CVE-2026-75157: Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)
Apache Airflow before 3.3.2 lets any user with Dag read permission delete queued asset events, suppressing asset-triggered scheduling (CVE-2026-75157).
CVE-2026-75157 is a low-severity authorization flaw in Apache Airflow before 3.3.2: the asset queued-events DELETE endpoints checked the caller's Dag-axis permission with READ instead of EDIT. Any authenticated user able to read a Dag could silently delete its queued asset events, suppressing asset-triggered scheduling; fixed versions enforce the EDIT permission.
- Queued-events DELETE endpoints were gated on Dag READ instead of Dag EDIT permission
- Any authenticated user with Dag read access could suppress asset-triggered scheduling
- Fixed in Apache Airflow 3.3.2
- CVEs
- CVE-2026-75157
- Vendors
- Apache
- Products
- Apache Airflow
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-75157 | Improper Authorization in Apache Airflow Lets Read-Only Users Delete Queued Asset Events | 7.5 | <1% | PoC |
From the original article
Posted by Rahul Vats on Sep 17 Severity: low Affected versions: - Apache Airflow before 3. 3. 2 Description: Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `EDIT`.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.