Apache Airflow: asset queued-event deletion gated on READ instead of EDIT permission

Impact

The asset queued-events DELETE endpoints checked the caller's Dag-axis permission with READ rather than EDIT. Any authenticated user who can read a Dag can delete its queued asset events, silently suppressing asset-triggered scheduling for that Dag. On a GPU cluster where data-dependent training and ETL pipelines fire on asset events, a read-only user can stop another team's work from ever being scheduled, with no error surfaced to the owner - the runs simply do not happen. Affected whenever asset-triggered scheduling is in use and Dag read access is broader than Dag edit access, which is the usual RBAC arrangement.

Who can reach it

Any authenticated Airflow user with read access to the target Dag, over the network. No special configuration required.

What to do

Upgrade to apache-airflow 3.3.2 or later and restart the API server. No mitigation short of the upgrade is published other than narrowing Dag read access.

References

Related entries

• Splunk Enterprise Edge Processor sidecar: Prometheus metrics endpoint served without authenticationCVE-2026-76262 · Splunk Enterprise Edge Processor SPL2 Preview sidecar (Prometheus metrics endpoint)High
• Dell OpenManage Server Administrator (network-facing management service): OMSA is the in-band hardware management agentCVE-2026-81438 · Dell OpenManage Server Administrator (network-facing management service)High
• Linux kernel nfsd: uncapped POSIX ACL entry count drives an O(n^2) sort in the NFS serverCVE-2026-89695 · Linux kernel nfsd (NFSv4 POSIX ACL decoder, sort_pacl_range)High
• Linux kernel nfsd: crafted inter-server COPY compound reaches ops with a NULL filehandle and panics nfsdCVE-2026-89696 · Linux kernel nfsd (inter-server COPY, NFSD4_FH_FOREIGN compound dispatch)High
• Linux kernel nfsd: unbounded symlink target length lets a client force multi-MiB kmallocs per COMPOUND opCVE-2026-89699 · Linux kernel nfsd (NFSv4 CREATE symlink decoder, cr_datalen)High
• Linux kernel nfsd: async COPY samples the writeback error cursor late and reports failed copies as durableCVE-2026-89704 · Linux kernel nfsd (async server-side COPY, writeback error cursor in _nfsd_copy_file_range)High