Airflow asset API returns Dag IDs callers cannot read
Original title: CVE-2026-111454: Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read
Authenticated users with asset read access can learn scheduled, producing, or consuming Dag IDs before 3.4.0.
Apache Airflow before 3.4.0 returns, from asset API endpoints, the IDs of Dags scheduled on, producing, or consuming an asset without checking whether the caller may read those Dags. An authenticated user with asset read access could learn Dag IDs they are not authorized to see. Users are advised to upgrade to apache-airflow 3.4.0 or later. Severity is low.
- CVE-2026-111454 affects Apache Airflow before 3.4.0.
- The leak covers scheduled, producing, and consuming Dag IDs.
- Only Dag identifiers are described as exposed, not Dag contents.
- The stated fix is apache-airflow 3.4.0 or later.
Impact: Disclosure of Dag IDs the caller cannot read
| Product | Affected | Fixed in |
|---|---|---|
| Apache Airflow | before 3.4.0 | 3.4.0 |
- 1.Upgrade to apache-airflow 3.4.0 or later.
- CVEs
- CVE-2026-111454
- Vendors
- Apache
- Products
- Apache Airflow
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111454 | Info Disclosure: Apache Airflow Asset API Leaks DAG IDs | — | — |
From the original article
Posted by Rahul Vats on Nov 08 Severity: low Affected versions: - Apache Airflow before 3. 4. 0 Description: Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset without checking whether the caller may read those Dags.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.