Three Apache Airflow authorization and token-handling flaws (CVE-2026-75158, CVE-2026-82355, CVE-2026-86473), all fixed in 3.3.2

Apache Airflow patches three Core API authorization flaws in version 3.3.2: an assets events endpoint that leaks events for unauthorized Dags, a session cookie that overrides an explicit bearer token, and a logout that fails to revoke bearer tokens; none are…

Three low-to-moderate severity vulnerabilities in Apache Airflow, all fixed in version 3.3.2, were announced on oss-security on 2026-09-21. CVE-2026-75158 (moderate, Airflow before 3.3.2): the /assets/events API returned asset events for every Dag, including source Dag ID, task ID, run ID, and timestamps, without a per-Dag authorization filter, so any authenticated user with asset-read access could enumerate events for Dags they were not authorized to read. CVE-2026-82355 (low, Airflow 3.3.0 before 3.3.2): when a core API request carried both a session cookie and an Authorization bearer token, Airflow authenticated the cookie principal and ignored the bearer token, reversing the intended precedence; the request executed and was audit-logged as the cookie identity, which the advisory describes as enabling session fixation. CVE-2026-86473 (low, Airflow 3.0.0 before 3.3.2): the Core API logout endpoint revoked only a session token presented as the _token cookie; a bearer credential presented in the Authorization header was not revoked despite a normal logout response, leaving a copied token valid until expiry. None of the three advisories reports exploitation in the wild.

• CVE-2026-75158 is rated moderate and affects Apache Airflow before 3.3.2.
• The /assets/events endpoint omitted a per-Dag authorization filter, exposing Dag ID, task ID, run ID, and timestamps for every Dag to any authenticated user with asset-read access.
• CVE-2026-82355 is rated low and affects Apache Airflow 3.3.0 before 3.3.2.
• A session cookie silently overrides an explicit Authorization bearer token; requests execute and are audit-logged as the cookie identity, a behavior the advisory links to session fixation.
• CVE-2026-86473 is rated low and affects Apache Airflow 3.0.0 before 3.3.2.
• Logout revokes only the _token session cookie; a bearer token remains valid until expiry even after a successful logout response.
• All three flaws are fixed in Apache Airflow 3.3.2.
• All three advisories were posted to oss-security on 2026-09-21 between 17:12 and 17:16 UTC.