Three Apache Airflow authorization and token-handling flaws (CVE-2026-75158, CVE-2026-82355, CVE-2026-86473), all fixed in 3.3.2

Apache Airflow patches three Core API authorization flaws in version 3.3.2: an assets events endpoint that leaks events for unauthorized Dags, a session cookie that overrides an explicit bearer token, and a logout that fails to revoke bearer tokens; none are…

Three low-to-moderate severity vulnerabilities in Apache Airflow, all fixed in version 3.3.2, were announced on oss-security on 2026-09-21. CVE-2026-75158 (moderate, Airflow before 3.3.2): the /assets/events API returned asset events for every Dag, including source Dag ID, task ID, run ID, and timestamps, without a per-Dag authorization filter, so any authenticated user with asset-read access could enumerate events for Dags they were not authorized to read. CVE-2026-82355 (low, Airflow 3.3.0 before 3.3.2): when a core API request carried both a session cookie and an Authorization bearer token, Airflow authenticated the cookie principal and ignored the bearer token, reversing the intended precedence; the request executed and was audit-logged as the cookie identity, which the advisory describes as enabling session fixation. CVE-2026-86473 (low, Airflow 3.0.0 before 3.3.2): the Core API logout endpoint revoked only a session token presented as the _token cookie; a bearer credential presented in the Authorization header was not revoked despite a normal logout response, leaving a copied token valid until expiry. None of the three advisories reports exploitation in the wild.