Apache Airflow Security Bypass Vulnerability

CERT-Bund identified CVE-2026-XXXX (specific CVE number pending) in Apache Airflow Provider for Databricks versions below 1.12.0. The vulnerability enables unauthenticated remote attackers to circumvent existing security controls, potentially gaining unauthorized access to workflows and sensitive data processed by Airflow installations. The CVSS temporal score is 6.4, reflecting active exploitation potential.

Organizations running Apache Airflow with the Databricks provider should immediately verify their installation version and apply the security patch (version 1.12.0 or later). IT security teams should review Airflow deployments for suspicious activity and implement compensating controls until patching is complete. Given CERT-Bund's focus on German federal infrastructure, government agencies and critical service providers should prioritize this update within their patch management cycles.