Airflow asset API returns Dag IDs callers cannot read
Authenticated users with asset read access can learn scheduled, producing, or consuming Dag IDs before 3.4.0.
28
CVE-2026-111454
Info Disclosure: Apache Airflow Asset API Leaks DAG IDs
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Airflow asset API endpoints return DAG IDs of those scheduled on, produce, or consume an asset without read authorization checks. Authenticated users with asset read access can query these endpoints to discover unauthorized DAG IDs. This affects all Apache Airflow users with asset permissions before version 3.4.0.
What to do: Upgrade to Apache Airflow 3.4.0 or later. No workaround available.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Airflow | < 3.4.0 | 3.4.0 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset without checking whether the caller may read those Dags. An authenticated user with asset read access could learn the IDs of Dags they are not authorized to see. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.
- Weakness
- CWE-200