https://seclists.org/oss-sec/2026/q3/849: CVE-2026-75158: Apache Airflow: Assets events API turns asset events for every Dag with no per-Dag authorization filter

Q: Which deployments are most exposed to this issue?

Deployments that use per-Dag access control to separate teams or tenants are affected. No special configuration beyond using that authorization model is required.

Q: What access does an attacker need?

An attacker needs to be an authenticated user with asset-read access. They can then enumerate asset events for Dags they are not authorized to read.

Q: What information can be disclosed?

The API can disclose source Dag IDs, task IDs, run IDs, and event timestamps for unauthorized Dags. The total_entries value and pagination can also reveal that hidden Dags exist.

Q: How can this be remediated?

Upgrade Apache Airflow to version 3.3.2 or later. Versions before 3.3.2 are affected.

Published Sep 21, 2026

Updated

Affected Software

1 affected component

Apache Airflow<3.3.2

Frequently Asked Questions

Which deployments are most exposed to this issue?

Deployments that use per-Dag access control to separate teams or tenants are affected. No special configuration beyond using that authorization model is required.

What access does an attacker need?

An attacker needs to be an authenticated user with asset-read access. They can then enumerate asset events for Dags they are not authorized to read.

What information can be disclosed?

The API can disclose source Dag IDs, task IDs, run IDs, and event timestamps for unauthorized Dags. The total_entries value and pagination can also reveal that hidden Dags exist.

How can this be remediated?

Upgrade Apache Airflow to version 3.3.2 or later. Versions before 3.3.2 are affected.