CVE-2026-75158: Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter
Apache Airflow before 3.3.2 lets asset readers enumerate events for every Dag via CVE-2026-75158.
Apache Airflow before 3.3.2 has a moderate authorization flaw, CVE-2026-75158, in the /assets/events API. The endpoint returned asset events for every Dag, including source Dag ID, task ID, run ID, and timestamps, without restricting results to Dags the caller may read. Any authenticated user with asset-read access could enumerate events for unauthorized Dags. The oss-security post does not report active exploitation.
- CVE-2026-75158 is rated moderate and fixed in Airflow 3.3.2.
- The assets events API omitted a per-Dag authorization filter.
- Authenticated asset readers could see Dag, task, run IDs and timestamps.
- No exploitation in the wild is reported in the advisory.
- CVEs
- CVE-2026-75158
- Vendors
- Apache
- Products
- Apache Airflow
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-75158 | Missing per-Dag Authorization in Apache Airflow Assets Events API Leaks Hidden Dag Data | 4.3 | — |
From the original article
Posted by Rahul Vats on Sep 21 Severity: moderate Affected versions: - Apache Airflow before 3. 3. 2 Description: Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.