Airflow queued-event delete ignores per-Dag edit checks
Original title: CVE-2026-111453: Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag_id query value but deletes rows for every readable Dag
Edit rights on one Dag let a user delete queued asset events for every Dag they can read.
In Apache Airflow 3.3.2 before 3.4.0, the API that deletes an asset's queued events checks Dag edit permission against the dag_id query parameter, then deletes queued events for every Dag the caller can read. An authenticated user with edit permission on one Dag and read access to others could suppress asset-triggered runs of Dags they cannot edit. The advisory rates this low.
Unconfirmed: The post is cut off, so any further impact or credit is not in the snippet.
- CVE-2026-111453 affects Apache Airflow 3.3.2 before 3.4.0.
- Authorization uses the dag_id query value, not each deleted row.
- The effect is suppressing asset-triggered runs, not reading data.
- Posted severity is low; the note is truncated after "This is".
Impact: Suppress asset-triggered runs of Dags the user cannot edit
| Product | Affected | Fixed in |
|---|---|---|
| Apache Airflow | 3.3.2 before 3.4.0 | 3.4.0 |
- 1.Upgrade Apache Airflow 3.3.2 installations to 3.4.0.
- CVEs
- CVE-2026-111453
- Vendors
- Apache
- Products
- Apache Airflow
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111453 | Permission Bypass in Apache Airflow 3.3.2 Asset Queued Events API | 4.3 | — |
From the original article
Posted by Rahul Vats on Nov 08 Severity: low Affected versions: - Apache Airflow 3. 3. 2 before 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.