CVE-2026-75158
mediumpriority · track · 0EPSS 0.006 · 50 %ileDEUSEPSS · scored 2026-10-27
Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events — including the source Dag ID, task ID, run ID and event timestamps — for Dags they have no permission to see. Because the filter was also absent from the count query, `total_entries` and pagination disclosed the existence of hidden Dags even without inspecting individual rows. Deployments are affected whenever per-Dag access control is used to separate teams or tenants; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (5)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-3493Apache Airflow: Mehrere SchwachstellenDeutsch2026-09-21csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um Informationen offenzulegen, falsche Informationen darzustellen oder Sicherheitsmaßnahmen zu umgehen.
- BIT-airflow-2026-75158Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter2026-09-26vendor · osvUS
Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events — including the source Dag ID, task ID, run ID and event timestamps — for Dags they have no permission to see. Because the filter was also absent from the count query, `total_entries` and pagination disclosed the existence of hidden Dags even without inspecting individual rows. Deployments are affected whenever per-Dag access control is used to separate teams or tenants; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.
- PYSEC-2026-39882026-09-21vendor · osvUS
Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events — including the source Dag ID, task ID, run ID and event timestamps — for Dags they have no permission to see. Because the filter was also absent from the count query, `total_entries` and pagination disclosed the existence of hidden Dags even without inspecting individual rows. Deployments are affected whenever per-Dag access control is used to separate teams or tenants; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.
also known as (2)
Other names and identifiers for this entity.
- BIT-airflow-2026-75158osv
- PYSEC-2026-3988osv
sources
Which sources assert this record, and when.
references (3) nvd
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2026/09/21/3Mailing ListThird Party Advisory
- https://github.com/apache/airflow/pull/71741Issue TrackingVendor Advisory
- https://lists.apache.org/thread/rx5lg86l0qkjl2s7dtmpqxjq0xplr4fyMailing ListVendor Advisory
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan