CVE-2026-111454: Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read

Q: Which users can exploit this issue?

An authenticated user who has read access to assets can exploit it. They do not need read permission for the referenced Dags; the affected endpoints may disclose the IDs of Dags they cannot otherwise view.

Q: What information is exposed?

The affected asset API endpoints can reveal IDs of Dags that are scheduled on, produce, or consume an asset. The provided information describes disclosure of Dag IDs, not access to the Dags themselves or their contents.

Q: What is the recommended remediation?

Upgrade apache-airflow to version 3.4.0 or later.

Published Nov 9, 2026

Updated

Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset without checking whether the caller may read those Dags. An authenticated user with asset read access could learn the IDs of Dags they are not authorized to see. Users are advised to upgrade to apache-airflow 3.4.0 or later.

Affected Software

1 affected component

pypi/apache-airflow<3.4.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade apache-airflow to a version that resolves this vulnerability.
Fixed in 3.4.0

Event History

Nov 9, 2026

CVE Published

via MITRE·09:07 AM

Data Sourced

via MITRE·09:07 AM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue?

An authenticated user who has read access to assets can exploit it. They do not need read permission for the referenced Dags; the affected endpoints may disclose the IDs of Dags they cannot otherwise view.

What information is exposed?

The affected asset API endpoints can reveal IDs of Dags that are scheduled on, produce, or consume an asset. The provided information describes disclosure of Dag IDs, not access to the Dags themselves or their contents.

What is the recommended remediation?

Upgrade apache-airflow to version 3.4.0 or later.

CVE-2026-111454: Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read

Affected Software

Remediation

Event History

Frequently Asked Questions

Which users can exploit this issue?

What information is exposed?

What is the recommended remediation?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What information is exposed?

What is the recommended remediation?