defaultStatus":"unaffected","collectionURL":"https://pypi.python.org","packageName":"apache-airflow","versions":[{"version":"0","lessThan":"3.2.2","versionType":"semver","status":"affected"}]}]

OR
          *cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* versions up to (excluding) 3.2.2

Apache Software Foundation: https://github.com/apache/airflow/pull/65325 Types: Issue Tracking, Patch

Apache Software Foundation: https://lists.apache.org/thread/823334db2559xjlwt59gpzjz47thnscl Types: Mailing List, Vendor Advisory

CVE: http://www.openwall.com/lists/oss-security/2026/05/31/1 Types: Mailing List, Third Party Advisory

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

http://www.openwall.com/lists/oss-security/2026/05/31/1

A Dag author could either (a) create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process (read-path attack — e.g. `/etc/passwd` or `airflow.cfg`) or (b) supply a `task_id` containing `..` sequences accepted by the Task SDK's `KEY_REGEX` (write-path attack), and in both cases the FileTaskHandler resolves the log path outside the configured `base_log_folder`, leaking or overwriting arbitrary files. Only affects deployments where the worker log folder is shared with the API server. Users are advised to upgrade to `apache-airflow` 3.2.2 or later. As a defense-in-depth mitigation, deploy the worker and API server with separate log volumes so that worker-controlled paths cannot reach the API server's filesystem.

CWE-59

https://github.com/apache/airflow/pull/65325

https://lists.apache.org/thread/823334db2559xjlwt59gpzjz47thnscl