CVE-2026-75158: Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter

As cited

Copy frozen at 2026-09-21 19:19 UTC (site build).

vulnerabilities

CVE-2026-75158: Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter

Apache Airflow versions before 3.3.2 contain a moderate-severity vulnerability in the /assets/events application programming interface (API) endpoint that returns asset events for all directed acyclic graphs (DAGs) without per-DAG authorization filtering. An authenticated user with asset-read permissions can enumerate asset events, including source DAG ID, task ID, run ID, and timestamps, for DAGs they lack authorization to access.

Why it matters: Airflow administrators and operators managing multi-tenant or access-controlled Airflow deployments face unauthorized information disclosure when authenticated users exploit this enumeration flaw to discover DAG structure and activity across the system.

Source published

2026-09-21 17:12 UTC

First seen by Cybersecurity Tracker

2026-09-21 18:13 UTC