Airflow queued-event delete ignores per-Dag edit checks
Edit rights on one Dag let a user delete queued asset events for every Dag they can read.
34
CVE-2026-111453
Permission Bypass in Apache Airflow 3.3.2 Asset Queued Events API
- CVSS 3.1
- 4.3 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Airflow's asset queuedEvents DELETE API endpoint checks edit permissions on the dag_id query parameter but deletes queued events for every readable Dag. An authenticated user with edit access on one Dag and read access on others can suppress asset-triggered runs for Dags they cannot edit. This affects Apache Airflow 3.3.2 users still impacted after the incomplete CVE-2026-75157 fix.
What to do: Upgrade to Apache Airflow 3.4.0 or later.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Airflow | 3.3.2 | 3.4.0 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the `dag_id` query parameter, but deleted the queued events of every Dag the caller could read. An authenticated user with edit permission on one Dag and read access to others could suppress asset-triggered runs of Dags they cannot edit. This is an incomplete fix for CVE-2026-75157: users who upgraded to apache-airflow 3.3.2 for that fix are still affected and should upgrade to apache-airflow 3.4.0 or later.
- Weakness
- CWE-863
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N