Apache Airflow: Unvalidated Input Allows Local Privilege Escalation

Summary

A bug in Apache Airflow's notification system can allow an attacker to gain more access to the system without needing extra permissions. This means an attacker could potentially take control of the system without needing to interact with it. Affected users should update to the latest version of Apache Airflow to prevent exploitation.

What to do

Update google platform/frameworks/base to version 16-qpr2-next:2026-03-01.
Update google platform/frameworks/base to version 15:2026-03-01.
Update google platform/frameworks/base to version 16:2026-03-01.
Update google platform/frameworks/base to version 16-qpr2:2026-03-01.
Update google platform/frameworks/base to version 14:2026-03-01.

Affected software

Vendor	Product	Affected versions	Fix available
google	android	14.0	–
google	android	15.0	–
google	android	16.0	–
google	android	16.0	–
google	android	16.0	–
google	android	16.0	–
google	platform/frameworks/base	> 16-qpr2-next:0 , <= 16-qpr2-next:2026-03-01	16-qpr2-next:2026-03-01
google	platform/frameworks/base	> 15:0 , <= 15:2026-03-01	15:2026-03-01
google	platform/frameworks/base	> 16:0 , <= 16:2026-03-01	16:2026-03-01
google	platform/frameworks/base	> 16-qpr2:0 , <= 16-qpr2:2026-03-01	16-qpr2:2026-03-01
google	platform/frameworks/base	> 14:0 , <= 14:2026-03-01	14:2026-03-01

Original title

In setPackageOrComponentEnabled of ManagedServices.java, there is a possible notification policy desync due to improper input validation. This could lead to local escalation of privilege with no ad...

Original description

In setPackageOrComponentEnabled of ManagedServices.java, there is a possible notification policy desync due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvd CVSS3.1 8.4

Vulnerability type

CWE-20 Improper Input Validation