Database/Control plane, storage & DevOps

Apache Airflow: queued-event deletion checks edit rights on one Dag but clears events for all readable Dags

CVSS 4.3CVE-2026-111453Control plane, storage & DevOpscurated

Impact

This is an incomplete fix for CVE-2026-75157. The endpoint that deletes an asset's queued events checks edit permission only against the dag_id query parameter, then deletes queued events for every Dag the caller can read. A user who can edit any one Dag can therefore suppress asset-triggered runs of other teams' Dags that they can only read. On a shared GPU cluster, data-dependent training and ETL pipelines then silently fail to schedule, with no error shown to the Dag owner. Deployments that took apache-airflow 3.3.2 for the earlier CVE are still affected.

Who can reach it

An authenticated Airflow user, over the network, who holds edit permission on at least one Dag and read access to the target Dags. Authentication is required.

What to do

Upgrade to apache-airflow 3.4.0 or later and restart the Airflow API server. Upgrading to 3.3.2 does not fix this. Until the upgrade, narrowing Dag read access limits which Dags are exposed.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-111453 https://lists.apache.org/thread.html/z212137tkfobdgl0hnos7qg6w6r1mxw5 https://github.com/apache/airflow/pull/74839 https://www.cve.org/CVERecord?id=CVE-2026-75157

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.