Apache Airflow: asset API reveals IDs of Dags the caller is not allowed to read

Impact

The asset API endpoints return the IDs of Dags that are scheduled on, produce or consume an asset, without checking whether the caller may read those Dags. A user with asset read access learns the names of pipelines outside their permissions. On a shared Airflow that runs training and data pipelines for several teams, that can reveal what other teams are running. Only identifiers leak, not Dag code, logs or connections.

Who can reach it

An authenticated Airflow user who holds asset read permission. Network access to the Airflow API is required.

What to do

Upgrade to apache-airflow 3.4.0 or later and restart the API server, scheduler and workers. Airflow 2.x is also affected but is end of life and will get no fix, so Airflow 2 deployments have to migrate to 3.4.0 or later.

References

Related entries

• Jenkins: symlink following during item rename discloses arbitrary controller filesCVE-2026-117615 · Jenkins core (item rename directory copy, symlink following)Medium
• ansible-pylibssh / ansible.netcommon: changed SSH host keys silently accepted when auto-add is onCVE-2026-126641 · ansible-pylibssh and ansible.netcommon libssh connection plugin (host key verification)Medium
• AWX: template admin can attach another user's webhook token and have it sent to a destination they controlCVE-2026-126642 · Red Hat Ansible Automation Platform / AWX (job template webhook credentials)Medium
• AAP Gateway Operator: resource-server secret copied in plaintext into the AutomationController custom resourceCVE-2026-126643 · Red Hat Ansible Automation Platform Gateway Operator (AutomationController reconciliation)Medium
• GitLab: group milestones API returns private-project milestone metadata without membershipCVE-2026-13319 · GitLab CE/EE group milestones API (project filter authorization)Medium
• GitLab CE/EE: malformed CSV import lets an authenticated user stall Sidekiq workersCVE-2026-1403 · GitLab CE/EE (CSV import, Sidekiq worker)Medium