Improper Authorization in Apache Airflow Lets Read-Only Users Delete Queued Asset Events
AI analysis
Apache Airflow's asset queued-events DELETE endpoints enforce the wrong authorization check, requiring only Dag-level READ permission where Dag-level EDIT permission is required (CWE-863). Any authenticated user who can read a Dag, even without edit rights, can call these endpoints and delete that Dag's queued asset events. Doing so silently suppresses asset-triggered scheduling for the Dag, a state-changing action that can halt intended pipeline triggers without an obvious error. Any deployment is affected where asset-triggered scheduling is in use and Dag read access is granted more widely than Dag edit access, which is the normal RBAC arrangement and requires no special configuration. No public proof-of-concept or in-the-wild exploitation is known, the issue is not in CISA KEV, and the fix is in apache-airflow 3.3.2 and later.
What to do: Upgrade to apache-airflow 3.3.2 or later. Until then, tighten RBAC so Dag READ is only granted to users who may also implicitly affect the Dag's scheduling, and audit logs for DELETE requests to the asset queued-events endpoints. Check the queued asset events for Dags readable by broad roles for signs of unexpected deletions that would have suppressed asset-triggered runs.
Affected
| Apache Airflow | prior to 3.3.2 (any release exposing the asset queued-events DELETE endpoints; no special configuration required beyond use of asset-triggered scheduling) |
Estimated exposure
largelikely tens of thousands of Airflow deployments (10,000–100,000 range, uncertain) given Airflow's large install base and the prevalence of asset-triggered… — Airflow is one of the most widely deployed workflow orchestrators (tens of thousands of organizations, millions of monthly package downloads), and the affected condition — asset-triggered scheduling with Dag read access broader than edit…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing action gated on a read-only permission. Deployments are affected whenever asset-triggered scheduling is in use and Dag read access is granted more widely than Dag edit access, which is the normal RBAC arrangement; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.