https://seclists.org/oss-sec/2026/q3/820: CVE-2026-75157: Apache Airflow: Asset queued-events DELETE endpoints gated on Dag AD instead of Dag EDIT (asset-trigged scheduling suppssion)
Affected Software
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with Dag read access can delete queued asset events for that Dag, even if they do not have Dag edit access. This is most relevant where Dag read permission is granted more broadly than Dag edit permission.
When is a deployment affected in practice?
The issue affects deployments using asset-triggered scheduling. No special configuration is required beyond that; the normal RBAC arrangement of broader read access than edit access creates the exposure.
What is the impact of deleting queued asset events?
Deleting the events silently suppresses asset-triggered scheduling for the affected Dag. The action changes scheduling state despite being authorized by a read-only permission.
What should teams do if they cannot upgrade immediately?
The provided information identifies upgrade to Apache Airflow 3.3.2 or later as the remediation. It does not provide an alternative mitigation.
How can teams determine whether they may already be exposed?
Review whether the deployment uses asset-triggered scheduling and whether authenticated users have Dag read access without Dag edit access. Apache Airflow versions before 3.3.2 are affected.