CVE-2026-111455

Apache Airflow's asynchronous connection test checked permissions when the test was queued — only create permission when the connection ID did not exist yet — but, when the test completed with commit_on_success, wrote the tested connection under that ID. A user allowed to create but not edit connections could overwrite a connection someone else had created in the meantime. Only deployments that enable the non-default [core] test_connection setting are affected. Users are advised to upgrade to apache-airflow 3.4.0 or later.