CVE-2026-75157: Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

As cited

Copy frozen at 2026-09-18 07:51 UTC (site build).

vulnerabilities

CVE-2026-75157: Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

CVE-2026-75157 is a low-severity permission flaw in Apache Airflow before version 3.3.2, where asset queued-events DELETE endpoints incorrectly check for Dag READ permission instead of Dag EDIT permission. This allows any authenticated user with read access to a directed acyclic graph (DAG) to delete that DAG's queued asset events, silently disabling asset-triggered scheduling.

Why it matters: Apache Airflow operators should upgrade to version 3.3.2 or later to prevent authenticated users from suppressing asset-triggered scheduling through a read-permission bypass.

Source published

2026-09-18 04:58 UTC

First seen by Cybersecurity Tracker

2026-09-18 06:42 UTC