CVE-2026-68971 describes a missing authorization vulnerability (CWE-862) in Apache Airflow's API endpoints related to asset materialization and XCom result checking. Specifically, the endpoints POST /api/v2/assets/{asset_id}/materialize and the wait_dag_run_until_finished check do not properly enforce team-scoped authorization when using a team-aware auth manager. This allows an authenticated user from one team to trigger DAG runs and access XCom data of another team by supplying arbitrary dag_run_id and conf values. The FAB auth manager is unaffected as it lacks multi-team support. The issue is fixed in Apache Airflow 3.3.1 and later by correctly resolving the DAG's team in these endpoints.

In multi-team mode deployments using a team-aware authorization manager, this vulnerability allows an authenticated user to bypass team-based access controls. The user can trigger DAG runs and read XCom results belonging to other teams, potentially leading to unauthorized data access and manipulation of workflows. Deployments using the FAB auth manager are not impacted. There are no known exploits in the wild at this time.

Users should upgrade to Apache Airflow version 3.3.1 or later, which includes fixes that properly enforce team-scoped authorization on the affected endpoints. No other mitigation or temporary workaround is indicated. Patch status is not explicitly stated but the vendor advises upgrading to 3.3.1 or later to resolve the issue.